thermalright-trcc
maintainer honjow
· 0 votes
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The pip install bundles uvicorn, a project dependency not in official Arch repos, from PyPI during packaging; this is a supply-chain risk but not actively malicious, and the rest of the package builds from verifiable source.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The pip install bundles uvicorn, a project dependency not in official Arch repos, from PyPI during packaging; this is a supply-chain risk but not actively malicious, and the rest of the package builds from verifiable source.
1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM
pip install of an external package
pip_install_external
`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.
-
PKGBUILD:56
python -m pip install --root="${pkgdir}" --prefix=/usr --no-deps uvicorn
PKGBUILD
1 offending line(s) highlighted
1
#!/usr/bin/env bash
2
# shellcheck shell=bash disable=SC2034,SC2154
3
# Maintainer: TRCC Linux Contributors <noreply@github.com>
4
5
pkgname=thermalright-trcc
6
pkgver=9.9.5
7
pkgrel=1
8
pkgdesc="Thermalright LCD/LED Control Center for Linux"
9
arch=('any')
10
url="https://github.com/Lexonight1/thermalright-trcc-linux"
11
license=('GPL-3.0-or-later')
12
depends=(
13
'python'
14
'pyside6'
15
'python-pillow'
16
'python-numpy'
17
'python-psutil'
18
'python-pyusb'
19
'python-click'
20
'python-typer'
21
'python-fastapi'
22
'libusb'
23
'sg3_utils'
24
'p7zip'
25
)
26
# python-uvicorn not in official Arch repos — bundled via pip in package()
27
optdepends=(
28
'python-pynvml: NVIDIA GPU sensor support'
29
'python-dbus: Wayland session support'
30
'python-gobject: Wayland session support'
31
'python-hidapi: Alternative HID transport'
32
)
33
makedepends=(
34
'python-build'
35
'python-installer'
36
'python-hatchling'
37
'python-pip'
38
)
39
conflicts=('thermalright-trcc-git')
40
source=(
41
"thermalright-trcc-linux-${pkgver}.tar.gz::${url}/archive/refs/tags/v${pkgver}.tar.gz"
42
)
43
sha256sums=('2f231183428ee4985f3116d2e73d2cc09f711e0980981697366ad8d6ae212ae3')
44
45
build() {
46
cd "${srcdir}/thermalright-trcc-linux-${pkgver}" || return 1
47
python -m build --wheel --no-isolation
48
}
49
50
package() {
51
cd "${srcdir}/thermalright-trcc-linux-${pkgver}" || return 1
52
53
python -m installer --destdir="${pkgdir}" --prefix=/usr dist/trcc_linux-*.whl
54
55
# Bundle deps not in official Arch repos.
56
python -m pip install --root="${pkgdir}" --prefix=/usr --no-deps uvicorn
57
58
# udev rules
59
install -Dm644 packaging/udev/99-trcc-lcd.rules \
60
"${pkgdir}/usr/lib/udev/rules.d/99-trcc-lcd.rules"
61
# modprobe config (USB storage quirks)
62
install -Dm644 packaging/modprobe/trcc-lcd.conf \
63
"${pkgdir}/usr/lib/modprobe.d/trcc-lcd.conf"
64
# modules-load (SCSI generic)
65
install -Dm644 packaging/modprobe/trcc-sg.conf \
66
"${pkgdir}/usr/lib/modules-load.d/trcc-sg.conf"
67
# desktop entry
68
install -Dm644 src/trcc/assets/trcc-linux.desktop \
69
"${pkgdir}/usr/share/applications/trcc-linux.desktop"
70
# polkit policy
71
install -Dm644 src/trcc/assets/com.github.lexonight1.trcc.policy \
72
"${pkgdir}/usr/share/polkit-1/actions/com.github.lexonight1.trcc.policy"
73
# systemd service
74
install -Dm644 src/trcc/assets/trcc-quirk-fix.service \
75
"${pkgdir}/usr/lib/systemd/system/trcc-quirk-fix.service"
76
77
# app icons
78
local size
79
for size in 256 128 64 48 32 24 16; do
80
install -Dm644 "src/trcc/assets/icons/trcc_${size}x${size}.png" \
81
"${pkgdir}/usr/share/icons/hicolor/${size}x${size}/apps/trcc.png"
82
done
83
84
# license
85
install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
86
}
87
Changes since previous scan
--- PKGBUILD @ 2026-07-31 00:14+++ PKGBUILD @ 2026-08-03 00:08@@ -3,7 +3,7 @@ # Maintainer: TRCC Linux Contributors <noreply@github.com> pkgname=thermalright-trcc-pkgver=9.9.3+pkgver=9.9.5 pkgrel=1 pkgdesc="Thermalright LCD/LED Control Center for Linux" arch=('any')@@ -40,7 +40,7 @@ source=( "thermalright-trcc-linux-${pkgver}.tar.gz::${url}/archive/refs/tags/v${pkgver}.tar.gz" )-sha256sums=('486726bddec1124e73fcd95a1ddd2ced684e06f0204a33db8ea12131322c1222')+sha256sums=('2f231183428ee4985f3116d2e73d2cc09f711e0980981697366ad8d6ae212ae3') build() { cd "${srcdir}/thermalright-trcc-linux-${pkgver}" || return 1Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 2 |
| 2026-08-02 00:16:08 | LOW | 2 |
| 2026-08-01 00:11:18 | LOW | 2 |
| 2026-07-31 21:18:45 | MEDIUM | 1 |
| 2026-07-31 00:14:10 | LOW | 2 |
| 2026-07-30 15:15:12 | MEDIUM | 1 |
| 2026-07-30 00:17:23 | LOW | 2 |
| 2026-07-29 00:25:53 | LOW | 2 |
| 2026-07-28 00:07:28 | LOW | 2 |
| 2026-07-27 21:35:42 | MEDIUM | 1 |
| 2026-07-27 00:24:32 | LOW | 2 |
| 2026-07-26 00:07:32 | LOW | 2 |
| 2026-07-25 00:13:44 | LOW | 2 |
| 2026-07-24 00:02:28 | LOW | 2 |
| 2026-07-23 00:14:47 | LOW | 2 |
| 2026-07-22 00:29:32 | LOW | 2 |
| 2026-07-21 00:24:15 | LOW | 2 |
| 2026-07-20 05:12:56 | MEDIUM | 1 |
| 2026-07-20 00:19:49 | MEDIUM | 2 |
| 2026-07-19 00:17:08 | MEDIUM | 2 |