tandoor-recipes

LOW

maintainer L0ric0 1 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The pip install is from the project's own requirements.txt within the verified source tarball; this is a standard build step for Python applications and not an external untrusted package.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The pip install is from the project's own requirements.txt within the verified source tarball; this is a standard build step for Python applications and not an external untrusted package.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:46 pip install --isolated --require-virtualenv --cache-dir "$srcdir/pip-cache" --disable-pip-version-check -r "$srcdir/recipes-$pkgver/requirements.txt"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Lorenz Steinert <aur@uraziel.de>
    
      2# Contributor: Bjoern Franke <bjo+aur@schafweide.org>
    
      3# Contributor: Jérôme de Courval <decje9@gmail.com>
    
      4pkgname=tandoor-recipes
    
      5pkgver=2.6.9
    
      6pkgrel=1
    
      7pkgdesc="Application for managing recipes, planning meals, building shopping lists and much much more."
    
      8arch=('any')
    
      9url="https://github.com/TandoorRecipes/recipes"
    
      10license=('GPL')
    
      11groups=()
    
      12depends=()
    
      13makedepends=('python-virtualenv' 'postgresql' 'postgresql-libs' 'nodejs' 'yarn')
    
      14provides=("tandoor-recipes")
    
      15conflicts=("tandoor-recipes")
    
      16replaces=()
    
      17backup=(
    
      18    'etc/tandoor/tandoor.conf'
    
      19)
    
      20options=(!strip)
    
      21install=tandoor.install
    
      22source=("${pkgname}-${pkgver}.tar.gz::https://github.com/TandoorRecipes/recipes/archive/refs/tags/$pkgver.tar.gz"
    
      23	'tandoor.service'
    
      24	'tandoor.socket'
    
      25	'tandoor-sysuser.conf'
    
      26	'tandoor-directory.conf'
    
      27)
    
      28sha512sums=('4001e79fe59525f527e425e20f8f6fd2447d64096ff6328acd81fec652665145c01de7426d647a4af0aacb681151cd2a1c806d085c5f11a7527cd9ebdfd3930a'
    
      29            '95dae7231412d20007f949536731dad9a95d82d208aa409698bf0ee81a5921fa893584747d2e0881eeb640198fb3c657447179707e27b0b0b6da1e15e06ceca0'
    
      30            '51e62f35632d709398bac39c11afcf452200a9ccfe55be5d0e6cf7f5f164a9bbd6bca0faebf3eb544017943e5d4597513ca0dfa0ee88de765b2f1b202341316c'
    
      31            '3c1314875b85244160ab7052258fdc4bb7637a1c43b85d62f4f2af2fa905c08ab76a7b2aca7c85e2fa02884f88bd6c7eb31796171cb38b3b77197c3d2ef8784e'
    
      32            '1ddd4ef1bff31bdb1b6ff1843207e0b05bdd613cab7e5eb66bae66687e8358acdfb451cfa5f0a581c5525aa9d63188bb64bab93c73ddff7bff2ace8c694fed63')
    
      33
    
      34
    
      35
    
      36build() {
    
      37	cd "$srcdir/recipes-$pkgver/vue3"
    
      38	yarn --cache-folder "$srcdir/yarn-cache" --ignore-engines install 
    
      39	yarn --cache-folder "$srcdir/yarn-cache" build
    
      40}
    
      41
    
      42
    
      43package() {
    
      44	python -m venv "$pkgdir/usr/share/tandoor/venv"
    
      45	source "$pkgdir/usr/share/tandoor/venv/bin/activate"
    
      46	pip install --isolated --require-virtualenv --cache-dir "$srcdir/pip-cache" --disable-pip-version-check -r "$srcdir/recipes-$pkgver/requirements.txt"
    
      47
    
      48	find "$pkgdir/usr/share/tandoor/venv" -name __pycache__ -type d -exec rm -rf {} +
    
      49	find "$pkgdir/usr/share/tandoor/venv" -type f -exec sed -i "s|$pkgdir||g" {} \;
    
      50
    
      51	cd "$srcdir"
    
      52	install -Dm644 -t "$pkgdir/usr/lib/systemd/system/" tandoor.service tandoor.socket
    
      53	install -Dm644 tandoor-sysuser.conf "$pkgdir/usr/lib/sysusers.d/tandoor.conf"
    
      54	install -Dm644 tandoor-directory.conf "$pkgdir/usr/lib/tmpfiles.d/tandoor.conf"
    
      55
    
      56	cd "$srcdir/recipes-$pkgver"
    
      57	install -Dm644 .env.template "$pkgdir/etc/tandoor/tandoor.conf"
    
      58	mkdir -p "$pkgdir/usr/share/tandoor"
    
      59	rm -rf "$srcdir/recipes/vue3/node_modules/.cache"
    
      60	cp -r manage.py vue3 recipes cookbook "$pkgdir/usr/share/tandoor"
    
      61}
    
      62

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2