sickchill-git

maintainer willemw · 12 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package uses uv to install SickChill from its official GitHub repository or PyPI, which is a legitimate source; the installation is self-contained and relocatable, with no evidence of malicious payloads or unauthorized remote code execution.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package uses uv to install SickChill from its official GitHub repository or PyPI, which is a legitimate source; the installation is self-contained and relocatable, with no evidence of malicious payloads or unauthorized remote code execution.

2 higher static findings superseded - not the current verdict (shown for transparency)

MEDIUM pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:112 uv pip install --cache-dir=../cache --python venv/bin/python --no-config --no-progress setuptools "$_pip_install_arg"

MEDIUM External install via pipx/uv/poetry/cargo/go/gem alt_pkg_manager_install

A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.

PKGBUILD:112 uv pip install --cache-dir=../cache --python venv/bin/python --no-config --no-progress setuptools "$_pip_install_arg"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: willemw <willemw12@gmail.com>
    
      2
    
      3# Use these default values to build to the latest git commit version.
    
      4#SICKCHILL_LATEST_COMMIT=1
    
      5#SICKCHILL_BRANCH=develop
    
      6
    
      7# OR
    
      8
    
      9# Set these values to build the latest release version.
    
      10#SICKCHILL_LATEST_COMMIT=0
    
      11# Or set another branch.
    
      12#SICKCHILL_BRANCH=master
    
      13# And/or set another release.
    
      14#SICKCHILL_VERSION=2024.3.1
    
      15
    
      16# This "PIP install" package is similar to a VCS package.
    
      17# It has a pkgver() function. And a reinstall updates the package.
    
      18# That is the only reason why this package ends on "-git".
    
      19
    
      20pkgname=sickchill-git
    
      21pkgver=2024.3.1.r0.20260307.latest
    
      22pkgrel=1
    
      23pkgdesc='Automatic video library manager for TV shows'
    
      24arch=(any)
    
      25url=https://sickchill.github.io
    
      26license=(GPL-3.0-or-later)
    
      27#depends=(python313) # python310
    
      28#makedepends=(git jq python-virtualenv)
    
      29makedepends=(git jq uv)
    
      30optdepends=(
    
      31  'libmediainfo: determine the resolution of MKV and AVI files with no resolution in the filename'
    
      32  'unrar: for RAR files')
    
      33provides=("${pkgname%-git}")
    
      34conflicts=("${pkgname%-git}")
    
      35options=('!strip')
    
      36install=$pkgname.install
    
      37source=(
    
      38  sickchill.service
    
      39  sickchill.sysusers
    
      40  sickchill.tmpfiles)
    
      41sha256sums=(
    
      42  'd8853cc0816e43d2bb0ea8a1867b6571ecd87552a266261e34c534b5cc3019c5'
    
      43  'aaeb298c9717da8b28853ed15509fb8428d975ae49e8737ebcec15caab9f0978'
    
      44  '2069f15e18fc7dd0f0f25b623f2067fc9028b1ca4122021a62364aa39914f88f')
    
      45
    
      46pkgver() {
    
      47  local version
    
      48  version="$(curl -s "https://pypi.org/pypi/${pkgname%-git}/json" | jq --raw-output --join-output '.info.version')"
    
      49  printf "%s.r0" "$version" | sed 's/\([^-]*-g\)/r\1/;s/-/./g'
    
      50
    
      51  if [[ ! -v SICKCHILL_LATEST_COMMIT ]] || ((SICKCHILL_LATEST_COMMIT)); then
    
      52    # SICKCHILL_LATEST_COMMIT is enabled
    
      53    printf '.%(%Y%m%d)T.latest' '-1'
    
      54  fi
    
      55  return 0
    
      56}
    
      57
    
      58build() {
    
      59  if [[ -v SICKCHILL_LATEST_COMMIT ]] && ! ((SICKCHILL_LATEST_COMMIT)); then
    
      60    # SICKCHILL_LATEST_COMMIT is not set or not enabled
    
      61    SICKCHILL_LATEST_COMMIT=0
    
      62    : "${SICKCHILL_BRANCH:=master}"
    
      63    #: "${SICKCHILL_VERSION:=2024.3.1}"
    
      64  else
    
      65    SICKCHILL_LATEST_COMMIT=1
    
      66    : "${SICKCHILL_BRANCH:=develop}"
    
      67    unset SICKCHILL_VERSION
    
      68  fi
    
      69  printf 'PKGBUILD configuration: SICKCHILL_LATEST_COMMIT=%s, SICKCHILL_BRANCH=%s, SICKCHILL_VERSION=%s\n' \
    
