rotki
LOW
maintainer chadsr
1 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The pip install via uv installs pyinstaller, a standard build tool required to package the Python backend, and is part of the normal build process for this application; there is no evidence of malicious or untrusted code execution.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The pip install via uv installs pyinstaller, a standard build tool required to package the Python backend, and is part of the normal build process for this application; there is no evidence of malicious or untrusted code execution.
2 higher static findings superseded - not the current verdict (shown for transparency)
Medium
pip install of an external package
pip_install_external
`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.
-
PKGBUILD:57
uv pip install pyinstaller
Medium
External install via pipx/uv/poetry/cargo/go/gem
alt_pkg_manager_install
A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.
-
PKGBUILD:57
uv pip install pyinstaller
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: chadsr <git at ross dot ch>
2
3
pkgname=rotki
4
pkgver=1.44.2 # renovate: datasource=github-releases depName=rotki/rotki
5
pkgrel=1
6
pkgdesc='A portfolio tracking, analytics, accounting and management application that protects your privacy'
7
arch=('x86_64' 'aarch64')
8
url='https://github.com/rotki/rotki'
9
license=('AGPL-3.0-only')
10
_electron=electron41
11
conflicts=("$pkgname-bin")
12
depends=(
13
"$_electron"
14
'zlib'
15
'hicolor-icon-theme'
16
)
17
makedepends=(
18
'python'
19
'uv'
20
'cargo'
21
'nodejs'
22
'pnpm'
23
'nvm'
24
'libxcrypt-compat'
25
)
26
options=(!lto)
27
source=(
28
"$pkgname-$pkgver.tar.gz::$url/archive/refs/tags/v$pkgver.tar.gz"
29
"rotki.sh"
30
"rotki.desktop"
31
"resources-path.cjs"
32
)
33
b2sums=('d8cb0db5419fb6d100f995fd790ad1892c5a2c5113e0b5c6b2ba66cf4bdc2ce159269cb0fa04cfcbeb5278932e62efb4209b971a009f9b47c51ea79edf280c65'
34
'd29df9c9116e94e650552b1bb36fcb546fff001609a264fb4e7fb211d9222d3f974a10bd3108f07d4b5012ebeee27303b422ca96d80f5f6eaf91ccc6a5e3e2d9'
35
'5a82adf633e21f6655532b9fb84c9e38135396e39ace6af82258c5f4ee102cde914ec51e1c33b5f110f7751df9cfa42b62c2ebe39bb174eb92fdfbbb62bb6fba'
36
'dd7658075a2181d7e41b5abc479b0b2beaad8f7ea0406555d805396aabadf5ed7c978d8a60f27fc1fb480ac0e173e52f05226cf44917d783f6fd76d144cca516')
37
38
_ensure_local_nvm() {
39
which nvm >/dev/null 2>&1 && nvm deactivate && nvm unload
40
export NVM_DIR="${srcdir}/.nvm"
41
42
# shellcheck source=/dev/null
43
source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
44
}
45
46
prepare() {
47
cd "$srcdir/$pkgname-$pkgver"
48
_ensure_local_nvm
49
50
export RUSTUP_TOOLCHAIN=stable
51
cargo fetch --locked --target "$(rustc -vV | sed -n 's/host: //p')" \
52
--manifest-path ./Cargo.toml
53
54
uv sync --group packaging
55
56
# Rotki doesn't include pyinstaller as a UV dependency, so install it
57
uv pip install pyinstaller
58
59
cd frontend
60
nvm install
61
nvm use
62
export CYPRESS_INSTALL_BINARY=0 # Avoid downloading Cypress binary during frontend install
63
pnpm install --frozen-lockfile
64
}
65
66
build() {
67
cd "$srcdir/$pkgname-$pkgver"
68
_ensure_local_nvm
69
70
# Build colibri and starling rust binaries
71
export RUSTUP_TOOLCHAIN=stable
72
cargo build \
73
--frozen \
74
--target-dir build/rust \
75
--manifest-path ./Cargo.toml \
76
--release \
77
-p colibri \
78
-p starling
79
80
mkdir -p build/colibri/bin build/starling/bin
81
mv build/rust/release/colibri build/colibri/bin/
