python-rapidocr
LOW
maintainer aliu
1 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The non-standard host (modelscope.cn) hosts model files, which are static data assets required for OCR functionality; these are not executable code, and the package builds from the project's own source, making the risk low despite the untrusted host.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The non-standard host (modelscope.cn) hosts model files, which are static data assets required for OCR functionality; these are not executable code, and the package builds from the project's own source, making the risk low despite the untrusted host.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:32
'https://www.modelscope.cn/models/RapidAI/RapidOCR/resolve/v3.9.0/onnx/PP-OCRv6/det/PP-OCRv6_det_small.onnx'
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: aliu <AA RON LIU <GMAIL.COM> >
2
pkgname=python-rapidocr
3
pkgver=3.9.1
4
pkgrel=1
5
pkgdesc='Cross-runtime OCR library'
6
arch=('any')
7
license=('Apache-2.0')
8
depends=('python>=3.8'
9
'python-pyclipper>=1.2.0'
10
'python-opencv>=4.5.1.48'
11
'python-numpy>=1.19.5' 'python-numpy<3.0.0'
12
'python-six>=1.15.0'
13
'python-shapely>=1.7.1' #'python-shapely!=2.0.4'
14
'python-yaml'
15
'python-pillow'
16
'python-tqdm'
17
'python-omegaconf'
18
'python-requests'
19
'python-colorlog')
20
optdepends=(
21
# Operation requires at least one of these and adjusted engine_type config
22
'python-onnxruntime: Recommended runtime'
23
'python-onnxruntime-cpu: Faster than GPU-accelerated onnxruntime (https://github.com/microsoft/onnxruntime/issues/13198)'
24
'python-openvino: Supported runtime'
25
'python-paddlepaddle: Supported runtime'
26
'python-pytorch: Supported runtime'
27
)
28
makedepends=('python-build' 'python-installer>=1.0.1' 'python-setuptools')
29
url='https://github.com/RapidAI/RapidOCR'
30
source=("https://github.com/RapidAI/RapidOCR/archive/v${pkgver}.tar.gz"
31
# models bundled in PyPI wheel, from default_models.yaml
32
'https://www.modelscope.cn/models/RapidAI/RapidOCR/resolve/v3.9.0/onnx/PP-OCRv6/det/PP-OCRv6_det_small.onnx'
33
'https://www.modelscope.cn/models/RapidAI/RapidOCR/resolve/v3.9.0/onnx/PP-OCRv4/cls/ch_ppocr_mobile_v2.0_cls_mobile.onnx'
34
'https://www.modelscope.cn/models/RapidAI/RapidOCR/resolve/v3.9.0/onnx/PP-OCRv6/rec/PP-OCRv6_rec_small.onnx'
35
# patch-in version number
36
'pyproject.toml.patch')
37
b2sums=('55a3f0e43f0a9d5efdb1fe9acea4ba303b01189ecde92934ac79b067d4d7de827a6d57bb3501a952584956e8de4106fb1ef6df9fc4bfa88192865a32fd54e20d'
38
'22409f1a00b806c03ceefa0a75bb6c43950e7627f33348944ac769a71b9ee8caa6d3142021a56e0a668a13f9ac14fb3486257293397a1c4c32494ca422b25f82'
39
'f0c251313ce88e8ce74ebc995e3d7488541727ac9d242db4089bef7c131b0a8d59e7a322b592f5f07e5702e8d58e232510103f18438b5cb8cbfbb285cd3290a6'
40
'267c40f15280dcfac6930ef69d3106c950c425c1af76c776eedda4fbba7133676b9490f503a212fe73b97f2fd87808430f49bfc6ffda1eadc1f940d0b2a6a84a'
41
'06fdefd3dd0357eec4b82c84ee12369231c2182e005f4b2053077377014fb538981a5b0fb48fa1b53352b736866a86a2fb3367fcc65ba9f283bd796bd5f252d3')
42
43
prepare() {
44
cd "${srcdir}/RapidOCR-${pkgver}/python"
45
46
# Patch in version number without needing to install a nonce dependency
47
# that fetches the version number from git
48
patch < "${srcdir}/pyproject.toml.patch"
49
sed -i "s/VERSION_NUM/\"${pkgver}\"/" pyproject.toml
50
51
rm rapidocr/models/.gitkeep # i don't like you
52
# From prepare_wheel_assets.py, run by gen_whl_to_pypi_rapidocr GH Action
53
mv "${srcdir}/"*.onnx -t rapidocr/models/
54
cat <<- EOF > MANIFEST.in
55
include rapidocr/models/PP-OCRv6_det_small.onnx
56
include rapidocr/models/ch_ppocr_mobile_v2.0_cls_mobile.onnx
57
include rapidocr/models/PP-OCRv6_rec_small.onnx
58
EOF
59
}
60
61
build() {
62
cd "${srcdir}/RapidOCR-${pkgver}/python"
63
python -m build --wheel --no-isolation
64
}
65
66
check() {
67
cd "${srcdir}/RapidOCR-${pkgver}/python/build/lib"
68
if [[ -f /etc/rapidocr/config.yaml ]]; then # Test with old config
69
mv {rapidocr,"${srcdir}"}/config.yaml
70
cp /etc/rapidocr/config.yaml rapidocr/config.yaml
71
cp /usr/lib/python*/site-packages/rapidocr/models/*.onnx --update=none rapidocr/models/
72
fi
73
PYTHONPATH="$PWD" python -m rapidocr.main check
74
}
75
76
package() {
77
cd "${srcdir}/RapidOCR-${pkgver}/python"
78
python -m installer --destdir="${pkgdir}" dist/*.whl
79
# Move config file to /etc
80
mkdir -p "${pkgdir}/etc/rapidocr/"
81
if [[ -f "${srcdir}/config.yaml" ]]; then # created backup during check()
82
mv {"${srcdir}","${pkgdir}"/etc/rapidocr}/config.yaml
83
rm "${pkgdir}"/usr/lib/python*/site-packages/rapidocr/config.yaml
84
else
85
mv "${pkgdir}"/usr/lib/python*/site-packages/rapidocr/config.yaml "${pkgdir}"/etc/rapidocr/config.yaml
86
fi
87
ln -s /etc/rapidocr/config.yaml "$(ls -d "${pkgdir}"/usr/lib/python*/site-packages/rapidocr)/config.yaml"
88
}
89
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |