qrgen

maintainer Saber0324 · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The `uv pip install segno` fetches an external PyPI package (segno) at build time rather than declaring it as a proper dependency, which is non-standard AUR packaging, but segno is a well-known legitimate QR code library and the rest of the build is straightforward compilation from the project's own GitHub source with a verified checksum.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 70%): The `uv pip install segno` fetches an external PyPI package (segno) at build time rather than declaring it as a proper dependency, which is non-standard AUR packaging, but segno is a well-known legitimate QR code library and the rest of the build is straightforward compilation from the project's own GitHub source with a verified checksum.

2 higher static findings superseded - not the current verdict (shown for transparency)

MEDIUM pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:16 uv pip install segno --target=./vendor --no-deps

MEDIUM External install via pipx/uv/poetry/cargo/go/gem alt_pkg_manager_install

A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.

PKGBUILD:16 uv pip install segno --target=./vendor --no-deps

PKGBUILD

1 offending line(s) highlighted

      1pkgname=qrgen
    
      2pkgver=1.0_beta
    
      3pkgrel=1
    
      4pkgdesc="A simple QR code generator"
    
      5arch=('x86_64')
    
      6url="https://github.com/Saber0324/qrgen"
    
      7license=('GPL-3.0-only')
    
      8depends=('python' 'pyside6' 'python-pillow' 'qt6-svg')
    
      9makedepends=('uv' 'python-installer')
    
      10options=(!debug)
    
      11source=("$pkgname-$pkgver.tar.gz::https://github.com/Saber0324/qrgen/archive/refs/tags/v1.0-beta.tar.gz")
    
      12sha256sums=('80b8fb2151c6159e9d3181fd1837b7fb4d077d1cde4f584d59321919a52eb637')
    
      13build() {
    
      14  cd "qrgen-1.0-beta"
    
      15  uv build --wheel
    
      16  uv pip install segno --target=./vendor --no-deps
    
      17}
    
      18package() {
    
      19  cd "qrgen-1.0-beta"
    
      20  PYVER=$(python -c "import sys; print(f'{sys.version_info.major}.{sys.version_info.minor}')")
    
      21  python -m installer --destdir="$pkgdir" dist/*.whl
    
      22  cp -r vendor/* "$pkgdir/usr/lib/python$PYVER/site-packages/"
    
      23  install -Dm755 /dev/stdin "$pkgdir/usr/bin/qrgen" <<'EOF'
    
      24#!/bin/sh
    
      25exec python -m qrgen.main "$@"
    
      26EOF
    
      27  install -Dm644 /dev/stdin "$pkgdir/usr/share/applications/qrgen.desktop" <<'EOF'
    
      28[Desktop Entry]
    
      29Name=qrgen
    
      30Comment=A styled QR code generator
    
      31Exec=qrgen
    
      32Icon=qrgen
    
      33Type=Application
    
      34Categories=Graphics;Utility;
    
      35Terminal=false
    
      36EOF
    
      37}
    
      38

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	3
2026-08-02 00:16:08	LOW	3
2026-08-01 00:11:18	LOW	3
2026-07-31 00:14:10	LOW	3
2026-07-30 00:17:23	LOW	3
2026-07-29 00:25:53	LOW	3
2026-07-28 00:07:28	LOW	3
2026-07-27 00:24:32	LOW	3
2026-07-26 00:07:32	LOW	3
2026-07-25 00:13:44	LOW	3
2026-07-24 00:02:28	LOW	3
2026-07-23 00:14:47	LOW	3
2026-07-22 00:29:32	LOW	3
2026-07-21 00:24:15	LOW	3
2026-07-20 00:19:49	LOW	3
2026-07-19 00:17:08	LOW	3
2026-07-18 00:14:48	LOW	3
2026-07-17 00:06:16	LOW	3
2026-07-16 00:05:41	LOW	3
2026-07-15 00:09:25	LOW	3