82
mv build/rust/release/starling build/starling/bin/
83
84
# Create the Python backend onefile with PyInstaller from rotkehlchen.spec
85
export PYTHONOPTIMIZE=2
86
export SETUPTOOLS_SCM_PRETEND_VERSION="$pkgver"
87
uv run pyinstaller --noconfirm --clean --distpath "${PWD}/build/backend" rotkehlchen.spec
88
89
# Build the Electron frontend
90
cd frontend
91
nvm use
92
export ROTKI_VERSION="$pkgver"
93
pnpm run build
94
pnpm run electron:package -- --dir \
95
-c.electronDist=/usr/lib/$_electron \
96
-c.electronVersion="$(cat /usr/lib/$_electron/version)"
97
}
98
99
package() {
100
cd "$srcdir/$pkgname-$pkgver"
101
102
_resources="frontend/app/build/linux-unpacked/resources"
103
104
# App resources
105
install -d "$pkgdir/usr/lib/$pkgname"
106
install -Dm644 "$_resources/app.asar" "$pkgdir/usr/lib/$pkgname/app.asar"
107
cp -a "$_resources/backend" "$_resources/colibri" "$_resources/starling" "$pkgdir/usr/lib/$pkgname/"
108
109
# Override process.resourcesPath for system electron
110
install -Dm644 "$srcdir/resources-path.cjs" "$pkgdir/usr/lib/$pkgname/resources-path.cjs"
111
112
# Launcher
113
install -Dm755 "$srcdir/rotki.sh" "$pkgdir/usr/bin/rotki"
114
115
# Desktop file
116
install -Dm644 "$srcdir/rotki.desktop" "$pkgdir/usr/share/applications/$pkgname.desktop"
117
118
# Icon
119
install -Dm644 frontend/app/public/assets/images/protocols/rotki.svg \
120
"$pkgdir/usr/share/icons/hicolor/scalable/apps/rotki.svg"
121
122
# License
123
install -Dm644 LICENSE.md "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
124
}
125
Changes since previous scan
--- PKGBUILD @ 2026-10-26 00:12+++ PKGBUILD @ 2026-11-01 00:21@@ -1,8 +1,8 @@ # Maintainer: chadsr <git at ross dot ch> pkgname=rotki-pkgver=1.44.0 # renovate: datasource=github-releases depName=rotki/rotki-pkgrel=2+pkgver=1.44.2 # renovate: datasource=github-releases depName=rotki/rotki+pkgrel=1 pkgdesc='A portfolio tracking, analytics, accounting and management application that protects your privacy' arch=('x86_64' 'aarch64') url='https://github.com/rotki/rotki'@@ -30,7 +30,7 @@ "rotki.desktop" "resources-path.cjs" )-b2sums=('809383d9e4f339a89e5acdd2e26e2fb8e73e207b9be8b84421fc5ccf94d3c6f8f504e08241fd978dfa91f4c1cc34360c510c63f615d542e48b1ed6e8157d08b9'+b2sums=('d8cb0db5419fb6d100f995fd790ad1892c5a2c5113e0b5c6b2ba66cf4bdc2ce159269cb0fa04cfcbeb5278932e62efb4209b971a009f9b47c51ea79edf280c65' 'd29df9c9116e94e650552b1bb36fcb546fff001609a264fb4e7fb211d9222d3f974a10bd3108f07d4b5012ebeee27303b422ca96d80f5f6eaf91ccc6a5e3e2d9' '5a82adf633e21f6655532b9fb84c9e38135396e39ace6af82258c5f4ee102cde914ec51e1c33b5f110f7751df9cfa42b62c2ebe39bb174eb92fdfbbb62bb6fba' 'dd7658075a2181d7e41b5abc479b0b2beaad8f7ea0406555d805396aabadf5ed7c978d8a60f27fc1fb480ac0e173e52f05226cf44917d783f6fd76d144cca516')Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 3 |
| 2026-10-31 00:07:41 | Low | 3 |
| 2026-10-30 00:29:30 | Low | 3 |
| 2026-10-29 00:13:55 | Low | 3 |
| 2026-10-28 00:06:54 | Low | 3 |
| 2026-10-27 00:23:28 | Low | 3 |
| 2026-10-26 09:44:33 | Medium | 2 |
| 2026-10-26 00:12:40 | Low | 3 |
| 2026-10-25 00:20:48 | Low | 3 |
| 2026-10-24 00:14:55 | Low | 3 |
| 2026-10-23 00:02:19 | Low | 3 |
| 2026-10-22 00:13:10 | Low | 3 |
| 2026-10-21 00:12:50 | Low | 3 |
| 2026-10-20 00:10:31 | Low | 3 |
| 2026-10-19 00:03:55 | Low | 3 |
| 2026-10-18 00:06:55 | Low | 3 |
| 2026-10-17 00:21:55 | Low | 3 |
| 2026-10-16 00:12:47 | Low | 3 |
| 2026-10-15 00:28:05 | Low | 3 |
| 2026-10-14 00:06:47 | Low | 3 |