qrgen

LOW

maintainer Saber0324 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The `uv pip install segno` fetches an external PyPI package (segno) at build time rather than declaring it as a proper dependency, which is non-standard AUR packaging, but segno is a well-known legitimate QR code library and the rest of the build is straightforward compilation from the project's own GitHub source with a verified checksum.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 70%): The `uv pip install segno` fetches an external PyPI package (segno) at build time rather than declaring it as a proper dependency, which is non-standard AUR packaging, but segno is a well-known legitimate QR code library and the rest of the build is straightforward compilation from the project's own GitHub source with a verified checksum.

2 higher static findings superseded - not the current verdict (shown for transparency)

Medium pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:16 uv pip install segno --target=./vendor --no-deps

Medium External install via pipx/uv/poetry/cargo/go/gem alt_pkg_manager_install

A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.

PKGBUILD:16 uv pip install segno --target=./vendor --no-deps

PKGBUILD

1 offending line(s) highlighted

      1pkgname=qrgen
    
      2pkgver=1.0_beta
    
      3pkgrel=1
    
      4pkgdesc="A simple QR code generator"
    
      5arch=('x86_64')
    
      6url="https://github.com/Saber0324/qrgen"
    
      7license=('GPL-3.0-only')
    
      8depends=('python' 'pyside6' 'python-pillow' 'qt6-svg')
    
      9makedepends=('uv' 'python-installer')
    
      10options=(!debug)
    
      11source=("$pkgname-$pkgver.tar.gz::https://github.com/Saber0324/qrgen/archive/refs/tags/v1.0-beta.tar.gz")
    
      12sha256sums=('80b8fb2151c6159e9d3181fd1837b7fb4d077d1cde4f584d59321919a52eb637')
    
      13build() {
    
      14  cd "qrgen-1.0-beta"
    
      15  uv build --wheel
    
      16  uv pip install segno --target=./vendor --no-deps
    
      17}
    
      18package() {
    
      19  cd "qrgen-1.0-beta"
    
      20  PYVER=$(python -c "import sys; print(f'{sys.version_info.major}.{sys.version_info.minor}')")
    
      21  python -m installer --destdir="$pkgdir" dist/*.whl
    
      22  cp -r vendor/* "$pkgdir/usr/lib/python$PYVER/site-packages/"
    
      23  install -Dm755 /dev/stdin "$pkgdir/usr/bin/qrgen" <<'EOF'
    
      24#!/bin/sh
    
      25exec python -m qrgen.main "$@"
    
      26EOF
    
      27  install -Dm644 /dev/stdin "$pkgdir/usr/share/applications/qrgen.desktop" <<'EOF'
    
      28[Desktop Entry]
    
      29Name=qrgen
    
      30Comment=A styled QR code generator
    
      31Exec=qrgen
    
      32Icon=qrgen
    
      33Type=Application
    
      34Categories=Graphics;Utility;
    
      35Terminal=false
    
      36EOF
    
      37}
    
      38

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	3
2026-09-16 00:03:17	Low	3
2026-09-15 00:25:31	Low	3
2026-09-14 00:27:57	Low	3
2026-09-13 00:19:54	Low	3
2026-09-12 00:25:17	Low	3
2026-09-11 00:19:22	Low	3
2026-09-10 00:22:44	Low	3
2026-09-09 00:04:09	Low	3
2026-09-08 00:18:08	Low	3
2026-09-07 00:30:15	Low	3
2026-09-06 00:17:06	Low	3
2026-09-05 00:16:27	Low	3
2026-09-04 00:03:13	Low	3
2026-09-03 00:15:47	Low	3
2026-09-02 00:02:31	Low	3
2026-09-01 00:11:19	Low	3
2026-08-31 00:19:57	Low	3
2026-08-30 00:04:14	Low	3
2026-08-29 00:29:17	Low	3