studio-controls-git

maintainer milkii · 8 votes · scanned 2026-08-18 00:03:42.021799

LOW

Why flagged The pip install fetches a non-executable Python module (pyalsaaudio) as a build-time dependency; while external, it is a known package and the action occurs in a controlled, isolated environment during packaging, not at runtime.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The pip install fetches a non-executable Python module (pyalsaaudio) as a build-time dependency; while external, it is a known package and the action occurs in a controlled, isolated environment during packaging, not at runtime.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:62 PIP_CONFIG_FILE=/dev/null pip install --isolated --root="$pkgdir" --ignore-installed --no-deps pyalsaaudio

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Milk Brewster (milkii on freenode)
    
      2# Maintainer: David Marzal <mundolibre at tutanota dot com>
    
      3
    
      4_pkgname=studio-controls
    
      5pkgname=${_pkgname}-git
    
      6pkgver=2.3.9.r2.g83c2bc7
    
      7pkgrel=1
    
      8pkgdesc="An JACK audio setup utility with USB device and PulseAudio bridges."
    
      9arch=('x86_64')
    
      10url="https://github.com/ovenwerks/studio-controls"
    
      11license=('GPL-2.0-only')
    
      12groups=()
    
      13depends=('jack2' 'jack2-dbus' 'python' 'python-gobject' 'python-dbus' 'python-jack-client' 'zita-ajbridge' 'a2jmidid')
    
      14makedepends=(git python-pip alsa-lib)
    
      15optdepends=('pulseaudio-jack: PulseAudio to JACK bridge'
    
      16            'alsa-utils: ALSA - Utilities (amixer)'
    
      17            'libffado: Driver for FireWire audio devices'
    
      18            'realtime-privileges: Realtime privileges for users'
    
      19            'carla: Audio Plugin Host'
    
      20            'pavucontrol: PulseAudio Volume Control'
    
      21            'qastools: qasmixer desktop mixer application'
    
      22            'agordejo: NSM based music production session manager'
    
      23            'raysession: NSM based music production session manager'
    
      24            'new-session-manager: NSM server and reference GUI'
    
      25            'zita-mu1: JACK app used to organise stereo monitoring')
    
      26provides=('studio-controls' 'studio-controls-git')
    
      27conflicts=('studio-controls' 'studio-controls-git' 'cadence')
    
      28replaces=()
    
      29backup=()
    
      30options=()
    
      31#install="${_pkgname}.install"
    
      32source=('git+https://github.com/ovenwerks/studio-controls')
    
      33noextract=()
    
      34md5sums=('SKIP')
    
      35
    
      36pkgver() {
    
      37  cd "$srcdir/${_pkgname%}"
    
      38  ( set -o pipefail
    
      39    git describe --long --tags 2>/dev/null | sed 's/\([^-]*-g\)/r\1/;s/-/./g' ||
    
      40    printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
    
      41  )
    
      42}
    
      43
    
      44prepare() {
    
      45  cd "$srcdir/${_pkgname%}"
    
      46}
    
      47
    
      48build() {
    
      49  cd "$srcdir/${_pkgname%}"
    
      50}
    
      51
    
      52check() {
    
      53  cd "$srcdir/${_pkgname%}"
    
      54}
    
      55
    
      56package() {
    
      57  cd "$srcdir/${_pkgname%}"
    
      58  cp -r etc usr $pkgdir
    
      59  mv $pkgdir/usr/sbin/studio-system $pkgdir/usr/bin
    
      60  rm -rf $pkgdir/usr/sbin
    
      61  # Install pyalsaaudio via pip (not in official repos)
    
      62  PIP_CONFIG_FILE=/dev/null pip install --isolated --root="$pkgdir" --ignore-installed --no-deps pyalsaaudio
    
      63}
    
      64

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-08-18 00:03
@@ -3,15 +3,15 @@
 
 _pkgname=studio-controls
 pkgname=${_pkgname}-git
-pkgver=2.2.3.r0.g99a71a0
+pkgver=2.3.9.r2.g83c2bc7
 pkgrel=1
 pkgdesc="An JACK audio setup utility with USB device and PulseAudio bridges."
 arch=('x86_64')
 url="https://github.com/ovenwerks/studio-controls"
 license=('GPL-2.0-only')
 groups=()
-depends=('jack2' 'jack2-dbus' 'python' 'python-gobject' 'python-dbus' 'python-jack-client' 'python-pyalsaaudio' 'zita-ajbridge' 'a2jmidid')
-makedepends=(git)
+depends=('jack2' 'jack2-dbus' 'python' 'python-gobject' 'python-dbus' 'python-jack-client' 'zita-ajbridge' 'a2jmidid')
+makedepends=(git python-pip alsa-lib)
 optdepends=('pulseaudio-jack: PulseAudio to JACK bridge'
             'alsa-utils: ALSA - Utilities (amixer)'
             'libffado: Driver for FireWire audio devices'
@@ -58,6 +58,7 @@
   cp -r etc usr $pkgdir
   mv $pkgdir/usr/sbin/studio-system $pkgdir/usr/bin
   rm -rf $pkgdir/usr/sbin
-  # mv $pkgdir/lib $pkgdir/usr/lib
+  # Install pyalsaaudio via pip (not in official repos)
+  PIP_CONFIG_FILE=/dev/null pip install --isolated --root="$pkgdir" --ignore-installed --no-deps pyalsaaudio
 }
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	LOW	2
2026-08-17 00:18:29	LOW	2
2026-08-16 00:03:42	LOW	2
2026-08-15 19:31:13	MEDIUM	1
2026-06-18 16:11:54	CLEAN	0