thermalright-trcc

MEDIUM

maintainer honjow 0 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package bundles 'uvicorn' via pip install at package time, which is an unverifiable, prebuilt external Python package not available in official Arch repos, creating a supply-chain risk if the PyPI source is compromised.

Triggered rules

Medium pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:56 python -m pip install --root="${pkgdir}" --prefix=/usr --no-deps uvicorn

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package bundles 'uvicorn' via pip install at package time, which is an unverifiable, prebuilt external Python package not available in official Arch repos, creating a supply-chain risk if the PyPI source is compromised.

PKGBUILD

1 offending line(s) highlighted

      1#!/usr/bin/env bash
    
      2# shellcheck shell=bash disable=SC2034,SC2154
    
      3# Maintainer: TRCC Linux Contributors <noreply@github.com>
    
      4
    
      5pkgname=thermalright-trcc
    
      6pkgver=9.11.1
    
      7pkgrel=1
    
      8pkgdesc="Thermalright LCD/LED Control Center for Linux"
    
      9arch=('any')
    
      10url="https://github.com/Lexonight1/thermalright-trcc-linux"
    
      11license=('GPL-3.0-or-later')
    
      12depends=(
    
      13  'python'
    
      14  'pyside6'
    
      15  'python-pillow'
    
      16  'python-numpy'
    
      17  'python-psutil'
    
      18  'python-pyusb'
    
      19  'python-click'
    
      20  'python-typer'
    
      21  'python-fastapi'
    
      22  'libusb'
    
      23  'sg3_utils'
    
      24  'p7zip'
    
      25)
    
      26# python-uvicorn not in official Arch repos — bundled via pip in package()
    
      27optdepends=(
    
      28  'python-pynvml: NVIDIA GPU sensor support'
    
      29  'python-dbus: Wayland session support'
    
      30  'python-gobject: Wayland session support'
    
      31  'python-hidapi: Alternative HID transport'
    
      32)
    
      33makedepends=(
    
      34  'python-build'
    
      35  'python-installer'
    
      36  'python-hatchling'
    
      37  'python-pip'
    
      38)
    
      39conflicts=('thermalright-trcc-git')
    
      40source=(
    
      41  "thermalright-trcc-linux-${pkgver}.tar.gz::${url}/archive/refs/tags/v${pkgver}.tar.gz"
    
      42)
    
      43sha256sums=('c28e0461f528583fc32b624e5cd68378edc409f50ef6db6e6e38d78722438c29')
    
      44
    
      45build() {
    
      46  cd "${srcdir}/thermalright-trcc-linux-${pkgver}" || return 1
    
      47  python -m build --wheel --no-isolation
    
      48}
    
      49
    
      50package() {
    
      51  cd "${srcdir}/thermalright-trcc-linux-${pkgver}" || return 1
    
      52
    
      53  python -m installer --destdir="${pkgdir}" --prefix=/usr dist/trcc_linux-*.whl
    
      54
    
      55  # Bundle deps not in official Arch repos.
    
      56  python -m pip install --root="${pkgdir}" --prefix=/usr --no-deps uvicorn
    
      57
    
      58  # udev rules
    
      59  install -Dm644 packaging/udev/99-trcc-lcd.rules \
    
      60    "${pkgdir}/usr/lib/udev/rules.d/99-trcc-lcd.rules"
    
      61  # modprobe config (USB storage quirks)
    
      62  install -Dm644 packaging/modprobe/trcc-lcd.conf \
    
      63    "${pkgdir}/usr/lib/modprobe.d/trcc-lcd.conf"
    
      64  # modules-load (SCSI generic)
    
      65  install -Dm644 packaging/modprobe/trcc-sg.conf \
    
      66    "${pkgdir}/usr/lib/modules-load.d/trcc-sg.conf"
    
      67  # desktop entry
    
      68  install -Dm644 src/trcc/assets/trcc-linux.desktop \
    
      69    "${pkgdir}/usr/share/applications/trcc-linux.desktop"
    
      70  # polkit policy
    
      71  install -Dm644 src/trcc/assets/com.github.lexonight1.trcc.policy \
    
      72    "${pkgdir}/usr/share/polkit-1/actions/com.github.lexonight1.trcc.policy"
    
      73  # systemd service
    
      74  install -Dm644 src/trcc/assets/trcc-quirk-fix.service \
    
      75    "${pkgdir}/usr/lib/systemd/system/trcc-quirk-fix.service"
    
      76
    
      77  # app icons
    
      78  local size
    
      79  for size in 256 128 64 48 32 24 16; do
    
      80    install -Dm644 "src/trcc/assets/icons/trcc_${size}x${size}.png" \
    
      81      "${pkgdir}/usr/share/icons/hicolor/${size}x${size}/apps/trcc.png"
    
      82  done
    
      83
    
      84  # license
    
      85  install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      86}
    
      87

Changes since previous scan

--- PKGBUILD @ 2026-10-21 13:31
+++ PKGBUILD @ 2026-11-01 00:21
@@ -3,7 +3,7 @@
 # Maintainer: TRCC Linux Contributors <noreply@github.com>
 
 pkgname=thermalright-trcc
-pkgver=9.10.9
+pkgver=9.11.1
 pkgrel=1
 pkgdesc="Thermalright LCD/LED Control Center for Linux"
 arch=('any')
@@ -40,7 +40,7 @@
 source=(
   "thermalright-trcc-linux-${pkgver}.tar.gz::${url}/archive/refs/tags/v${pkgver}.tar.gz"
 )
-sha256sums=('60911dfce46b513b22dfab9835f7ff30618c42eb5291221d17d3d9fc003eeebb')
+sha256sums=('c28e0461f528583fc32b624e5cd68378edc409f50ef6db6e6e38d78722438c29')
 
 build() {
   cd "${srcdir}/thermalright-trcc-linux-${pkgver}" || return 1

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Medium	2
2026-10-31 00:07:41	Medium	2
2026-10-30 00:29:30	Medium	2
2026-10-29 00:13:55	Medium	2
2026-10-28 00:06:54	Medium	2
2026-10-27 00:23:28	Medium	2
2026-10-26 00:12:40	Medium	2
2026-10-25 00:20:48	Medium	2
2026-10-24 00:14:55	Medium	2
2026-10-23 00:02:19	Medium	2
2026-10-22 00:13:10	Medium	2
2026-10-21 17:32:44	Medium	2
2026-10-21 13:31:17	Medium	1
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2