superset-venv

maintainer AlphaJack · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged This is a well-known AUR pattern for venv-based Python application packaging (explicitly references similar AUR packages like funkwhale-venv, octoprint-venv, pretix-venv). The pip install fetches apache-superset, gevent, and Pillow from PyPI without pinned versions or hashes, which is non-reproducible and theoretically subject to supply-chain risk, but this is standard practice for this class of AUR venv packages and is not meaningfully different from any other AUR package that downloads upstream sources at build time. The package installs a legitimate, well-known Apache project. The source files (service, sysusers, tmpfiles, env, conf, bin) are all checksummed with b2sums. The pkgver() function queries PyPI JSON API to get the latest version, which is also a common AUR pattern. There is no obfuscation, no unofficial host, no binary blob from a personal server, and no piracy. The lack of pinned pip dependencies is a reproducibility/quality concern (low) rather than a genuine supply-chain attack vector beyond what any AUR package already represents.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 82%): This is a well-known AUR pattern for venv-based Python application packaging (explicitly references similar AUR packages like funkwhale-venv, octoprint-venv, pretix-venv). The pip install fetches apache-superset, gevent, and Pillow from PyPI without pinned versions or hashes, which is non-reproducible and theoretically subject to supply-chain risk, but this is standard practice for this class of AUR venv packages and is not meaningfully different from any other AUR package that downloads upstream sources at build time. The package installs a legitimate, well-known Apache project. The source files (service, sysusers, tmpfiles, env, conf, bin) are all checksummed with b2sums. The pkgver() function queries PyPI JSON API to get the latest version, which is also a common AUR pattern. There is no obfuscation, no unofficial host, no binary blob from a personal server, and no piracy. The lack of pinned pip dependencies is a reproducibility/quality concern (low) rather than a genuine supply-chain attack vector beyond what any AUR package already represents.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:58 "$pkgdir/usr/share/superset/venv/bin/"pip install -I apache-superset gevent Pillow

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: AlphaJack <alphajack at tuta dot io>
    
      2
    
      3# https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=funkwhale-venv
    
      4# https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=octoprint-venv
    
      5# https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=pretix-venv
    
      6# https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=python-ffsubsync-venv
    
      7
    
      8pkgname="superset-venv"
    
      9_pkgname="apache-superset"
    
      10pkgver=4.1.1
    
      11pkgrel=1
    
      12pkgdesc="A modern, enterprise-ready business intelligence web application (venv installation type)"
    
      13url="https://superset.apache.org/"
    
      14license=("Apache-2.0")
    
      15arch=("any")
    
      16provides=("superset")
    
      17conflicts=("superset")
    
      18depends=("python")
    
      19makedepends=("jq")
    
      20source=("superset.bin"
    
      21        "superset.env"
    
      22        "superset.conf"
    
      23        "superset.sysusers"
    
      24        "superset.tmpfiles"
    
      25        "superset.service")
    
      26b2sums=('4cf278dd529b778356452eeb6e6d9c105dae977a28eadc1c7fbed3755eaaa1aa853fcb461d019b57879ed8512b819604ec46380719805de06ff14388552dc79a'
    
      27        '415e3b03382f043685f3080b5adde24cc55cd56da3b767e232673029afb500ec8f23ed7b9b48420cc757e73edfa6c07de00cbd2c9ecafa047645e2dbae017368'
    
      28        '5d99b11cd9ae415d5da4b828a3d1b29686f349cc7d3739f1f7aecef26dab82fb214761733e8f4bc88c1386f75457116ae71c3bf9d722b4e028b0b3eff0a50048'
    
      29        '85a1d4232a1901d00becf06ef5cbf139477209b93f3738add436f4243aa58d1b16a99dd6342c9f45f4b4efd2e10db337525d183f7f27c708420df406f31e6e09'
    
      30        '6580456589b3176aafa30a805fb63afc04401d1fb7e9c2ec9ee9f6b087c69ea54d4f854a5142783ea6a2566a4fe49f1222217071eed0fd2b04b370473d67748a'
    
      31        '90f6eab47fd21a9c062490e1d3add85245125d7809afe260d0dada93f336a5b41a5ce003923bf1fc392ab4e6002db76f3d1e8296ed23ffec79c9a02c6ec9012d')
    
      32backup=("etc/superset/env"
    
      33        "etc/superset/superset_config.py")
    
      34options=("!strip")
    
      35install="superset.install"
    
      36
    
      37pkgver(){
    
      38 curl -s "https://pypi.org/pypi/apache-superset/json" | jq -r ".info.version"
    
      39}
    
      40
    
      41package(){
    
      42 install -d -m 750 "$pkgdir/etc/superset"
    
      43 install -d -m 750 "$pkgdir/var/lib/superset"
    
      44 install -d -m 755 "$pkgdir/usr/share/superset" 
    
      45 install -D -m 755 "$srcdir/superset.bin"       "$pkgdir/usr/bin/superset"
    
      46 install -D -m 640 "$srcdir/superset.env"       "$pkgdir/etc/superset/env"
    
      47 install -D -m 640 "$srcdir/superset.conf"      "$pkgdir/etc/superset/superset_config.py"
    
      48 install -D -m 644 "$srcdir/superset.sysusers"  "$pkgdir/usr/lib/sysusers.d/superset.conf"
    
      49 install -D -m 644 "$srcdir/superset.tmpfiles"  "$pkgdir/usr/lib/tmpfiles.d/superset.conf"
    
      50 install -D -m 644 "$srcdir/superset.service"   "$pkgdir/usr/lib/systemd/system/superset.service"
    
      51 
    
      52 # create virtual environment
    
      53 export PIP_DISABLE_PIP_VERSION_CHECK=1
    
      54 export PYTHONDONTWRITEBYTECODE=1
    
      55 python -m venv "$pkgdir/usr/share/superset/venv"
    
      56 source "$pkgdir/usr/share/superset/venv/bin/activate"
    
      57 # install superset and dependencies using pip
    
      58 "$pkgdir/usr/share/superset/venv/bin/"pip install -I apache-superset gevent Pillow
    
      59 # remove references to pkgdir
    
      60 find "$pkgdir/usr/share/superset/venv/bin" -maxdepth 1 -type f -exec sed -i "s#${pkgdir}/#/#g" {} +
    
      61 find "$pkgdir/usr/share/superset/venv/pyvenv.cfg" -maxdepth 1 -type f -exec sed -i "s#${pkgdir}/#/#g" {} +
    
      62 find "$pkgdir/usr/share/superset/venv" -type f -name "*.py[co]" -delete
    
      63 find "$pkgdir/usr/share/superset/venv" -type d -name "__pycache__" -delete
    
      64 # exit virtual environment
    
      65 deactivate
    
      66}
    
      67

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2