superset-venv

LOW

maintainer AlphaJack 1 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package uses 'uv pip install' to install the official Apache Superset package and dependencies from the Python package index into a local virtual environment, which is a normal and expected part of building a Python application; the installed package is the same one named in the project's source and is not an untrusted external payload.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package uses 'uv pip install' to install the official Apache Superset package and dependencies from the Python package index into a local virtual environment, which is a normal and expected part of building a Python application; the installed package is the same one named in the project's source and is not an untrusted external payload.

PKGBUILD:71 uv pip install --python "$share/venv/bin/python" "$_pkgname==$pkgver" gevent Pillow

2 higher static findings superseded - not the current verdict (shown for transparency)

Medium pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:71 uv pip install --python "$share/venv/bin/python" "$_pkgname==$pkgver" gevent Pillow

Medium External install via pipx/uv/poetry/cargo/go/gem alt_pkg_manager_install

A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.

PKGBUILD:71 uv pip install --python "$share/venv/bin/python" "$_pkgname==$pkgver" gevent Pillow

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: AlphaJack <alphajack at tuta dot io>
    
      2
    
      3# https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=funkwhale-venv
    
      4# https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=octoprint-venv
    
      5# https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=pretix-venv
    
      6# https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=python-ffsubsync-venv
    
      7
    
      8pkgname="superset-venv"
    
      9_pkgname="apache-superset"
    
      10pkgver=4.1.1
    
      11# superset pins numpy, pandas and pyarrow versions without wheels for the system Python
    
      12_python=3.12
    
      13pkgrel=3
    
      14pkgdesc="A modern, enterprise-ready business intelligence web application (venv installation type)"
    
      15url="https://superset.apache.org/"
    
      16license=("Apache-2.0")
    
      17arch=("x86_64" "aarch64")
    
      18provides=("superset")
    
      19conflicts=("superset")
    
      20makedepends=("uv")
    
      21source=("superset.bin"
    
      22        "superset.env"
    
      23        "superset.conf"
    
      24        "superset.sysusers"
    
      25        "superset.tmpfiles"
    
      26        "superset.service")
    
      27b2sums=('4cf278dd529b778356452eeb6e6d9c105dae977a28eadc1c7fbed3755eaaa1aa853fcb461d019b57879ed8512b819604ec46380719805de06ff14388552dc79a'
    
      28        '415e3b03382f043685f3080b5adde24cc55cd56da3b767e232673029afb500ec8f23ed7b9b48420cc757e73edfa6c07de00cbd2c9ecafa047645e2dbae017368'
    
      29        '5d99b11cd9ae415d5da4b828a3d1b29686f349cc7d3739f1f7aecef26dab82fb214761733e8f4bc88c1386f75457116ae71c3bf9d722b4e028b0b3eff0a50048'
    
      30        '85a1d4232a1901d00becf06ef5cbf139477209b93f3738add436f4243aa58d1b16a99dd6342c9f45f4b4efd2e10db337525d183f7f27c708420df406f31e6e09'
    
      31        '6580456589b3176aafa30a805fb63afc04401d1fb7e9c2ec9ee9f6b087c69ea54d4f854a5142783ea6a2566a4fe49f1222217071eed0fd2b04b370473d67748a'
    
      32        '90f6eab47fd21a9c062490e1d3add85245125d7809afe260d0dada93f336a5b41a5ce003923bf1fc392ab4e6002db76f3d1e8296ed23ffec79c9a02c6ec9012d')
    
      33backup=("etc/superset/env"
    
      34        "etc/superset/superset_config.py")
    
      35# a venv has no use for a -debug package, and collecting its sources takes minutes
    
      36options=("!strip" "!debug")
    
      37install="superset.install"
    
      38
    
      39_strip_pkgdir() {
    
      40 # remove mentions of $pkgdir in files and symlinks
    
      41 grep -RIlZ "$pkgdir" "$pkgdir" | xargs -0 -r sed -i "s|$pkgdir||g"
    
      42 find "$pkgdir" -type l -print0 |
    
      43  while IFS= read -r -d '' _link; do
    
      44   _target=$(readlink -- "$_link")
    
      45   if [[ $_target == "$pkgdir"/* ]]; then
    
      46    ln -sfn "${_target#"$pkgdir"}" "$_link"
    
      47   fi
    
      48  done
    
      49}
    
      50
    
      51package(){
    
      52 install -d -m 750 "$pkgdir/etc/superset"
    
      53 install -d -m 750 "$pkgdir/var/lib/superset"
    
      54 install -d -m 755 "$pkgdir/usr/share/superset" 
    
      55 install -D -m 755 "$srcdir/superset.bin"       "$pkgdir/usr/bin/superset"
    
      56 install -D -m 640 "$srcdir/superset.env"       "$pkgdir/etc/superset/env"
    
      57 install -D -m 640 "$srcdir/superset.conf"      "$pkgdir/etc/superset/superset_config.py"
    
      58 install -D -m 644 "$srcdir/superset.sysusers"  "$pkgdir/usr/lib/sysusers.d/superset.conf"
    
      59 install -D -m 644 "$srcdir/superset.tmpfiles"  "$pkgdir/usr/lib/tmpfiles.d/superset.conf"
    
      60 install -D -m 644 "$srcdir/superset.service"   "$pkgdir/usr/lib/systemd/system/superset.service"
    
