sakura-launcher-gui

maintainer lucasandersen · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The pip install is from the project's own requirements.txt within the checked-out Git repository, which is a normal part of building the application from source; the dependencies are not from an external or untrusted origin in a supply-chain sense.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The pip install is from the project's own requirements.txt within the checked-out Git repository, which is a normal part of building the application from source; the dependencies are not from an external or untrusted origin in a supply-chain sense.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:61 pip install -r requirements.txt

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: ResRipper <resripper at connective dot link>
    
      2
    
      3# shellcheck disable=SC2034,SC2148,SC2154
    
      4
    
      5pkgname=sakura-launcher-gui
    
      6pkgver=v1.2.0_beta
    
      7pkgrel=5
    
      8pkgdesc="A simple SakuraLLM launcher"
    
      9arch=(x86_64)
    
      10url='https://github.com/PiDanShouRouZhouXD/Sakura_Launcher_GUI'
    
      11license=('GPL-3.0-only')
    
      12options=(!debug)
    
      13
    
      14makedepends=(
    
      15    git
    
      16    python-pip
    
      17
    
      18    # Lib
    
      19    at-spi2-core
    
      20    cairo
    
      21    freetype2
    
      22    gdk-pixbuf2
    
      23    gtk3
    
      24    harfbuzz
    
      25    libx11
    
      26    libxcb
    
      27    libxkbcommon
    
      28    libxkbcommon-x11
    
      29    pango
    
      30    xcb-util
    
      31    xcb-util-cursor
    
      32    xcb-util-image
    
      33    xcb-util-keysyms
    
      34    xcb-util-renderutil
    
      35    xcb-util-wm
    
      36)
    
      37
    
      38source=(
    
      39    "$pkgname::git+https://github.com/PiDanShouRouZhouXD/Sakura_Launcher_GUI#tag=${pkgver/_/-}"
    
      40    main.spec
    
      41    sakura-launcher-gui.desktop
    
      42    sakura-launcher-gui.png
    
      43)
    
      44
    
      45sha256sums=(
    
      46    fef9109ecf0a0b9effd98a816d805dd20dde5763beea03cf11fb434ee55542cf
    
      47    3471e9b6f5c99f683fc5f60da965d708f396302dfce224138352cd457f4fdb96
    
      48    dc4ecb769e489538a308c6626a305b173c01216f97d570ff52828532cee6f3be
    
      49    307a4a88fcc2c62b11e7ca8cf9310ed0f755d8a5f8f4820d76c5874a980ba3d9
    
      50)
    
      51
    
      52build() {
    
      53    cd "$pkgname" || exit
    
      54
    
      55    # Create build environment
    
      56    python -m venv .venv
    
      57    source .venv/bin/activate
    
      58
    
      59    # Install dependencies
    
      60    echo "$(sed 's/^wmi$//' requirements.txt)" > requirements.txt # Remove WMI
    
      61    pip install -r requirements.txt
    
      62
    
      63    # Build
    
      64    mv -f "$srcdir/main.spec" ./
    
      65    pyinstaller main.spec
    
      66
    
      67    # Clean-up
    
      68    rm -rf .venv
    
      69}
    
      70
    
      71package() {
    
      72    cd "$pkgdir" || exit
    
      73
    
      74    # Icon
    
      75    install -dm0755 "$pkgdir/usr/share/icons/hicolor/256x256/apps/"
    
      76    cp "$srcdir/sakura-launcher-gui.png" "$pkgdir/usr/share/icons/hicolor/256x256/apps/"
    
      77    chmod 644 "$pkgdir/usr/share/icons/hicolor/256x256/apps/sakura-launcher-gui.png"
    
      78
    
      79    # Desktop file
    
      80    install -dm0755 "$pkgdir/usr/share/applications"
    
      81    cp "$srcdir/sakura-launcher-gui.desktop" "$pkgdir/usr/share/applications/"
    
      82    chmod 644 "$pkgdir/usr/share/applications/sakura-launcher-gui.desktop"
    
      83
    
      84    # Install app
    
      85    # TODO: switch to 755 once customized data path is supported
    
      86    install -dm777 "$pkgdir/opt/sakura-launcher-gui"
    
      87    cp "$srcdir/$pkgname/dist/sakura_launcher" "$pkgdir/opt/sakura-launcher-gui/"
    
      88}
    
      89

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2