sign-and-seal

maintainer danitxu79 · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The pip install is used to fetch build dependencies (like PyInstaller and libraries) in an isolated virtual environment to compile the application from the project's own source; this is a normal part of building a Python application and does not involve executing untrusted remote code or installing packages system-wide.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The pip install is used to fetch build dependencies (like PyInstaller and libraries) in an isolated virtual environment to compile the application from the project's own source; this is a normal part of building a Python application and does not involve executing untrusted remote code or installing packages system-wide.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:52 ./build_env/bin/pip install --upgrade pip
PKGBUILD:53 ./build_env/bin/pip install pyinstaller pymupdf PyQt6 Pillow opencv-python-headless numpy qrcode "pyhanko[crypto]"

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Daniel Serrano Armenta (AnabasaSoft) <anabasasoft@gmail.com>
    
      2pkgname=sign-and-seal
    
      3pkgver=1.14
    
      4pkgrel=2
    
      5pkgdesc="Simple PDF Signer for Linux (Sign & Seal) - Compiled from source"
    
      6arch=('x86_64')
    
      7url="https://github.com/AnabasaSoft/SignAndSeal"
    
      8license=('LGPL3')
    
      9provides=('sign-and-seal')
    
      10conflicts=('sign-and-seal-bin')
    
      11
    
      12# Dependencias mínimas del sistema para ejecutar el binario resultante
    
      13depends=('glibc' 'zlib' 'fuse2')
    
      14
    
      15# Dependencias para compilar: Solo pedimos Python y Git.
    
      16# El resto lo bajaremos vía pip para evitar errores de pacman.
    
      17makedepends=('python' 'git')
    
      18
    
      19source=("https://github.com/AnabasaSoft/SignAndSeal/archive/refs/tags/v${pkgver}.tar.gz")
    
      20
    
      21sha256sums=('54632b21b6c2f054237e5c3205d30fd6450b64e072821cc00ca7c3c042f74dcf')
    
      22
    
      23prepare() {
    
      24    cd "SignAndSeal-${pkgver}"
    
      25
    
      26    # 1. Renombrar script si es necesario
    
      27    if [ -f "sign_and_seal_v2.py" ]; then
    
      28        mv sign_and_seal_v2.py sign_and_seal.py
    
      29    fi
    
      30
    
      31    # 2. Generar .desktop al vuelo
    
      32    cat > sign-and-seal.desktop <<EOF
    
      33[Desktop Entry]
    
      34Name=Sign & Seal
    
      35Comment=Firmador de PDFs simple
    
      36Exec=/usr/bin/sign-and-seal
    
      37Icon=sign-and-seal
    
      38Type=Application
    
      39Categories=Office;Utility;
    
      40Terminal=false
    
      41EOF
    
      42}
    
      43
    
      44build() {
    
      45    cd "SignAndSeal-${pkgver}"
    
      46
    
      47    echo "--- Creando entorno virtual de compilación (aislado) ---"
    
      48    python -m venv build_env
    
      49
    
      50    echo "--- Instalando dependencias de compilación con pip ---"
    
      51    # Usamos las rutas directas para no depender de 'source activate'
    
      52    ./build_env/bin/pip install --upgrade pip
    
      53    ./build_env/bin/pip install pyinstaller pymupdf PyQt6 Pillow opencv-python-headless numpy qrcode "pyhanko[crypto]"
    
      54
    
      55    echo "--- Compilando binario ---"
    
      56    # Llamamos al pyinstaller del entorno virtual
    
      57    ./build_env/bin/pyinstaller --clean --onefile --noconsole --hidden-import=cv2 \
    
      58        --name "SignAndSeal" \
    
      59        --add-data "sign_and_seal_icon.png:." \
    
      60        sign_and_seal.py
    
      61}
    
      62
    
      63package() {
    
      64    cd "SignAndSeal-${pkgver}"
    
      65
    
      66    # 1. Instalar el binario generado
    
      67    install -Dm755 "dist/SignAndSeal" "${pkgdir}/usr/bin/sign-and-seal"
    
      68
    
      69    # 2. Instalar el icono
    
      70    install -Dm644 "sign_and_seal_icon.png" "${pkgdir}/usr/share/icons/hicolor/256x256/apps/sign-and-seal.png"
    
      71
    
      72    # 3. Instalar el .desktop
    
      73    install -Dm644 "sign-and-seal.desktop" "${pkgdir}/usr/share/applications/sign-and-seal.desktop"
    
      74}
    
      75

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2