python-rapidocr

maintainer aliu · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The non-standard host (modelscope.cn) hosts model files, which are static data assets required for OCR functionality; these are not executable code, and the package builds from the project's own source, making the risk low despite the untrusted host.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The non-standard host (modelscope.cn) hosts model files, which are static data assets required for OCR functionality; these are not executable code, and the package builds from the project's own source, making the risk low despite the untrusted host.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:32 'https://www.modelscope.cn/models/RapidAI/RapidOCR/resolve/v3.9.0/onnx/PP-OCRv6/det/PP-OCRv6_det_small.onnx'

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: aliu <AA RON LIU <GMAIL.COM> >
    
      2pkgname=python-rapidocr
    
      3pkgver=3.9.1
    
      4pkgrel=1
    
      5pkgdesc='Cross-runtime OCR library'
    
      6arch=('any')
    
      7license=('Apache-2.0')
    
      8depends=('python>=3.8'
    
      9	'python-pyclipper>=1.2.0'
    
      10	'python-opencv>=4.5.1.48'
    
      11	'python-numpy>=1.19.5' 'python-numpy<3.0.0'
    
      12	'python-six>=1.15.0'
    
      13	'python-shapely>=1.7.1' #'python-shapely!=2.0.4'
    
      14	'python-yaml'
    
      15	'python-pillow'
    
      16	'python-tqdm'
    
      17	'python-omegaconf'
    
      18	'python-requests'
    
      19	'python-colorlog')
    
      20optdepends=(
    
      21	# Operation requires at least one of these and adjusted engine_type config
    
      22	'python-onnxruntime: Recommended runtime'
    
      23	'python-onnxruntime-cpu: Faster than GPU-accelerated onnxruntime (https://github.com/microsoft/onnxruntime/issues/13198)'
    
      24	'python-openvino: Supported runtime'
    
      25	'python-paddlepaddle: Supported runtime'
    
      26	'python-pytorch: Supported runtime'
    
      27)
    
      28makedepends=('python-build' 'python-installer>=1.0.1' 'python-setuptools')
    
      29url='https://github.com/RapidAI/RapidOCR'
    
      30source=("https://github.com/RapidAI/RapidOCR/archive/v${pkgver}.tar.gz"
    
      31	# models bundled in PyPI wheel, from default_models.yaml
    
      32	'https://www.modelscope.cn/models/RapidAI/RapidOCR/resolve/v3.9.0/onnx/PP-OCRv6/det/PP-OCRv6_det_small.onnx'
    
      33	'https://www.modelscope.cn/models/RapidAI/RapidOCR/resolve/v3.9.0/onnx/PP-OCRv4/cls/ch_ppocr_mobile_v2.0_cls_mobile.onnx'
    
      34	'https://www.modelscope.cn/models/RapidAI/RapidOCR/resolve/v3.9.0/onnx/PP-OCRv6/rec/PP-OCRv6_rec_small.onnx'
    
      35	# patch-in version number
    
      36	'pyproject.toml.patch')
    
      37b2sums=('55a3f0e43f0a9d5efdb1fe9acea4ba303b01189ecde92934ac79b067d4d7de827a6d57bb3501a952584956e8de4106fb1ef6df9fc4bfa88192865a32fd54e20d'
    
      38        '22409f1a00b806c03ceefa0a75bb6c43950e7627f33348944ac769a71b9ee8caa6d3142021a56e0a668a13f9ac14fb3486257293397a1c4c32494ca422b25f82'
    
      39        'f0c251313ce88e8ce74ebc995e3d7488541727ac9d242db4089bef7c131b0a8d59e7a322b592f5f07e5702e8d58e232510103f18438b5cb8cbfbb285cd3290a6'
    
      40        '267c40f15280dcfac6930ef69d3106c950c425c1af76c776eedda4fbba7133676b9490f503a212fe73b97f2fd87808430f49bfc6ffda1eadc1f940d0b2a6a84a'
    
      41        '06fdefd3dd0357eec4b82c84ee12369231c2182e005f4b2053077377014fb538981a5b0fb48fa1b53352b736866a86a2fb3367fcc65ba9f283bd796bd5f252d3')
    
      42
    
      43prepare() {
    
      44	cd "${srcdir}/RapidOCR-${pkgver}/python"
    
      45
    
      46	# Patch in version number without needing to install a nonce dependency
    
      47	# that fetches the version number from git
    
      48	patch < "${srcdir}/pyproject.toml.patch"
    
      49	sed -i "s/VERSION_NUM/\"${pkgver}\"/" pyproject.toml
    
      50
    
      51	rm rapidocr/models/.gitkeep  # i don't like you
    
      52	# From prepare_wheel_assets.py, run by gen_whl_to_pypi_rapidocr GH Action
    
      53	mv "${srcdir}/"*.onnx -t rapidocr/models/
    
      54	cat <<- EOF > MANIFEST.in
    
      55	include rapidocr/models/PP-OCRv6_det_small.onnx
    
      56	include rapidocr/models/ch_ppocr_mobile_v2.0_cls_mobile.onnx
    
      57	include rapidocr/models/PP-OCRv6_rec_small.onnx
    
      58	EOF
    
      59}
    
      60
    
      61build() {
    
      62	cd "${srcdir}/RapidOCR-${pkgver}/python"
    
