secfetch

LOW

maintainer ake13-art 1 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The pip install is used to build the package from the project's own source tarball, which is hosted at the project's official GitHub repository and verified by a checksum; this is a normal and safe AUR packaging practice.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The pip install is used to build the package from the project's own source tarball, which is hosted at the project's official GitHub repository and verified by a checksum; this is a normal and safe AUR packaging practice.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:25 PIP_CONFIG_FILE=/dev/null pip install --isolated --root="${pkgdir}" --ignore-installed --no-warn-script-location --root-user-action ignore --no-deps .

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Rafael Dominiquini <rafaeldominiquini at gmail dot com>
    
      2
    
      3pkgname="secfetch"
    
      4pkgver=1.7.0
    
      5pkgrel=1
    
      6pkgdesc="Lightweight security state inspector for Linux"
    
      7
    
      8license=('GPL-3.0')
    
      9arch=('any')
    
      10
    
      11url="https://github.com/ake13-art/secfetch"
    
      12
    
      13provides=("${pkgname}")
    
      14
    
      15makedepends=('python-setuptools' 'python-wheel' 'python-build' 'python-installer' 'python-pip')
    
      16depends=('python')
    
      17
    
      18source=("${pkgname}-${pkgver}.tgz::${url}/archive/refs/tags/v${pkgver}.tar.gz")
    
      19sha256sums=('20da6a5b0926655286c127ec9ad2f6c7bed99a949c5b2eadc1f776a022206374')
    
      20
    
      21
    
      22package() {
    
      23    cd "${srcdir}/${pkgname}-${pkgver}/"
    
      24
    
      25    PIP_CONFIG_FILE=/dev/null pip install --isolated --root="${pkgdir}" --ignore-installed --no-warn-script-location --root-user-action ignore --no-deps .
    
      26
    
      27    python -O -m compileall "${pkgdir}"
    
      28}
    
      29

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 00:13:55	Low	2
2026-10-28 00:06:54	Low	2
2026-10-27 00:23:28	Low	2
2026-10-26 00:12:40	Low	2
2026-10-25 00:20:48	Low	2
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 00:13:10	Low	2
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2
2026-10-13 00:23:45	Low	2