qrgen

LOW

maintainer Saber0324 0 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The `uv pip install segno` fetches an external PyPI package (segno) at build time rather than declaring it as a proper dependency, which is non-standard AUR packaging, but segno is a well-known legitimate QR code library and the rest of the build is straightforward compilation from the project's own GitHub source with a verified checksum.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 70%): The `uv pip install segno` fetches an external PyPI package (segno) at build time rather than declaring it as a proper dependency, which is non-standard AUR packaging, but segno is a well-known legitimate QR code library and the rest of the build is straightforward compilation from the project's own GitHub source with a verified checksum.

2 higher static findings superseded - not the current verdict (shown for transparency)

Medium pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:16 uv pip install segno --target=./vendor --no-deps

Medium External install via pipx/uv/poetry/cargo/go/gem alt_pkg_manager_install

A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.

PKGBUILD:16 uv pip install segno --target=./vendor --no-deps

PKGBUILD

1 offending line(s) highlighted

      1pkgname=qrgen
    
      2pkgver=1.0_beta
    
      3pkgrel=1
    
      4pkgdesc="A simple QR code generator"
    
      5arch=('x86_64')
    
      6url="https://github.com/Saber0324/qrgen"
    
      7license=('GPL-3.0-only')
    
      8depends=('python' 'pyside6' 'python-pillow' 'qt6-svg')
    
      9makedepends=('uv' 'python-installer')
    
      10options=(!debug)
    
      11source=("$pkgname-$pkgver.tar.gz::https://github.com/Saber0324/qrgen/archive/refs/tags/v1.0-beta.tar.gz")
    
      12sha256sums=('80b8fb2151c6159e9d3181fd1837b7fb4d077d1cde4f584d59321919a52eb637')
    
      13build() {
    
      14  cd "qrgen-1.0-beta"
    
      15  uv build --wheel
    
      16  uv pip install segno --target=./vendor --no-deps
    
      17}
    
      18package() {
    
      19  cd "qrgen-1.0-beta"
    
      20  PYVER=$(python -c "import sys; print(f'{sys.version_info.major}.{sys.version_info.minor}')")
    
      21  python -m installer --destdir="$pkgdir" dist/*.whl
    
      22  cp -r vendor/* "$pkgdir/usr/lib/python$PYVER/site-packages/"
    
      23  install -Dm755 /dev/stdin "$pkgdir/usr/bin/qrgen" <<'EOF'
    
      24#!/bin/sh
    
      25exec python -m qrgen.main "$@"
    
      26EOF
    
      27  install -Dm644 /dev/stdin "$pkgdir/usr/share/applications/qrgen.desktop" <<'EOF'
    
      28[Desktop Entry]
    
      29Name=qrgen
    
      30Comment=A styled QR code generator
    
      31Exec=qrgen
    
      32Icon=qrgen
    
      33Type=Application
    
      34Categories=Graphics;Utility;
    
      35Terminal=false
    
      36EOF
    
      37}
    
      38

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	3
2026-10-31 00:07:41	Low	3
2026-10-30 00:29:30	Low	3
2026-10-29 00:13:55	Low	3
2026-10-28 00:06:54	Low	3
2026-10-27 00:23:28	Low	3
2026-10-26 00:12:40	Low	3
2026-10-25 00:20:48	Low	3
2026-10-24 00:14:55	Low	3
2026-10-23 00:02:19	Low	3
2026-10-22 00:13:10	Low	3
2026-10-21 00:12:50	Low	3
2026-10-20 00:10:31	Low	3
2026-10-19 00:03:55	Low	3
2026-10-18 00:06:55	Low	3
2026-10-17 00:21:55	Low	3
2026-10-16 00:12:47	Low	3
2026-10-15 00:28:05	Low	3
2026-10-14 00:06:47	Low	3
2026-10-13 00:23:45	Low	3