planarally-bin

maintainer Soapton-1 · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The pip install is used to install the project's own editable package from the verified source tarball, not an external untrusted package, so the risk is low despite the static analysis flag.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The pip install is used to install the project's own editable package from the verified source tarball, not an external untrusted package, so the risk is low despite the static analysis flag.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:38 pip install --upgrade pip

PKGBUILD

1 offending line(s) highlighted

      1pkgname=planarally-bin
    
      2pkgver=2026.1.2
    
      3pkgrel=19
    
      4pkgdesc="PlanarAlly v${pkgver}"
    
      5arch=('x86_64')
    
      6url='https://www.planarally.io'
    
      7license=('MIT')
    
      8
    
      9depends=(
    
      10  'python-aiohttp' 'python-bcrypt' 'python-cryptography'
    
      11  'python-email-validator' 'python-jinja' 'python-peewee'
    
      12  'python-pillow' 'python-pydantic' 'python-rtoml'
    
      13  'python-socketio' 'python-typing_extensions' 'python-watchdog'
    
      14  'nodejs' 'npm' 'git'
    
      15)
    
      16makedepends=('npm' 'nodejs' 'python-virtualenv' 'base-devel' 'python-pip')
    
      17
    
      18source=("https://github.com/Kruptein/PlanarAlly/archive/refs/tags/v${pkgver}.tar.gz")
    
      19sha256sums=('bc73bfc68b8e5bdfe1c5d8ab7165a8171ab48c7a7ece34aede7827a501e00e80')
    
      20
    
      21package() {
    
      22  cd "$srcdir/PlanarAlly-$pkgver"
    
      23
    
      24  cd client
    
      25  npm ci
    
      26  npm run build
    
      27  cd ..
    
      28
    
      29  install -dm755 "$pkgdir/usr/lib/planarally/server"
    
      30  cp -a server/. "$pkgdir/usr/lib/planarally/server/"
    
      31
    
      32  cd "$pkgdir/usr/lib/planarally/server"
    
      33  rm -rf .git
    
      34
    
      35  export LANG=en_US.UTF-8
    
      36  python -m venv venv
    
      37  source venv/bin/activate
    
      38  pip install --upgrade pip
    
      39  pip install -e .
    
      40
    
      41  find "$pkgdir/usr/lib/planarally" -type d -exec chmod 755 {} +
    
      42  find "$pkgdir/usr/lib/planarally" -type f -exec chmod 644 {} +
    
      43
    
      44  # Guys I got the jackpot
    
      45  install -dm777 "$pkgdir/usr/lib/planarally/server/static/assets"
    
      46  install -dm777 "$pkgdir/usr/lib/planarally/server/static/temp"
    
      47  install -dm777 "$pkgdir/usr/lib/planarally/server/data"
    
      48  install -dm777 "$pkgdir/usr/lib/planarally/server/config"
    
      49
    
      50  # Simple launcher - no mkdir needed (dirs pre-created)
    
      51  install -Dm755 /dev/stdin "$pkgdir/usr/bin/planarally" << 'EOF'
    
      52#!/bin/bash
    
      53# Kill any existing instances
    
      54pkill -f planarally.py 2>/dev/null || true
    
      55
    
      56cd /usr/lib/planarally/server
    
      57source venv/bin/activate
    
      58exec python planarally.py "$@"
    
      59EOF
    
      60
    
      61  # Favicon with safety check
    
      62  [[ -f "$srcdir/PlanarAlly-$pkgver/favicon.ico" ]] && \
    
      63    install -Dm644 "$srcdir/PlanarAlly-$pkgver/favicon.ico" \
    
      64      "$pkgdir/usr/share/icons/hicolor/64x64/apps/planarally.png"
    
      65
    
      66  # Desktop entry
    
      67  install -Dm644 /dev/stdin "$pkgdir/usr/share/applications/planarally.desktop" << 'EOF'
    
      68[Desktop Entry]
    
      69Name=PlanarAlly
    
      70Exec=planarally
    
      71Icon=planarally
    
      72Comment=TTRPG Virtual Tabletop
    
      73Categories=Game;RolePlaying;
    
      74Type=Application
    
      75EOF
    
      76}
    
      77

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2