pretix-venv

maintainer orphaned · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The pip install is used to install build dependencies (wheel, gunicorn) and the source package itself from a verified PyPI tarball; this is standard for Python venv packaging and poses no remote code execution risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The pip install is used to install build dependencies (wheel, gunicorn) and the source package itself from a verified PyPI tarball; this is standard for Python venv packaging and poses no remote code execution risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:38 pip3 install wheel gunicorn

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Bjoern Franke <bjo+aur@schafweide.org>
    
      2
    
      3pkgname=pretix-venv
    
      4_pkgname=pretix
    
      5pkgver=4.20.1
    
      6pkgrel=1
    
      7pkgdesc="Ticket shop application for conferences, festivals, concerts, tech events, shows, exhibitions, workshops, barcamps, etc. (venv-version)"
    
      8arch=('any')
    
      9url="https://github.com/pretix/pretix"
    
      10license=('GPL')
    
      11depends=('python' 'postgresql' 'redis' 'nodejs')
    
      12makedeps=('python-pip')
    
      13backup=('etc/pretix/pretix.cfg')
    
      14source=("https://files.pythonhosted.org/packages/source/${_pkgname::1}/$_pkgname/$_pkgname-$pkgver.tar.gz"
    
      15        "$_pkgname-web.service"
    
      16        "$_pkgname-worker.service"
    
      17        "$_pkgname-periodic.service"
    
      18        "$_pkgname-periodic.timer"
    
      19        "$_pkgname.sysusers"
    
      20        "$_pkgname.tmpfiles"
    
      21        "$_pkgname.cfg")
    
      22sha256sums=('cc20bf627c11aa34bafb41b54f0111174bc044bdbf27df57cc60589bdcc005c4'
    
      23            '3cfa382ea4295d2e6eca94acc4cf77b93811d9b9ecee3e549eb445f161adf3ed'
    
      24            'e22f39cf639d797e5c91401050a351754d502c4b179af8450e926679ea31b4c9'
    
      25            '8463729a99776fe56bf5331aae6c2f58683e03c2951810fdb46314bac159beaa'
    
      26            '83c48c5d35a05359b59bff5df90baedb82cb8c0bd8d4f80d8783fdc017d8ac3f'
    
      27            'e49d25f1a308331d56abe4a30db3593da4eb2a316118da46d8fa2e8dbc4569bc'
    
      28            '41d010ed86e8603ce9bfbb603ffdd274b243a3903e579fdb9300f90bc9e87c0b'
    
      29            '37597bd7d2bbd9c1c34317043d88eb61278b7f8d72bc544a6f51457c2cd41f32')
    
      30
    
      31package() {
    
      32  cd $_pkgname-$pkgver
    
      33  export PIP_DISABLE_PIP_VERSION_CHECK=1
    
      34  export PYTHONDONTWRITEBYTECODE=1
    
      35  install -dm0755 -o root "$pkgdir/var/pretix/venv"
    
      36  python3 -m venv "$pkgdir/var/pretix/venv"
    
      37  source "$pkgdir/var/pretix/venv/bin/activate"
    
      38  pip3 install wheel gunicorn
    
      39  pip3 install .  --compile
    
      40  find "$pkgdir"/var/pretix/venv/bin/ \
    
      41    -maxdepth 1 -type f -exec sed -i "s#${pkgdir}/#/#g" {} +
    
      42  find "$pkgdir"/var/pretix/venv/ \
    
      43    -type f -name "*.py[co]" -delete
    
      44  find "$pkgdir"/var/pretix/venv/ \
    
      45    -type d -name "__pycache__" -delete
    
      46  deactivate
    
      47  cd $srcdir
    
      48  install -Dm644 "$_pkgname"{-web,-worker,-periodic}.service -t "$pkgdir/usr/lib/systemd/system/"
    
      49  install -Dm644 "$_pkgname-periodic.timer" -t "$pkgdir/usr/lib/systemd/system/"
    
      50  install -Dm600 "$_pkgname.cfg"   "$pkgdir/etc/$_pkgname/$_pkgname.cfg"
    
      51  install -Dm644 "$_pkgname.sysusers"   "$pkgdir/usr/lib/sysusers.d/$_pkgname.conf"
    
      52  install -Dm644 "$_pkgname.tmpfiles"   "$pkgdir/usr/lib/tmpfiles.d/$_pkgname.conf"
    
      53}
    
      54
    
      55# vim:set ts=2 sw=2 et:
    
      56

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2