primespecpcr

maintainer michael.gruz · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

broken

Why flagged The PKGBUILD has several issues but the security concern raised by the cheaper model is overstated. The pip install from requirements.txt happens inside a venv with --system-site-packages, and the source is pulled directly from the upstream GitHub repo (same repo as the package itself), so requirements.txt is part of the audited upstream source, not an external unverified file. This is sloppy packaging (using pip inside a PKGBUILD build() instead of proper wheel/installer workflow, and the venv is then copied wholesale into /usr/share), but not a meaningful supply-chain risk beyond what any AUR package already entails. The package is also likely broken: the build() function creates a venv and runs build_executable.py --clean (which presumably produces a binary named PrimeSpecPCR), but the package() function symlinks to ../share/primespecpcr/PrimeSpecPCR which may or may not exist depending on what build_executable.py actually produces. The commented-out code suggests this is a work-in-progress. The desktop entry incorrectly categorizes a bioinformatics tool as a Game. Overall: sloppy/incomplete packaging with no real security threat.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 80%): The PKGBUILD has several issues but the security concern raised by the cheaper model is overstated. The pip install from requirements.txt happens inside a venv with --system-site-packages, and the source is pulled directly from the upstream GitHub repo (same repo as the package itself), so requirements.txt is part of the audited upstream source, not an external unverified file. This is sloppy packaging (using pip inside a PKGBUILD build() instead of proper wheel/installer workflow, and the venv is then copied wholesale into /usr/share), but not a meaningful supply-chain risk beyond what any AUR package already entails. The package is also likely broken: the build() function creates a venv and runs build_executable.py --clean (which presumably produces a binary named PrimeSpecPCR), but the package() function symlinks to ../share/primespecpcr/PrimeSpecPCR which may or may not exist depending on what build_executable.py actually produces. The commented-out code suggests this is a work-in-progress. The desktop entry incorrectly categorizes a bioinformatics tool as a Game. Overall: sloppy/incomplete packaging with no real security threat.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:24 python3 -m pip install -r requirements.txt

PKGBUILD

1 offending line(s) highlighted

      1pkgname=primespecpcr
    
      2_name=PrimeSpecPCR
    
      3pkgver=0.0.1
    
      4pkgrel=1
    
      5pkgdesc="Species-Specific Primer Design Toolkit."
    
      6arch=('any')
    
      7url="https://github.com/Adv20202/PrimeSpecPCR"
    
      8license=('MIT')
    
      9depends=('mafft' 'python' 'python-construct' 'python-biopython' 'primer3-py' 'python-pandas' 'python-numpy' 'python-tqdm' 'python-validators' 'python-requests')
    
      10makedepends=('python-build' 'python-installer' 'python-setuptools' 'python-wheel')
    
      11source=("git+https://github.com/Adv20202/PrimeSpecPCR.git")
    
      12md5sums=('SKIP')
    
      13
    
      14#uild() {
    
      15# cd "$srcdir/$_name"
    
      16#python -m build
    
      17#
    
      18
    
      19build() {
    
      20  cd "$srcdir/$_name"
    
      21  # Instead of doing the full ./bootstrap.sh
    
      22  python3 -m venv env --system-site-packages
    
      23  source env/bin/activate
    
      24  python3 -m pip install -r requirements.txt
    
      25  msg "Starting build..."
    
      26  python build_executable.py --clean
    
      27}
    
      28
    
      29package() {
    
      30  cd "$srcdir/$_name"
    
      31#    python -m installer --destdir="$pkgdir" dist/*.whl
    
      32
    
      33#	install -Dp -m644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      34#	install -Dp -m644 README.md "$pkgdir/usr/share/doc/$pkgname/README.md"
    
      35#  cp -R "help" "build"
    
      36#  cp -R "locale" "build"
    
      37#  python package.py --arch-pkg
    
      38#  cd "build/${pkgname}-arch"
    
      39
    
      40
    
      41#  mkdir -p "${pkgdir}/usr/share/applications"
    
      42#  mv ${pkgname}.desktop "${pkgdir}/usr/share/applications"
    
      43  
    
      44  mkdir -p "${pkgdir}/usr/share/${pkgname}"
    
      45  cp -a -- * "${pkgdir}/usr/share/${pkgname}/"
    
      46  chmod a+x "${pkgdir}/usr/share/${pkgname}/run.py"
    
      47  
    
      48#  mkdir -p "${pkgdir}/usr/share/pixmaps"
    
      49#  ln -s "/usr/share/${pkgname}/dgse_logo_128.png" "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
    
      50  mkdir -p "${pkgdir}/usr/bin"
    
      51#  ln -s ../share/${pkgname}/run.py "${pkgdir}/usr/bin/${pkgname}"
    
      52  ln -s ../share/${pkgname}/PrimeSpecPCR "${pkgdir}/usr/bin/${pkgname}"
    
      53      # Install desktop entry
    
      54  install -Dm644 /dev/stdin "$pkgdir/usr/share/applications/${pkgname}.desktop" << 'EOF'
    
      55[Desktop Entry]
    
      56Name=PrimeSpecPCR
    
      57Comment=Species-Specific Primer Design Toolkit
    
      58Exec=primespecpcr
    
      59Icon=applications-games
    
      60Terminal=false
    
      61Type=Application
    
      62Categories=Game;Utility;
    
      63EOF
    
      64}
    
      65
    
      66# vim: set ft=sh ts=4 sw=4 noet:
    
      67

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2