salt-venv

maintainer crw · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The PKGBUILD installs Salt into a virtualenv using pip from PyPI with pinned versions. The primary source (salt tarball) is fetched from pypi.io with a sha256sum. The pip install of dependencies is from official PyPI with pinned versions, which is standard practice for virtualenv-based packaging. The cheaper model's concern about PyPI supply-chain risk is a generic theoretical concern that applies to virtually every Python package in the AUR — it is not a specific or elevated risk here. The packages installed are well-known, widely-used libraries (cryptography, PyYAML, tornado, requests, etc.) pinned to specific versions. There is no unofficial or personal host involved, no obfuscation, no binary blobs from unknown sources. The main legitimate concern is that pip dependencies lack hash verification (no --require-hashes), which is sloppy but not a targeted attack. This is a low-severity packaging quality issue, not a medium supply-chain concern.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 82%): The PKGBUILD installs Salt into a virtualenv using pip from PyPI with pinned versions. The primary source (salt tarball) is fetched from pypi.io with a sha256sum. The pip install of dependencies is from official PyPI with pinned versions, which is standard practice for virtualenv-based packaging. The cheaper model's concern about PyPI supply-chain risk is a generic theoretical concern that applies to virtually every Python package in the AUR — it is not a specific or elevated risk here. The packages installed are well-known, widely-used libraries (cryptography, PyYAML, tornado, requests, etc.) pinned to specific versions. There is no unofficial or personal host involved, no obfuscation, no binary blobs from unknown sources. The main legitimate concern is that pip dependencies lack hash verification (no --require-hashes), which is sloppy but not a targeted attack. This is a low-severity packaging quality issue, not a medium supply-chain concern.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:65 $pkgdir${_venv_base}/bin/pip install --upgrade setuptools
PKGBUILD:66 $pkgdir${_venv_base}/bin/pip install cffi==2.0.0 cryptography==46.0.7 distro==1.9.0 Jinja2==3.1.6 looseversion==1.3.0 M2Crypto==0.47.0 MarkupSafe==3.0.3 msgpack==1.1.2 packaging==26.1 pycparser==3.0 PyYAML==6.0.3 pyzmq==27.1.0 tornado==6.1 requests>=2.32.5 msgpack>=1.0.0 msgpack>=1.0.0 jaraco.functools>=4.1.0 jaraco.context>=6.1.0 jaraco.text>=4.0.0 jmespath>=1.1.0 frozenlist>=1.3.0 croniter>=0.3.0,!=0.3.22 timelib>=0.2.5 psutil>=5.0.0

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Charlie Wolf <charlie@wolf.is>
    
      2# Contributor: Johannes Löthberg <johannes@kyriasis.com>
    
      3# Contributor: Morten Linderud <foxboron@archlinux.org>
    
      4# Contributor: Sébastien Luttringer
    
      5# Contributor: Daniel Wallace <danielwallace at gtmanfred dot com>
    
      6# Contributor: Christer Edwards <christer.edwards@gmail.com>
    
      7# Contributor: zer0def <zer0def@github>
    
      8
    
      9_venv_base=/var/lib/salt/venv
    
      10pkgname=salt-venv
    
      11pkgver=3006.23
    
      12pkgrel=4
    
      13pkgdesc='Central system and configuration manager - LTS version running in a Virtualenv with an older python as per the salt supported python guide'
    
      14arch=('any')
    
      15url='http://saltstack.org/'
    
      16license=('Apache')
    
      17replaces=('salt')
    
      18conflicts=('salt')
    
      19makedepends=('python310' 'patchelf' 'rsync')
    
      20backup=('etc/logrotate.d/salt'
    
      21        'etc/salt/master'
    
      22        'etc/salt/minion')
    
      23install=salt.install
    
      24source=("https://pypi.io/packages/source/s/salt/salt-$pkgver.tar.gz"
    
      25        salt.logrotate)
    
      26sha256sums=('89a53ef52bb484f910a4e666810b0d096f0ad42005a54ffd035036d003865e1c'
    
      27            'abecc3c1be124c4afffaaeb3ba32b60dfee8ba6dc32189edfa2ad154ecb7a215')
    
      28
    
      29prepare() {
    
      30  cd salt-$pkgver
    
      31  sed -i '/^contextvars/d' requirements/base.txt
    
      32
    
      33  # remove version requirements for pyzmq, there's no point in it
    
      34  # we only have one version and the "python_version <=> *" checks are discarded
    
