thermalright-trcc-git
MEDIUM
maintainer honjow
0 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The package bundles 'uvicorn' via pip at install time, pulling an unverified external Python wheel not available in official Arch repos, creating a supply-chain risk if the PyPI package is compromised.
Triggered rules
Medium
pip install of an external package
pip_install_external
`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.
-
PKGBUILD:74
python -m pip install --root="${pkgdir}" --prefix=/usr --no-deps uvicorn
Medium
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 85%): The package bundles 'uvicorn' via pip at install time, pulling an unverified external Python wheel not available in official Arch repos, creating a supply-chain risk if the PyPI package is compromised.
PKGBUILD
1 offending line(s) highlighted
1
#!/usr/bin/env bash
2
# shellcheck shell=bash disable=SC2034,SC2154
3
# Maintainer: TRCC Linux Contributors <noreply@github.com>
4
5
pkgname=thermalright-trcc-git
6
_pkgname=thermalright-trcc-linux
7
pkgver=8.3.7.r3.gc9c9c8a
8
pkgrel=2
9
pkgdesc="Thermalright LCD/LED Control Center for Linux (git version)"
10
arch=('any')
11
url="https://github.com/Lexonight1/thermalright-trcc-linux"
12
license=('GPL-3.0-or-later')
13
depends=(
14
'python'
15
'pyside6'
16
'python-pillow'
17
'python-numpy'
18
'python-psutil'
19
'python-pyusb'
20
'python-click'
21
'python-typer'
22
'python-fastapi'
23
'libusb'
24
'sg3_utils'
25
'p7zip'
26
)
27
# python-uvicorn not in official Arch repos — bundled via pip in package()
28
optdepends=(
29
'python-pynvml: NVIDIA GPU sensor support'
30
'python-dbus: Wayland session support'
31
'python-gobject: Wayland session support'
32
'python-hidapi: Alternative HID transport'
33
)
34
makedepends=(
35
'git'
36
'python-build'
37
'python-installer'
38
'python-hatchling'
39
'python-pip'
40
)
41
provides=('thermalright-trcc')
42
conflicts=('thermalright-trcc')
43
source=("git+${url}.git")
44
sha256sums=('SKIP')
45
46
pkgver() {
47
cd "${srcdir}/${_pkgname}" || return 1
48
49
local _tag_raw _tag _rev _hash
50
_tag_raw="$(git describe --tags --abbrev=0 2>/dev/null || true)"
51
_hash="$(git rev-parse --short=7 HEAD)"
52
53
if [[ -n "${_tag_raw}" ]]; then
54
_tag="${_tag_raw#v}"
55
_rev="$(git rev-list --count "${_tag_raw}"..HEAD)"
56
printf '%s.r%s.g%s\n' "${_tag}" "${_rev}" "${_hash}"
57
else
58
_rev="$(git rev-list --count HEAD)"
59
printf '0.r%s.g%s\n' "${_rev}" "${_hash}"
