quam_facere-git

maintainer seraf1 · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The pip installs are for two harmless Python dependencies (mdutils and pymupdf-fonts) from PyPI, which are used by the application; this is a normal part of packaging and not malicious.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The pip installs are for two harmless Python dependencies (mdutils and pymupdf-fonts) from PyPI, which are used by the application; this is a normal part of packaging and not malicious.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:35 pip install --isolated --root="$pkgdir" --ignore-installed --no-deps mdutils
PKGBUILD:36 pip install --isolated --root="$pkgdir" --ignore-installed --no-deps pymupdf-fonts

PKGBUILD

2 offending line(s) highlighted

      1#!/bin/bash
    
      2# shellcheck disable=SC2034
    
      3# shellcheck disable=SC2154
    
      4
    
      5# Maintainer: Philippe.seraphin <philippe(dot)seraphin(at)spn109(dot)fr>
    
      6# Contributor: Philippe.seraphin <philippe(dot)seraphin(at)spn109(dot)fr>
    
      7_pkgname=quam_facere
    
      8pkgname=${_pkgname}-git
    
      9pkgver=0.2.1
    
      10pkgrel=2
    
      11pkgdesc="A comprehensive web-based system for managing IT procedures, operations, and team workflows"
    
      12arch=(any)
    
      13url="https://spn109.fr/qf"
    
      14license=('Apache-2')
    
      15groups=()
    
      16provides=("$_pkgname")
    
      17depends=("python" "python-flask" "python-pyaml" "python-flask-login" "python-flask-migrate" "python-flask-sqlalchemy" "python-sqlalchemy" "python-pygments" "python-werkzeug" "python-pymupdf" "gunicorn")
    
      18optdepends=()
    
      19makedepends=('git' "python-pip")
    
      20conflicts=("$_pkgname")
    
      21replaces=()
    
      22backup=("etc/quam_facere/config.yaml")
    
      23install=install
    
      24source=("${pkgname}::git+https://codeberg.org/spn109/Quam_Facere.git#tag=v${pkgver}")
    
      25md5sums=('SKIP')
    
      26
    
      27build()
    
      28{
    
      29    cd "${srcdir}/${pkgname}" || exit 1
    
      30}
    
      31
    
      32package()
    
      33{
    
      34    PIP_CONFIG_FILE=/dev/null
    
      35    pip install --isolated --root="$pkgdir" --ignore-installed --no-deps mdutils 
    
      36    pip install --isolated --root="$pkgdir" --ignore-installed --no-deps pymupdf-fonts
    
      37
    
      38    cd "${srcdir}/${pkgname}" || exit 1
    
      39    mkdir -p "${pkgdir}/usr/share/${_pkgname}/"
    
      40    mkdir -p "${pkgdir}/usr/lib/systemd/system/"
    
      41    mkdir -p "${pkgdir}/etc/${_pkgname}/"
    
      42    mkdir -p "${pkgdir}/var/lib/${_pkgname}/"
    
      43    cp -R ./qf "${pkgdir}/usr/share/${_pkgname}/"
    
      44    cp config.yaml "${pkgdir}/etc/${_pkgname}/"
    
      45    cp gunicorn.conf.py "${pkgdir}/usr/share/${_pkgname}/"
    
      46    key=$(cat /dev/urandom | head -n 1 |tr -dc '[:alnum:]' |cut -c -32)
    
      47    sed -i -e "s/test_quam_facere/${key}/g" "${pkgdir}/etc/${_pkgname}/config.yaml"
    
      48    chmod +x "${pkgdir}/usr/share/${_pkgname}/qf/main.py"
    
      49    cat <<'eof' > ${pkgdir}/usr/lib/systemd/system/${_pkgname}.service
    
      50[Unit]
    
      51Description=Quam Facere service
    
      52StartLimitIntervalSec=0
    
      53
    
      54[Service]
    
      55Type=simple
    
      56Restart=always
    
      57RestartSec=1
    
      58User=qf
    
      59SetLoginEnvironment=True
    
      60WorkingDirectory=/usr/share/quam_facere/
    
      61ExecStart=/usr/bin/gunicorn qf:app
    
      62
    
      63[Install]
    
      64WantedBy=multi-user.target
    
      65eof
    
      66}
    
      67

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2