savestate

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

• PKGBUILD:61 pip install -r requirements.txt

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD uses PyInstaller to bundle a Python application into a single binary, which is a legitimate packaging approach. However, there are genuine supply-chain concerns: (1) The .spec file is pulled from the HEAD of the main branch (not pinned to the tagged release), meaning it can change at any time without the sha256sum catching it — though it does have a checksum, that checksum will become stale if the branch HEAD changes. (2) pip install -r requirements.txt inside a venv installs PyPI packages whose versions are not pinned in the PKGBUILD itself; the requirements.patch modifies requirements.txt but we cannot see what it does. If requirements.txt lacks pinned versions, arbitrary PyPI package versions could be installed at build time and bundled into the final binary. (3) The final installed artifact is a PyInstaller-bundled binary (dist/SaveState) that contains all bundled Python dependencies — users get an opaque binary rather than inspectable Python code. These are real supply-chain concerns (unpinned transitive dependencies from PyPI bundled into an executed binary, plus a floating branch reference for the spec file), consistent with a MEDIUM rating. There is no evidence of active malice or obfuscation.