pkgforge
LOW
maintainer goun7
0 votes
scanned 2026-10-24 00:14:55.209548
Why flagged
The pip install occurs in a local venv to build a sidecar binary from the project's own source, not an external package; the source is from the project's official repository and the build is part of normal packaging.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The pip install occurs in a local venv to build a sidecar binary from the project's own source, not an external package; the source is from the project's official repository and the build is part of normal packaging.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
pip install of an external package
pip_install_external
`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.
-
PKGBUILD:70
.venv/bin/pip install --quiet --upgrade pip -
PKGBUILD:71
.venv/bin/pip install --quiet pyinstaller
PKGBUILD
2 offending line(s) highlighted
1
# Maintainer: goun7 <https://github.com/goun7/pkgforge>
2
pkgname=pkgforge
3
pkgver=2.2.2
4
pkgrel=4
5
pkgdesc="Modern .deb/.rpm package converter, safety analyzer, and lifecycle manager for Arch Linux"
6
arch=('x86_64')
7
url="https://github.com/goun7/pkgforge"
8
license=('GPL-3.0-or-later')
9
depends=(
10
'python'
11
'pacman'
12
'fakeroot'
13
'libarchive'
14
'python-pydantic'
15
'hicolor-icon-theme'
16
'webkit2gtk-4.1'
17
'gtk3'
18
)
19
makedepends=(
20
'git'
21
'python-build'
22
'python-installer'
23
'python-setuptools'
24
'python-wheel'
25
'nodejs'
26
'npm'
27
'rust'
28
'cairo'
29
'pango'
30
'atk'
31
'gdk-pixbuf2'
32
'libsoup3'
33
)
34
optdepends=(
35
'python-pyqt6: Legacy GUI interface (pkgforge gui)'
36
'python-pyqt6-sip: Legacy GUI interface'
37
'python-fastapi: REST API (pkgforge serve-api)'
38
'python-uvicorn: REST API server'
39
'namcap: Static package analysis'
40
'bubblewrap: Build sandbox isolation'
41
'debtap: Legacy DEB conversion fallback'
42
'rpmextract: RPM extraction support'
43
'distrobox: Container fallback support'
44
'clamav: Malware scanning'
45
'trivy: OCI image security scanning'
46
'xdelta3: Binary delta updates'
47
'gnupg: Package signing'
48
)
49
# NOTE: pkgname is itself "pkgforge", so provides/conflicts on "pkgforge" are
50
# self-referential (copied from packaging/aur/pkgforge-git, where they ARE
51
# correct because that package replaces the released one). A package conflicts
52
# with nothing here; keep the -git variant's lines for the real replacement.
53
# NOTE: sha256 verified against the published v2.2.0 tag tarball (2026-09-18).
54
# 2.2.0-4: 100/100 denetim duzeltmeleri (DropZone hata geri bildirimi,
55
# PyQt6 emoji/render hatasi, plugin marketplace bos-vaat duzeltimi).
56
# 2.2.0-3: Tauri desktop binary + sidecar pakete eklendi.
57
# Onceki 2.2.0-1 yalnizca Python wheel'ini iceriyordu (modern arayuz AUR
58
# kullanicilarina ulasmiyordu).
59
source=("$pkgver.tar.gz::https://github.com/goun7/pkgforge/archive/refs/tags/v$pkgver.tar.gz")
60
sha256sums=('60639805e9f53b9087acbb247d7e4f23215934ed59e75359f590405c6537716d')
61
62
build() {
63
cd "$srcdir/pkgforge-$pkgver"
64
python -m build --wheel --no-isolation
65
66
# Tauri desktop binary + Python sidecar (offline, CDN'siz modern UI).
67
# build-sidecar.sh bir venv ister (PyInstaller oradan calisir); AUR
68
# derleme ortaminda sistem Python'i ile sade venv olustur.
69
python -m venv .venv
70
.venv/bin/pip install --quiet --upgrade pip
71
.venv/bin/pip install --quiet pyinstaller
72
.venv/bin/pip install --quiet --no-deps .
