tandoor-recipes-git
LOW
maintainer jeromedc
0 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The pip install is from a requirements.txt file within the project's own source repository, which is a normal and expected part of building the application; the dependencies are not externally injected or obfuscated.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The pip install is from a requirements.txt file within the project's own source repository, which is a normal and expected part of building the application; the dependencies are not externally injected or obfuscated.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
pip install of an external package
pip_install_external
`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.
-
PKGBUILD:57
pip install --isolated --require-virtualenv --cache-dir "$srcdir/pip-cache" --disable-pip-version-check -r "$srcdir/recipes/requirements.txt"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Jérôme de Courval <decje9@gmail.com>
2
pkgname=tandoor-recipes-git
3
pkgver=1.2.2.r4969.8bb70710d
4
pkgrel=2
5
pkgdesc=""
6
arch=('any')
7
url="https://github.com/TandoorRecipes/recipes"
8
license=('GPL')
9
groups=()
10
depends=('python313' 'postgresql' 'postgresql-libs')
11
makedepends=('git' 'nodejs' 'yarn')
12
optdepends=('nginx: reverse proxy')
13
provides=("tandoor-recipes")
14
conflicts=("tandoor-recipes")
15
replaces=()
16
backup=(
17
'etc/tandoor/tandoor.conf'
18
'etc/nginx/sites-available/tandoor.conf'
19
)
20
options=(!strip)
21
install=tandoor.install
22
source=(
23
'git+https://github.com/TandoorRecipes/recipes.git'
24
'tandoor.service'
25
'tandoor.socket'
26
'tandoor-sysuser.conf'
27
'tandoor-directory.conf'
28
'tandoor-nginx.conf'
29
)
30
noextract=()
31
sha1sums=(
32
'SKIP'
33
'2b4fe62b9458512b37e3a44f4e50eaa271677e90'
34
'b564ef5c07d98c9983cb891e1e974dbf678e5c73'
35
'431a88a4ab33ec118961d80c00e3a5944d2c5691'
36
'3eabdaaeba5d356f7d7e4b47680a1e0864249b7f'
37
'8d1d8d9a3cf6963cf7eb145d25a3d724479a89c2'
38
)
39
40
pkgver() {
41
cd "$srcdir/recipes"
42
printf "%s" "$(git describe --long | sed 's/\([^-]*-\)g/r\1/;s/-/./g')"
43
}
44
45
46
build() {
47
cd "$srcdir/recipes/vue3"
48
yarn --cache-folder "$srcdir/yarn-cache" --ignore-engines install
49
yarn --cache-folder "$srcdir/yarn-cache" build
50
}
51
52
53
package() {
54
cd "$srcdir"
55
python3.13 -m venv "$pkgdir/usr/share/tandoor/venv"
56
source "$pkgdir/usr/share/tandoor/venv/bin/activate"
57
pip install --isolated --require-virtualenv --cache-dir "$srcdir/pip-cache" --disable-pip-version-check -r "$srcdir/recipes/requirements.txt"
58
find "$pkgdir/usr/share/tandoor/venv" -name __pycache__ -type d -exec rm -rf {} +
59
find "$pkgdir/usr/share/tandoor/venv/bin" -type f -exec sed -i "s|$pkgdir||g" {} \;
60
61
install -Dm644 -t "$pkgdir/usr/lib/systemd/system/" tandoor.service tandoor.socket
62
install -Dm644 tandoor-sysuser.conf "$pkgdir/usr/lib/sysusers.d/tandoor.conf"
63
install -Dm644 tandoor-directory.conf "$pkgdir/usr/lib/tmpfiles.d/tandoor.conf"
64
install -Dm644 tandoor-nginx.conf "$pkgdir/etc/nginx/sites-available/tandoor.conf"
65
66
cd recipes
67
install -Dm644 .env.template "$pkgdir/etc/tandoor/tandoor.conf"
68
mkdir -p "$pkgdir/usr/share/tandoor"
69
rm -rf "$srcdir/recipes/vue3/node_modules/.cache"
70
cp -r manage.py vue3 recipes cookbook "$pkgdir/usr/share/tandoor"
71
}
72
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 00:13:55 | Low | 2 |
| 2026-10-28 00:06:54 | Low | 2 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |
| 2026-10-14 00:06:47 | Low | 2 |
| 2026-10-13 00:23:45 | Low | 2 |