tandoor-recipes-git
LOW
maintainer jeromedc
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The pip install is from a requirements.txt file within the project's own source repository, which is a normal and expected part of building the application; the dependencies are not externally injected or obfuscated.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The pip install is from a requirements.txt file within the project's own source repository, which is a normal and expected part of building the application; the dependencies are not externally injected or obfuscated.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
pip install of an external package
pip_install_external
`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.
-
PKGBUILD:57
pip install --isolated --require-virtualenv --cache-dir "$srcdir/pip-cache" --disable-pip-version-check -r "$srcdir/recipes/requirements.txt"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Jérôme de Courval <decje9@gmail.com>
2
pkgname=tandoor-recipes-git
3
pkgver=1.2.2.r4969.8bb70710d
4
pkgrel=2
5
pkgdesc=""
6
arch=('any')
7
url="https://github.com/TandoorRecipes/recipes"
8
license=('GPL')
9
groups=()
10
depends=('python313' 'postgresql' 'postgresql-libs')
11
makedepends=('git' 'nodejs' 'yarn')
12
optdepends=('nginx: reverse proxy')
13
provides=("tandoor-recipes")
14
conflicts=("tandoor-recipes")
15
replaces=()
16
backup=(
17
'etc/tandoor/tandoor.conf'
18
'etc/nginx/sites-available/tandoor.conf'
19
)
20
options=(!strip)
21
install=tandoor.install
22
source=(
23
'git+https://github.com/TandoorRecipes/recipes.git'
24
'tandoor.service'
25
'tandoor.socket'
26
'tandoor-sysuser.conf'
27
'tandoor-directory.conf'
28
'tandoor-nginx.conf'
29
)
30
noextract=()
31
sha1sums=(
32
'SKIP'
33
'2b4fe62b9458512b37e3a44f4e50eaa271677e90'
34
'b564ef5c07d98c9983cb891e1e974dbf678e5c73'
35
'431a88a4ab33ec118961d80c00e3a5944d2c5691'
36
'3eabdaaeba5d356f7d7e4b47680a1e0864249b7f'
37
'8d1d8d9a3cf6963cf7eb145d25a3d724479a89c2'
38
)
39
40
pkgver() {
41
cd "$srcdir/recipes"
42
printf "%s" "$(git describe --long | sed 's/\([^-]*-\)g/r\1/;s/-/./g')"
43
}
44
45
46
build() {
47
cd "$srcdir/recipes/vue3"
48
yarn --cache-folder "$srcdir/yarn-cache" --ignore-engines install
49
yarn --cache-folder "$srcdir/yarn-cache" build
50
}
51
52
53
package() {
54
cd "$srcdir"
55
python3.13 -m venv "$pkgdir/usr/share/tandoor/venv"
56
source "$pkgdir/usr/share/tandoor/venv/bin/activate"
57
pip install --isolated --require-virtualenv --cache-dir "$srcdir/pip-cache" --disable-pip-version-check -r "$srcdir/recipes/requirements.txt"
58
find "$pkgdir/usr/share/tandoor/venv" -name __pycache__ -type d -exec rm -rf {} +
59
find "$pkgdir/usr/share/tandoor/venv/bin" -type f -exec sed -i "s|$pkgdir||g" {} \;
60
61
install -Dm644 -t "$pkgdir/usr/lib/systemd/system/" tandoor.service tandoor.socket
62
install -Dm644 tandoor-sysuser.conf "$pkgdir/usr/lib/sysusers.d/tandoor.conf"
63
install -Dm644 tandoor-directory.conf "$pkgdir/usr/lib/tmpfiles.d/tandoor.conf"
64
install -Dm644 tandoor-nginx.conf "$pkgdir/etc/nginx/sites-available/tandoor.conf"
65
66
cd recipes
67
install -Dm644 .env.template "$pkgdir/etc/tandoor/tandoor.conf"
68
mkdir -p "$pkgdir/usr/share/tandoor"
69
rm -rf "$srcdir/recipes/vue3/node_modules/.cache"
70
cp -r manage.py vue3 recipes cookbook "$pkgdir/usr/share/tandoor"
71
}
72
Changes since previous scan
--- PKGBUILD @ 2026-09-01 00:11+++ PKGBUILD @ 2026-09-17 00:27@@ -1,14 +1,15 @@ # Maintainer: Jérôme de Courval <decje9@gmail.com> pkgname=tandoor-recipes-git-pkgver=1.2.2.r4134.28e554d04-pkgrel=1+pkgver=1.2.2.r4969.8bb70710d+pkgrel=2 pkgdesc="" arch=('any') url="https://github.com/TandoorRecipes/recipes" license=('GPL') groups=()-depends=()-makedepends=('git' 'nodejs' 'postgresql' 'postgresql-libs' 'python-virtualenv' 'nginx' 'yarn')+depends=('python313' 'postgresql' 'postgresql-libs')+makedepends=('git' 'nodejs' 'yarn')+optdepends=('nginx: reverse proxy') provides=("tandoor-recipes") conflicts=("tandoor-recipes") replaces=()@@ -29,10 +30,10 @@ noextract=() sha1sums=( 'SKIP' - '2477c21bff44ed1051281dd66a6f13a296db11ca'+ '2b4fe62b9458512b37e3a44f4e50eaa271677e90' 'b564ef5c07d98c9983cb891e1e974dbf678e5c73' '431a88a4ab33ec118961d80c00e3a5944d2c5691'- '6072447d59acbc452b1e4dc5b0064c5ccafae97b'+ '3eabdaaeba5d356f7d7e4b47680a1e0864249b7f' '8d1d8d9a3cf6963cf7eb145d25a3d724479a89c2' ) @@ -51,7 +52,7 @@ package() { cd "$srcdir"- python -m venv "$pkgdir/usr/share/tandoor/venv"+ python3.13 -m venv "$pkgdir/usr/share/tandoor/venv" source "$pkgdir/usr/share/tandoor/venv/bin/activate" pip install --isolated --require-virtualenv --cache-dir "$srcdir/pip-cache" --disable-pip-version-check -r "$srcdir/recipes/requirements.txt" find "$pkgdir/usr/share/tandoor/venv" -name __pycache__ -type d -exec rm -rf {} +Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 01:46:26 | Medium | 1 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |