rotki
LOW
maintainer chadsr
1 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The pip install via uv is for pyinstaller, a build tool required to package the application, and occurs in the prepare() phase using the project's own source; this is a normal part of building the package and not a supply-chain risk.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The pip install via uv is for pyinstaller, a build tool required to package the application, and occurs in the prepare() phase using the project's own source; this is a normal part of building the package and not a supply-chain risk.
2 higher static findings superseded - not the current verdict (shown for transparency)
Medium
pip install of an external package
pip_install_external
`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.
-
PKGBUILD:57
uv pip install pyinstaller
Medium
External install via pipx/uv/poetry/cargo/go/gem
alt_pkg_manager_install
A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.
-
PKGBUILD:57
uv pip install pyinstaller
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: chadsr <git at ross dot ch>
2
3
pkgname=rotki
4
pkgver=1.44.0 # renovate: datasource=github-releases depName=rotki/rotki
5
pkgrel=2
6
pkgdesc='A portfolio tracking, analytics, accounting and management application that protects your privacy'
7
arch=('x86_64' 'aarch64')
8
url='https://github.com/rotki/rotki'
9
license=('AGPL-3.0-only')
10
_electron=electron41
11
conflicts=("$pkgname-bin")
12
depends=(
13
"$_electron"
14
'zlib'
15
'hicolor-icon-theme'
16
)
17
makedepends=(
18
'python'
19
'uv'
20
'cargo'
21
'nodejs'
22
'pnpm'
23
'nvm'
24
'libxcrypt-compat'
25
)
26
options=(!lto)
27
source=(
28
"$pkgname-$pkgver.tar.gz::$url/archive/refs/tags/v$pkgver.tar.gz"
29
"rotki.sh"
30
"rotki.desktop"
31
"resources-path.cjs"
32
)
33
b2sums=('809383d9e4f339a89e5acdd2e26e2fb8e73e207b9be8b84421fc5ccf94d3c6f8f504e08241fd978dfa91f4c1cc34360c510c63f615d542e48b1ed6e8157d08b9'
34
'd29df9c9116e94e650552b1bb36fcb546fff001609a264fb4e7fb211d9222d3f974a10bd3108f07d4b5012ebeee27303b422ca96d80f5f6eaf91ccc6a5e3e2d9'
35
'5a82adf633e21f6655532b9fb84c9e38135396e39ace6af82258c5f4ee102cde914ec51e1c33b5f110f7751df9cfa42b62c2ebe39bb174eb92fdfbbb62bb6fba'
36
'dd7658075a2181d7e41b5abc479b0b2beaad8f7ea0406555d805396aabadf5ed7c978d8a60f27fc1fb480ac0e173e52f05226cf44917d783f6fd76d144cca516')
37
38
_ensure_local_nvm() {
39
which nvm >/dev/null 2>&1 && nvm deactivate && nvm unload
40
export NVM_DIR="${srcdir}/.nvm"
41
42
# shellcheck source=/dev/null
43
source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
44
}
45
46
prepare() {
47
cd "$srcdir/$pkgname-$pkgver"
48
_ensure_local_nvm
49
50
export RUSTUP_TOOLCHAIN=stable
51
cargo fetch --locked --target "$(rustc -vV | sed -n 's/host: //p')" \
52
--manifest-path ./Cargo.toml
53
54
uv sync --group packaging
55
56
# Rotki doesn't include pyinstaller as a UV dependency, so install it
57
uv pip install pyinstaller
58
59
cd frontend
60
nvm install
61
nvm use
62
export CYPRESS_INSTALL_BINARY=0 # Avoid downloading Cypress binary during frontend install
63
pnpm install --frozen-lockfile
64
}
65
66
build() {
67
cd "$srcdir/$pkgname-$pkgver"
68
_ensure_local_nvm
69
70
# Build colibri and starling rust binaries
71
export RUSTUP_TOOLCHAIN=stable
72
cargo build \
73
--frozen \
74
--target-dir build/rust \
75
--manifest-path ./Cargo.toml \
76
--release \
77
-p colibri \
78
-p starling
79
80
mkdir -p build/colibri/bin build/starling/bin
81
mv build/rust/release/colibri build/colibri/bin/
82
mv build/rust/release/starling build/starling/bin/
83
84
# Create the Python backend onefile with PyInstaller from rotkehlchen.spec
85
export PYTHONOPTIMIZE=2
86
export SETUPTOOLS_SCM_PRETEND_VERSION="$pkgver"
87
