quam_facere-git

LOW

maintainer seraf1 1 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The pip installs are for two harmless Python dependencies (mdutils and pymupdf-fonts) from PyPI, which are used by the application; this is a normal part of packaging and not malicious.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The pip installs are for two harmless Python dependencies (mdutils and pymupdf-fonts) from PyPI, which are used by the application; this is a normal part of packaging and not malicious.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:35 pip install --isolated --root="$pkgdir" --ignore-installed --no-deps mdutils
PKGBUILD:36 pip install --isolated --root="$pkgdir" --ignore-installed --no-deps pymupdf-fonts

PKGBUILD

2 offending line(s) highlighted

      1#!/bin/bash
    
      2# shellcheck disable=SC2034
    
      3# shellcheck disable=SC2154
    
      4
    
      5# Maintainer: Philippe.seraphin <philippe(dot)seraphin(at)spn109(dot)fr>
    
      6# Contributor: Philippe.seraphin <philippe(dot)seraphin(at)spn109(dot)fr>
    
      7_pkgname=quam_facere
    
      8pkgname=${_pkgname}-git
    
      9pkgver=0.2.1
    
      10pkgrel=2
    
      11pkgdesc="A comprehensive web-based system for managing IT procedures, operations, and team workflows"
    
      12arch=(any)
    
      13url="https://spn109.fr/qf"
    
      14license=('Apache-2')
    
      15groups=()
    
      16provides=("$_pkgname")
    
      17depends=("python" "python-flask" "python-pyaml" "python-flask-login" "python-flask-migrate" "python-flask-sqlalchemy" "python-sqlalchemy" "python-pygments" "python-werkzeug" "python-pymupdf" "gunicorn")
    
      18optdepends=()
    
      19makedepends=('git' "python-pip")
    
      20conflicts=("$_pkgname")
    
      21replaces=()
    
      22backup=("etc/quam_facere/config.yaml")
    
      23install=install
    
      24source=("${pkgname}::git+https://codeberg.org/spn109/Quam_Facere.git#tag=v${pkgver}")
    
      25md5sums=('SKIP')
    
      26
    
      27build()
    
      28{
    
      29    cd "${srcdir}/${pkgname}" || exit 1
    
      30}
    
      31
    
      32package()
    
      33{
    
      34    PIP_CONFIG_FILE=/dev/null
    
      35    pip install --isolated --root="$pkgdir" --ignore-installed --no-deps mdutils 
    
      36    pip install --isolated --root="$pkgdir" --ignore-installed --no-deps pymupdf-fonts
    
      37
    
      38    cd "${srcdir}/${pkgname}" || exit 1
    
      39    mkdir -p "${pkgdir}/usr/share/${_pkgname}/"
    
      40    mkdir -p "${pkgdir}/usr/lib/systemd/system/"
    
      41    mkdir -p "${pkgdir}/etc/${_pkgname}/"
    
      42    mkdir -p "${pkgdir}/var/lib/${_pkgname}/"
    
      43    cp -R ./qf "${pkgdir}/usr/share/${_pkgname}/"
    
      44    cp config.yaml "${pkgdir}/etc/${_pkgname}/"
    
      45    cp gunicorn.conf.py "${pkgdir}/usr/share/${_pkgname}/"
    
      46    key=$(cat /dev/urandom | head -n 1 |tr -dc '[:alnum:]' |cut -c -32)
    
      47    sed -i -e "s/test_quam_facere/${key}/g" "${pkgdir}/etc/${_pkgname}/config.yaml"
    
      48    chmod +x "${pkgdir}/usr/share/${_pkgname}/qf/main.py"
    
      49    cat <<'eof' > ${pkgdir}/usr/lib/systemd/system/${_pkgname}.service
    
      50[Unit]
    
      51Description=Quam Facere service
    
      52StartLimitIntervalSec=0
    
      53
    
      54[Service]
    
      55Type=simple
    
      56Restart=always
    
      57RestartSec=1
    
      58User=qf
    
      59SetLoginEnvironment=True
    
      60WorkingDirectory=/usr/share/quam_facere/
    
      61ExecStart=/usr/bin/gunicorn qf:app
    
      62
    
      63[Install]
    
      64WantedBy=multi-user.target
    
      65eof
    
      66}
    
      67

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2