      70    "$SICKCHILL_LATEST_COMMIT" "$SICKCHILL_BRANCH" "$SICKCHILL_VERSION"
    
      71
    
      72  if ((SICKCHILL_LATEST_COMMIT)); then
    
      73    _pip_install_arg="git+https://github.com/SickChill/sickchill.git@$SICKCHILL_BRANCH"
    
      74  else
    
      75    if [[ -n "$SICKCHILL_VERSION" ]]; then
    
      76      _pip_install_arg=sickchill==$SICKCHILL_VERSION
    
      77    else
    
      78      _pip_install_arg=sickchill # Latest released version
    
      79    fi
    
      80  fi
    
      81
    
      82  ####
    
      83
    
      84  # export XDG_CACHE_HOME=cache/pip
    
      85  # #python -m venv build
    
      86  # VIRTUALENV_OVERRIDE_APP_DATA=cache/virtualenv virtualenv build
    
      87  # set -x
    
      88  # PIP_CONFIG_FILE=/dev/null build/bin/pip install \
    
      89  #   --ignore-installed --isolated --cache-dir=cache --prefix=. --root=build \
    
      90  #   --default-timeout=60 --disable-pip-version-check --no-warn-script-location --progress-bar=off \
    
      91  #   setuptools "$_pip_install_arg"
    
      92  # { set +x; } 2>/dev/null
    
      93
    
      94  # sed -i '1s|.*|#!/opt/sickchill/app/bin/python|' build/bin/SickChill
    
      95
    
      96  # # Patch for error "TypeError: ExtensionManager._load_one_plugin() got an unexpected keyword argument 'verify_requirements'"
    
      97  # if ((SICKCHILL_LATEST_COMMIT)); then
    
      98  #   sed -i 's| \(verify_requirements=False,\)| #\1|' build/lib/python*/site-packages/subliminal/extensions.py
    
      99  # fi
    
      100
    
      101  ####
    
      102
    
      103  # Run the service in an older embedded Python environment
    
      104
    
      105  mkdir -p build/python
    
      106  cd build
    
      107
    
      108  uv python install 3.13 --install-dir=python --no-progress --quiet # 3.10
    
      109  _python=$(find python -path '*/bin/python' | head -n 1)
    
      110  _python="${_python:?Could not find embedded Python}"
    
      111  uv venv venv --python="$_python" --no-progress --relocatable
    
      112  uv pip install --cache-dir=../cache --python venv/bin/python --no-config --no-progress setuptools "$_pip_install_arg"
    
      113
    
      114  # Patch: make "venv --relocatable" relocatable, by making all paths relative
    
      115  # See https://github.com/astral-sh/uv/issues/6782
    
      116  ln -sfn "../../${_python}" venv/bin/python
    
      117  ln -sfn "python" venv/bin/python3
    
      118  ln -sfn "python" venv/bin/python3.13 # 3.10
    
      119  _home="../$(dirname "${_python#./}")"
    
      120  sed -i "s|^home *=.*|home = ${_home}|" venv/pyvenv.cfg
    
      121}
    
      122
    
      123package() {
    
      124  install -Dm644 sickchill.service -t "$pkgdir/usr/lib/systemd/system"
    
      125  install -Dm644 sickchill.sysusers "$pkgdir/usr/lib/sysusers.d/sickchill.conf"
    
      126  install -Dm644 sickchill.tmpfiles "$pkgdir/usr/lib/tmpfiles.d/sickchill.conf"
    
      127
    
      128  install -dm755 "$pkgdir/opt/sickchill"
    
      129  cp -a build "$pkgdir/opt/sickchill/app"
    
      130}
    
      131

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	3
2026-08-02 00:16:08	LOW	3
2026-08-01 00:11:18	LOW	3
2026-07-31 00:14:10	LOW	3
2026-07-30 00:17:23	LOW	3
2026-07-29 00:25:53	LOW	3
2026-07-28 00:07:28	LOW	3
2026-07-27 00:24:32	LOW	3
2026-07-26 00:07:32	LOW	3
2026-07-25 00:13:44	LOW	3
2026-07-24 00:02:28	LOW	3
2026-07-23 00:14:47	LOW	3
2026-07-22 00:29:32	LOW	3
2026-07-21 00:24:15	LOW	3
2026-07-20 00:19:49	LOW	3
2026-07-19 00:17:08	LOW	3
2026-07-18 00:14:48	LOW	3
2026-07-17 00:06:16	LOW	3
2026-07-16 00:05:41	LOW	3
2026-07-15 00:09:25	LOW	3