uv run pyinstaller --noconfirm --clean --distpath "${PWD}/build/backend" rotkehlchen.spec
88
89
# Build the Electron frontend
90
cd frontend
91
nvm use
92
export ROTKI_VERSION="$pkgver"
93
pnpm run build
94
pnpm run electron:package -- --dir \
95
-c.electronDist=/usr/lib/$_electron \
96
-c.electronVersion="$(cat /usr/lib/$_electron/version)"
97
}
98
99
package() {
100
cd "$srcdir/$pkgname-$pkgver"
101
102
_resources="frontend/app/build/linux-unpacked/resources"
103
104
# App resources
105
install -d "$pkgdir/usr/lib/$pkgname"
106
install -Dm644 "$_resources/app.asar" "$pkgdir/usr/lib/$pkgname/app.asar"
107
cp -a "$_resources/backend" "$_resources/colibri" "$_resources/starling" "$pkgdir/usr/lib/$pkgname/"
108
109
# Override process.resourcesPath for system electron
110
install -Dm644 "$srcdir/resources-path.cjs" "$pkgdir/usr/lib/$pkgname/resources-path.cjs"
111
112
# Launcher
113
install -Dm755 "$srcdir/rotki.sh" "$pkgdir/usr/bin/rotki"
114
115
# Desktop file
116
install -Dm644 "$srcdir/rotki.desktop" "$pkgdir/usr/share/applications/$pkgname.desktop"
117
118
# Icon
119
install -Dm644 frontend/app/public/assets/images/protocols/rotki.svg \
120
"$pkgdir/usr/share/icons/hicolor/scalable/apps/rotki.svg"
121
122
# License
123
install -Dm644 LICENSE.md "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
124
}
125
Changes since previous scan
--- PKGBUILD @ 2026-09-08 00:18+++ PKGBUILD @ 2026-09-17 00:27@@ -2,7 +2,7 @@ pkgname=rotki pkgver=1.44.0 # renovate: datasource=github-releases depName=rotki/rotki-pkgrel=1+pkgrel=2 pkgdesc='A portfolio tracking, analytics, accounting and management application that protects your privacy' arch=('x86_64' 'aarch64') url='https://github.com/rotki/rotki'@@ -49,7 +49,7 @@ export RUSTUP_TOOLCHAIN=stable cargo fetch --locked --target "$(rustc -vV | sed -n 's/host: //p')" \- --manifest-path ./colibri/Cargo.toml+ --manifest-path ./Cargo.toml uv sync --group packaging @@ -67,16 +67,19 @@ cd "$srcdir/$pkgname-$pkgver" _ensure_local_nvm - # Build colibri rust binary+ # Build colibri and starling rust binaries export RUSTUP_TOOLCHAIN=stable cargo build \ --frozen \- --target-dir build/colibri \- --manifest-path ./colibri/Cargo.toml \- --release+ --target-dir build/rust \+ --manifest-path ./Cargo.toml \+ --release \+ -p colibri \+ -p starling - mkdir -p build/colibri/bin/- mv build/colibri/release/colibri build/colibri/bin/+ mkdir -p build/colibri/bin build/starling/bin+ mv build/rust/release/colibri build/colibri/bin/+ mv build/rust/release/starling build/starling/bin/ # Create the Python backend onefile with PyInstaller from rotkehlchen.spec export PYTHONOPTIMIZE=2@@ -101,7 +104,7 @@ # App resources install -d "$pkgdir/usr/lib/$pkgname" install -Dm644 "$_resources/app.asar" "$pkgdir/usr/lib/$pkgname/app.asar"- cp -a "$_resources/backend" "$_resources/colibri" "$pkgdir/usr/lib/$pkgname/"+ cp -a "$_resources/backend" "$_resources/colibri" "$_resources/starling" "$pkgdir/usr/lib/$pkgname/" # Override process.resourcesPath for system electron install -Dm644 "$srcdir/resources-path.cjs" "$pkgdir/usr/lib/$pkgname/resources-path.cjs"Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 3 |
| 2026-09-16 00:03:17 | Low | 3 |
| 2026-09-15 00:25:31 | Low | 3 |
| 2026-09-14 00:27:57 | Low | 3 |
| 2026-09-13 00:19:54 | Low | 3 |
| 2026-09-12 00:25:17 | Low | 3 |
| 2026-09-11 00:19:22 | Low | 3 |
| 2026-09-10 00:22:44 | Low | 3 |
| 2026-09-09 00:04:09 | Low | 3 |
| 2026-09-08 11:17:13 | Medium | 2 |
| 2026-09-08 00:18:08 | Low | 3 |
| 2026-09-07 00:30:15 | Low | 3 |
| 2026-09-06 00:17:06 | Low | 3 |
| 2026-09-05 00:16:27 | Low | 3 |
| 2026-09-04 00:03:13 | Low | 3 |
| 2026-09-03 00:15:47 | Low | 3 |
| 2026-09-02 00:02:31 | Low | 3 |
| 2026-09-01 00:11:19 | Low | 3 |
| 2026-08-31 00:19:57 | Low | 3 |
| 2026-08-30 00:04:14 | Low | 3 |