      61 
    
      62 # standalone Python and virtual environment, both inside the package
    
      63 local share="$pkgdir/usr/share/superset"
    
      64 export UV_CACHE_DIR="$srcdir/uv-cache"
    
      65 export UV_LINK_MODE=copy
    
      66 export UV_NO_INSTALLER_METADATA=1
    
      67 export UV_PYTHON_INSTALL_DIR="$share/python"
    
      68 export PYTHONDONTWRITEBYTECODE=1
    
      69 uv python install --no-bin "$_python"
    
      70 uv venv --python "$_python" --python-preference only-managed "$share/venv"
    
      71 uv pip install --python "$share/venv/bin/python" "$_pkgname==$pkgver" gevent Pillow
    
      72 _strip_pkgdir
    
      73 find "$share" -type f -name "*.py[co]" -delete
    
      74 find "$share" -type d -name "__pycache__" -delete
    
      75}
    
      76

Changes since previous scan

--- PKGBUILD @ 2026-10-29 15:52
+++ PKGBUILD @ 2026-11-01 00:21
@@ -8,15 +8,16 @@
 pkgname="superset-venv"
 _pkgname="apache-superset"
 pkgver=4.1.1
-pkgrel=1
+# superset pins numpy, pandas and pyarrow versions without wheels for the system Python
+_python=3.12
+pkgrel=3
 pkgdesc="A modern, enterprise-ready business intelligence web application (venv installation type)"
 url="https://superset.apache.org/"
 license=("Apache-2.0")
-arch=("any")
+arch=("x86_64" "aarch64")
 provides=("superset")
 conflicts=("superset")
-depends=("python")
-makedepends=("jq")
+makedepends=("uv")
 source=("superset.bin"
         "superset.env"
         "superset.conf"
@@ -31,11 +32,20 @@
         '90f6eab47fd21a9c062490e1d3add85245125d7809afe260d0dada93f336a5b41a5ce003923bf1fc392ab4e6002db76f3d1e8296ed23ffec79c9a02c6ec9012d')
 backup=("etc/superset/env"
         "etc/superset/superset_config.py")
-options=("!strip")
+# a venv has no use for a -debug package, and collecting its sources takes minutes
+options=("!strip" "!debug")
 install="superset.install"
 
-pkgver(){
- curl -s "https://pypi.org/pypi/apache-superset/json" | jq -r ".info.version"
+_strip_pkgdir() {
+ # remove mentions of $pkgdir in files and symlinks
+ grep -RIlZ "$pkgdir" "$pkgdir" | xargs -0 -r sed -i "s|$pkgdir||g"
+ find "$pkgdir" -type l -print0 |
+  while IFS= read -r -d '' _link; do
+   _target=$(readlink -- "$_link")
+   if [[ $_target == "$pkgdir"/* ]]; then
+    ln -sfn "${_target#"$pkgdir"}" "$_link"
+   fi
+  done
 }
 
 package(){
@@ -49,19 +59,18 @@
  install -D -m 644 "$srcdir/superset.tmpfiles"  "$pkgdir/usr/lib/tmpfiles.d/superset.conf"
  install -D -m 644 "$srcdir/superset.service"   "$pkgdir/usr/lib/systemd/system/superset.service"
  
- # create virtual environment
- export PIP_DISABLE_PIP_VERSION_CHECK=1
+ # standalone Python and virtual environment, both inside the package
+ local share="$pkgdir/usr/share/superset"
+ export UV_CACHE_DIR="$srcdir/uv-cache"
+ export UV_LINK_MODE=copy
+ export UV_NO_INSTALLER_METADATA=1
+ export UV_PYTHON_INSTALL_DIR="$share/python"
  export PYTHONDONTWRITEBYTECODE=1
- python -m venv "$pkgdir/usr/share/superset/venv"
- source "$pkgdir/usr/share/superset/venv/bin/activate"
- # install superset and dependencies using pip
- "$pkgdir/usr/share/superset/venv/bin/"pip install -I apache-superset gevent Pillow
- # remove references to pkgdir
- find "$pkgdir/usr/share/superset/venv/bin" -maxdepth 1 -type f -exec sed -i "s#${pkgdir}/#/#g" {} +
- find "$pkgdir/usr/share/superset/venv/pyvenv.cfg" -maxdepth 1 -type f -exec sed -i "s#${pkgdir}/#/#g" {} +
- find "$pkgdir/usr/share/superset/venv" -type f -name "*.py[co]" -delete
- find "$pkgdir/usr/share/superset/venv" -type d -name "__pycache__" -delete
- # exit virtual environment
- deactivate
+ uv python install --no-bin "$_python"
+ uv venv --python "$_python" --python-preference only-managed "$share/venv"
+ uv pip install --python "$share/venv/bin/python" "$_pkgname==$pkgver" gevent Pillow
+ _strip_pkgdir
+ find "$share" -type f -name "*.py[co]" -delete
+ find "$share" -type d -name "__pycache__" -delete
 }
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	3
2026-10-31 00:07:41	Low	3
2026-10-30 00:29:30	Low	3
2026-10-29 17:53:05	Medium	2
2026-10-29 15:52:51	Medium	2
2026-10-29 00:13:55	Low	2
2026-10-28 00:06:54	Low	2
2026-10-27 00:23:28	Low	2
2026-10-26 00:12:40	Low	2
2026-10-25 00:20:48	Low	2
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 00:13:10	Low	2
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2