      35  # so pyzmq<=20.0.0 ends up in the final requirements.txt
    
      36  echo -e '-r crypto.txt\n\npyzmq' > requirements/zeromq.txt
    
      37  true
    
      38}
    
      39
    
      40build() {
    
      41true
    
      42}
    
      43
    
      44# TODO: Missing salt-factories, pytest-tempdir
    
      45# check() {
    
      46# local site_packages=$(python -c "import site; print(site.getsitepackages()[0])")
    
      47#   cd salt-$pkgver
    
      48#   python setup.py install --root="$PWD/tmp_install" --optimize=1
    
      49#   PYTHONPATH="$PWD/tmp_install/$site_packages:$PYTHONPATH" py.test
    
      50# }
    
      51
    
      52package() {
    
      53  python3.10 -m venv --copies $pkgdir${_venv_base}
    
      54  pacman -Ql python310|cut -c 10-|grep /usr/lib/python3.10|cut -c 10- > $srcdir/lib_list.txt
    
      55  rsync -lvpto --files-from $srcdir/lib_list.txt /usr/lib $pkgdir${_venv_base}/lib/
    
      56  cp /usr/lib/$(ldd $pkgdir${_venv_base}/bin/python|awk '{print $1}'|grep libpython) $pkgdir${_venv_base}/lib/
    
      57  patchelf --set-rpath "${_venv_base}/lib" $pkgdir${_venv_base}/bin/python3.10
    
      58  ln -sf python3.10 $pkgdir${_venv_base}/bin/python3
    
      59  ln -sf python3 $pkgdir${_venv_base}/bin/python
    
      60  $pkgdir${_venv_base}/bin/python3.10 salt-$pkgver/setup.py build
    
      61  
    
      62  install -Dm644 salt.logrotate "$pkgdir"/etc/logrotate.d/salt
    
      63
    
      64
    
      65  $pkgdir${_venv_base}/bin/pip install --upgrade setuptools
    
      66  $pkgdir${_venv_base}/bin/pip install cffi==2.0.0 cryptography==46.0.7 distro==1.9.0 Jinja2==3.1.6 looseversion==1.3.0 M2Crypto==0.47.0 MarkupSafe==3.0.3 msgpack==1.1.2 packaging==26.1 pycparser==3.0 PyYAML==6.0.3 pyzmq==27.1.0 tornado==6.1 requests>=2.32.5 msgpack>=1.0.0 msgpack>=1.0.0 jaraco.functools>=4.1.0 jaraco.context>=6.1.0 jaraco.text>=4.0.0 jmespath>=1.1.0 frozenlist>=1.3.0 croniter>=0.3.0,!=0.3.22 timelib>=0.2.5 psutil>=5.0.0
    
      67  $pkgdir${_venv_base}/bin/python3.10 salt-$pkgver/setup.py --salt-pidfile-dir="/run/salt" install  --skip-build
    
      68  rm $pkgdir${_venv_base}/pyvenv.cfg
    
      69  find $pkgdir${_venv_base} -type f -name '*.pyc' -exec rm {} \;
    
      70  find $pkgdir${_venv_base} -type f -print0 | xargs -0 sed -i "s~$pkgdir~~g"
    
      71  $pkgdir${_venv_base}/bin/python3.10 -m compileall $pkgdir${_venv_base}
    
      72  # default config
    
      73  cd salt-$pkgver
    
      74  install -v -Dm644 conf/master "$pkgdir/etc/salt/master"
    
      75  install -v -Dm644 conf/minion "$pkgdir/etc/salt/minion"
    
      76  mkdir -p $pkgdir/usr/bin
    
      77  for _bin in salt    salt-call   salt-cp   salt-master  salt-pip    salt-run  salt-syndic salt-api  salt-cloud  salt-key  salt-minion  salt-proxy spm  salt-ssh; do
    
      78      ln -s ${_venv_base}/bin/$_bin $pkgdir/usr/bin/$_bin
    
      79  done
    
      80
    
      81  # systemd services
    
      82  for _svc in salt-master.service salt-syndic.service salt-minion.service salt-api.service; do
    
      83    install -v -Dm644 pkg/common/$_svc "$pkgdir/usr/lib/systemd/system/$_svc"
    
      84  done
    
      85
    
      86  rm $pkgdir${_venv_base}/bin/pip*
    
      87  rm $pkgdir${_venv_base}/bin/activate*
    
      88  rm $pkgdir${_venv_base}/bin/Activate*
    
      89
    
      90  install -v -Dm644 pkg/common/salt.zsh "$pkgdir/usr/share/zsh/site-functions/_salt"
    
      91  install -v -Dm644 -t "$pkgdir/usr/share/fish/vendor_completions.d" pkg/common/fish-completions/*
    
      92}
    
      93
    
      94# vim:set ts=2 sw=2 et:
    
      95

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2