60
fi
61
}
62
63
build() {
64
cd "${srcdir}/${_pkgname}" || return 1
65
python -m build --wheel --no-isolation
66
}
67
68
package() {
69
cd "${srcdir}/${_pkgname}" || return 1
70
71
python -m installer --destdir="${pkgdir}" --prefix=/usr dist/trcc_linux-*.whl
72
73
# Bundle deps not in official Arch repos.
74
python -m pip install --root="${pkgdir}" --prefix=/usr --no-deps uvicorn
75
76
# udev rules
77
install -Dm644 packaging/udev/70-trcc-lcd.rules \
78
"${pkgdir}/usr/lib/udev/rules.d/70-trcc-lcd.rules"
79
# Device-access group referenced by the udev rules
80
install -Dm644 packaging/sysusers/trcc.conf \
81
"${pkgdir}/usr/lib/sysusers.d/trcc.conf"
82
# modprobe config (USB storage quirks)
83
install -Dm644 packaging/modprobe/trcc-lcd.conf \
84
"${pkgdir}/usr/lib/modprobe.d/trcc-lcd.conf"
85
# modules-load (SCSI generic)
86
install -Dm644 packaging/modprobe/trcc-sg.conf \
87
"${pkgdir}/usr/lib/modules-load.d/trcc-sg.conf"
88
# desktop entry
89
install -Dm644 src/trcc/assets/trcc-linux.desktop \
90
"${pkgdir}/usr/share/applications/trcc-linux.desktop"
91
# polkit policy
92
install -Dm644 src/trcc/assets/com.github.lexonight1.trcc.policy \
93
"${pkgdir}/usr/share/polkit-1/actions/com.github.lexonight1.trcc.policy"
94
# systemd service
95
install -Dm644 src/trcc/assets/trcc-quirk-fix.service \
96
"${pkgdir}/usr/lib/systemd/system/trcc-quirk-fix.service"
97
98
# app icons
99
local size
100
for size in 256 128 64 48 32 24 16; do
101
install -Dm644 "src/trcc/assets/icons/trcc_${size}x${size}.png" \
102
"${pkgdir}/usr/share/icons/hicolor/${size}x${size}/apps/trcc.png"
103
done
104
105
# license
106
install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
107
}
108
Changes since previous scan
--- PKGBUILD @ 2026-10-23 00:02+++ PKGBUILD @ 2026-11-01 00:21@@ -5,7 +5,7 @@ pkgname=thermalright-trcc-git _pkgname=thermalright-trcc-linux pkgver=8.3.7.r3.gc9c9c8a-pkgrel=1+pkgrel=2 pkgdesc="Thermalright LCD/LED Control Center for Linux (git version)" arch=('any') url="https://github.com/Lexonight1/thermalright-trcc-linux"@@ -74,8 +74,11 @@ python -m pip install --root="${pkgdir}" --prefix=/usr --no-deps uvicorn # udev rules- install -Dm644 packaging/udev/99-trcc-lcd.rules \- "${pkgdir}/usr/lib/udev/rules.d/99-trcc-lcd.rules"+ install -Dm644 packaging/udev/70-trcc-lcd.rules \+ "${pkgdir}/usr/lib/udev/rules.d/70-trcc-lcd.rules"+ # Device-access group referenced by the udev rules+ install -Dm644 packaging/sysusers/trcc.conf \+ "${pkgdir}/usr/lib/sysusers.d/trcc.conf" # modprobe config (USB storage quirks) install -Dm644 packaging/modprobe/trcc-lcd.conf \ "${pkgdir}/usr/lib/modprobe.d/trcc-lcd.conf"Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Medium | 2 |
| 2026-10-31 00:07:41 | Medium | 2 |
| 2026-10-30 00:29:30 | Medium | 2 |
| 2026-10-29 00:13:55 | Medium | 2 |
| 2026-10-28 00:06:54 | Medium | 2 |
| 2026-10-27 00:23:28 | Medium | 2 |
| 2026-10-26 00:12:40 | Medium | 2 |
| 2026-10-25 00:20:48 | Medium | 2 |
| 2026-10-24 00:14:55 | Medium | 2 |
| 2026-10-23 05:36:55 | Medium | 2 |
| 2026-10-23 00:02:19 | Medium | 2 |
| 2026-10-22 00:13:10 | Medium | 2 |
| 2026-10-21 00:12:50 | Medium | 2 |
| 2026-10-20 00:10:31 | Medium | 2 |
| 2026-10-19 00:03:55 | Medium | 2 |
| 2026-10-18 00:06:55 | Medium | 2 |
| 2026-10-17 00:21:55 | Medium | 2 |
| 2026-10-16 00:12:47 | Medium | 2 |
| 2026-10-15 00:28:05 | Medium | 2 |
| 2026-10-14 00:06:47 | Medium | 2 |