73
74
cd desktop
75
# package-lock.json git'te takip edilmediginden tarbolda yok; npm ci
76
# (kilit dosyasi zorunlu) calismaz. npm install kullan.
77
npm install --ignore-scripts
78
VENV_PY="$srcdir/pkgforge-$pkgver/.venv/bin/python" ./scripts/build-sidecar.sh
79
cd src-tauri
80
../node_modules/.bin/tauri build --no-bundle
81
cd "$srcdir/pkgforge-$pkgver"
82
}
83
84
package() {
85
cd "$srcdir/pkgforge-$pkgver"
86
python -m installer --destdir="$pkgdir" dist/*.whl
87
88
# Remove __pycache__ directories (bytecode — unnecessary in packages)
89
find "$pkgdir" -type d -name __pycache__ -exec rm -rf {} + 2>/dev/null || true
90
91
# Tauri desktop binary + sidecar
92
install -Dm755 "desktop/src-tauri/target/release/pkgforge-desktop" \
93
"$pkgdir/usr/lib/pkgforge/desktop/pkgforge-desktop"
94
install -Dm755 "desktop/src-tauri/target/release/pkgforge-sidecar" \
95
"$pkgdir/usr/lib/pkgforge/desktop/pkgforge-sidecar"
96
97
# Desktop entry, icon, metainfo, polkit policy, completions and helper
98
# scripts are shipped by the wheel's data-files and already installed by
99
# `python -m installer` above — do NOT reinstall them here (a manual
100
# install previously produced a duplicate menu entry under a second name).
101
102
# Install systemd timer for delta auto-updates
103
if [ -f data/pkgforge-delta.service ]; then
104
install -Dm644 data/pkgforge-delta.service "$pkgdir/usr/lib/systemd/system/pkgforge-delta.service"
105
install -Dm644 data/pkgforge-delta.timer "$pkgdir/usr/lib/systemd/system/pkgforge-delta.timer"
106
fi
107
}
108
Changes since previous scan
--- PKGBUILD @ 2026-10-18 00:06+++ PKGBUILD @ 2026-10-24 00:14@@ -1,7 +1,7 @@ # Maintainer: goun7 <https://github.com/goun7/pkgforge> pkgname=pkgforge-pkgver=2.2.0-pkgrel=3+pkgver=2.2.2+pkgrel=4 pkgdesc="Modern .deb/.rpm package converter, safety analyzer, and lifecycle manager for Arch Linux" arch=('x86_64') url="https://github.com/goun7/pkgforge"@@ -46,15 +46,18 @@ 'xdelta3: Binary delta updates' 'gnupg: Package signing' )-provides=('pkgforge')-conflicts=('pkgforge')-# NOTE: sha256 verified against the published v2.2.0 tag tarball (2026-09-17).-# 2.2.0-3: Tauri desktop binary + sidecar derlenip pakete eklendi; namcap'in-# isaret ettigi python-pydantic ve hicolor-icon-theme bagimliliklari-# giderildi. Onceki 2.2.0-1 yalnizca Python wheel'ini iceriyordu (modern-# arayuz AUR kullanicilarina ulasmiyordu).+# NOTE: pkgname is itself "pkgforge", so provides/conflicts on "pkgforge" are+# self-referential (copied from packaging/aur/pkgforge-git, where they ARE+# correct because that package replaces the released one). A package conflicts+# with nothing here; keep the -git variant's lines for the real replacement.+# NOTE: sha256 verified against the published v2.2.0 tag tarball (2026-09-18).+# 2.2.0-4: 100/100 denetim duzeltmeleri (DropZone hata geri bildirimi,+# PyQt6 emoji/render hatasi, plugin marketplace bos-vaat duzeltimi).+# 2.2.0-3: Tauri desktop binary + sidecar pakete eklendi.+# Onceki 2.2.0-1 yalnizca Python wheel'ini iceriyordu (modern arayuz AUR+# kullanicilarina ulasmiyordu). source=("$pkgver.tar.gz::https://github.com/goun7/pkgforge/archive/refs/tags/v$pkgver.tar.gz")-sha256sums=('f8181dda7e44bd07e8cfc7f5e40b281a00327b085240717510a7434ea987302e')+sha256sums=('60639805e9f53b9087acbb247d7e4f23215934ed59e75359f590405c6537716d') build() { cd "$srcdir/pkgforge-$pkgver"Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 11:22:05 | Medium | 1 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |
| 2026-10-14 00:06:47 | Low | 2 |
| 2026-10-13 00:23:45 | Low | 2 |
| 2026-10-12 00:18:51 | Low | 2 |
| 2026-10-11 00:26:05 | Low | 2 |
| 2026-10-10 00:11:52 | Low | 2 |
| 2026-10-09 00:05:33 | Low | 2 |
| 2026-10-08 00:28:03 | Low | 2 |
| 2026-10-07 00:21:34 | Low | 2 |
| 2026-10-06 00:13:36 | Low | 2 |