      63	python -m build --wheel --no-isolation
    
      64}
    
      65
    
      66check() {
    
      67	cd "${srcdir}/RapidOCR-${pkgver}/python/build/lib"
    
      68	if [[ -f /etc/rapidocr/config.yaml ]]; then  # Test with old config
    
      69		mv {rapidocr,"${srcdir}"}/config.yaml
    
      70		cp /etc/rapidocr/config.yaml rapidocr/config.yaml
    
      71		cp /usr/lib/python*/site-packages/rapidocr/models/*.onnx --update=none rapidocr/models/
    
      72	fi
    
      73	PYTHONPATH="$PWD" python -m rapidocr.main check
    
      74}
    
      75
    
      76package() {
    
      77	cd "${srcdir}/RapidOCR-${pkgver}/python"
    
      78	python -m installer --destdir="${pkgdir}" dist/*.whl
    
      79	# Move config file to /etc
    
      80	mkdir -p "${pkgdir}/etc/rapidocr/"
    
      81	if [[ -f "${srcdir}/config.yaml" ]]; then  # created backup during check()
    
      82		mv {"${srcdir}","${pkgdir}"/etc/rapidocr}/config.yaml
    
      83		rm "${pkgdir}"/usr/lib/python*/site-packages/rapidocr/config.yaml
    
      84	else
    
      85		mv "${pkgdir}"/usr/lib/python*/site-packages/rapidocr/config.yaml "${pkgdir}"/etc/rapidocr/config.yaml
    
      86	fi
    
      87	ln -s /etc/rapidocr/config.yaml "$(ls -d "${pkgdir}"/usr/lib/python*/site-packages/rapidocr)/config.yaml"
    
      88}
    
      89

Changes since previous scan

--- PKGBUILD @ 2026-07-21 00:24
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,6 +1,6 @@
 # Maintainer: aliu <AA RON LIU <GMAIL.COM> >
 pkgname=python-rapidocr
-pkgver=3.9.0
+pkgver=3.9.1
 pkgrel=1
 pkgdesc='Cross-runtime OCR library'
 arch=('any')
@@ -34,7 +34,7 @@
 	'https://www.modelscope.cn/models/RapidAI/RapidOCR/resolve/v3.9.0/onnx/PP-OCRv6/rec/PP-OCRv6_rec_small.onnx'
 	# patch-in version number
 	'pyproject.toml.patch')
-b2sums=('924ce6b578cf421c5b0ad2b4243e7f81cc86cbfa5a66e036f912367a997ec39ef5ca8b110cbe7b9669d2dfdad598a9f4f8f15c6ca2dfd3569f15b065d2c87d25'
+b2sums=('55a3f0e43f0a9d5efdb1fe9acea4ba303b01189ecde92934ac79b067d4d7de827a6d57bb3501a952584956e8de4106fb1ef6df9fc4bfa88192865a32fd54e20d'
         '22409f1a00b806c03ceefa0a75bb6c43950e7627f33348944ac769a71b9ee8caa6d3142021a56e0a668a13f9ac14fb3486257293397a1c4c32494ca422b25f82'
         'f0c251313ce88e8ce74ebc995e3d7488541727ac9d242db4089bef7c131b0a8d59e7a322b592f5f07e5702e8d58e232510103f18438b5cb8cbfbb285cd3290a6'
         '267c40f15280dcfac6930ef69d3106c950c425c1af76c776eedda4fbba7133676b9490f503a212fe73b97f2fd87808430f49bfc6ffda1eadc1f940d0b2a6a84a'
@@ -65,7 +65,7 @@
 
 check() {
 	cd "${srcdir}/RapidOCR-${pkgver}/python/build/lib"
-	if [[ -f /etc/rapidocr/config.yaml ]]; then
+	if [[ -f /etc/rapidocr/config.yaml ]]; then  # Test with old config
 		mv {rapidocr,"${srcdir}"}/config.yaml
 		cp /etc/rapidocr/config.yaml rapidocr/config.yaml
 		cp /usr/lib/python*/site-packages/rapidocr/models/*.onnx --update=none rapidocr/models/
@@ -76,7 +76,7 @@
 package() {
 	cd "${srcdir}/RapidOCR-${pkgver}/python"
 	python -m installer --destdir="${pkgdir}" dist/*.whl
-	# move config file to /etc
+	# Move config file to /etc
 	mkdir -p "${pkgdir}/etc/rapidocr/"
 	if [[ -f "${srcdir}/config.yaml" ]]; then  # created backup during check()
 		mv {"${srcdir}","${pkgdir}"/etc/rapidocr}/config.yaml
@@ -84,7 +84,6 @@
 	else
 		mv "${pkgdir}"/usr/lib/python*/site-packages/rapidocr/config.yaml "${pkgdir}"/etc/rapidocr/config.yaml
 	fi
-	set -x
 	ln -s /etc/rapidocr/config.yaml "$(ls -d "${pkgdir}"/usr/lib/python*/site-packages/rapidocr)/config.yaml"
 }
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 19:17:41	MEDIUM	1
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2