tracefinity
maintainer potatoattack
· 1 votes
· scanned 2026-08-03 00:08:14.047287
MEDIUM
View on AUR ↗
Why flagged
The package installs Python dependencies from an untrusted index (PyTorch's private index) and uses pip on external requirements, creating a potential supply-chain risk if the host is compromised or spoofed.
Triggered rules
MEDIUM
pip install of an external package
pip_install_external
`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.
-
PKGBUILD:49
pip install --upgrade pip -
PKGBUILD:51
pip install --no-cache-dir torch torchvision --index-url https://download.pytorch.org/whl/cpu -
PKGBUILD:52
pip install --no-cache-dir -r backend/requirements.txt
MEDIUM
Package install from an untrusted index/registry host
install_untrusted_index
An install command is pointed at a custom package index / registry on a non-allowlisted host (--index-url / --registry / --extra-index-url), a classic dependency-confusion vector.
-
PKGBUILD:51
pip install --no-cache-dir torch torchvision --index-url https://download.pytorch.org/whl/cpu
MEDIUM
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package installs Python dependencies from an untrusted index (PyTorch's private index) and uses pip on external requirements, creating a potential supply-chain risk if the host is compromised or spoofed.
PKGBUILD
3 offending line(s) highlighted
1
# Maintainer: Aaron Coach <aur@awc.id.au>
2
pkgname=tracefinity
3
_pkgname=tracefinity
4
pkgver=0.8.0
5
pkgrel=1
6
pkgdesc="Generate custom gridfinity bins with AI, from photos of your tools"
7
arch=('x86_64')
8
url="https://github.com/tracefinity/tracefinity"
9
license=('MIT')
10
depends=('nodejs' 'python' 'glibc' 'gcc-libs' 'libglvnd' 'glib2' 'libsm' 'libxext' 'libxrender' 'libheif')
11
makedepends=('git' 'python-pip' 'python-virtualenv' 'npm')
12
backup=('etc/tracefinity/tracefinity.env')
13
optdepends=('nginx: Reverse proxy to combine frontend and backend on a single port')
14
install='tracefinity.install'
15
16
source=("${pkgname}-${pkgver}.tar.gz::https://github.com/tracefinity/tracefinity/archive/refs/tags/${pkgver}.tar.gz"
17
"tracefinity-backend.service"
18
"tracefinity-frontend.service"
19
"tracefinity.sysusers"
20
"tracefinity.tmpfiles"
21
"tracefinity.nginx.conf"
22
"tracefinity.env")
23
24
sha256sums=('9a59eca820d441117c67167c09b4b9b35a2ddb8f0e3b2066b3d23a07ed256163'
25
'd4f393ee489dc518bf42a93d8ace1322bc7edd68d96a5d676a7f0b00f948e773'
26
'7e50478cde51f9c618eeeb09e7529f9471b2e0bd463c72987fb7415eba3adf35'
27
'7be50bd94eefbbb8907f5f150761b76e16f65f7a2527f2bb371cac426303cf2d'
28
'69751a017f2f4d5b89b69efaf5958a9db4728e2352ce9476ac677341a201f2a6'
29
'0fe90b1c7354e22f4fe69ac69d5005e35addf86a02069e4ed60e57480a0e911f'
30
'905c4f757dd03c99754fb8827a6f677679655bce04556d922e9de8cead962eb7')
31
32
build() {
33
cd "$srcdir/$_pkgname-$pkgver"
34
35
msg2 "Building frontend..."
36
cd frontend
37
38
npm install --cache "$srcdir/npm-cache" --no-audit --no-fund --legacy-peer-deps
39
40
NEXT_TELEMETRY_DISABLED=1 NEXT_PUBLIC_API_URL= npm run build
41
42
msg2 "Pruning frontend development dependencies..."
43
npm prune --omit=dev --legacy-peer-deps
44
cd ..
45
46
msg2 "Building backend virtualenv..."
47
python -m venv "$srcdir/venv"
48
source "$srcdir/venv/bin/activate"
49
pip install --upgrade pip
50
51
pip install --no-cache-dir torch torchvision --index-url https://download.pytorch.org/whl/cpu
52
pip install --no-cache-dir -r backend/requirements.txt
53
54
find "$srcdir/venv" -type d -name "__pycache__" -exec rm -rf {} +
55
}
56
57
package() {
58
cd "$srcdir/$_pkgname-$pkgver"
59
60
install -d "$pkgdir/opt/$_pkgname"
61
cp -a "$srcdir/venv" "$pkgdir/opt/$_pkgname/"
62
63
install -d "$pkgdir/opt/$_pkgname/backend"
64
cp -a backend/* "$pkgdir/opt/$_pkgname/backend/"
65
66
install -d "$pkgdir/opt/$_pkgname/frontend"
67
cp -a frontend/.next "$pkgdir/opt/$_pkgname/frontend/"
68
cp -a frontend/public "$pkgdir/opt/$_pkgname/frontend/"
69
cp frontend/package*.json "$pkgdir/opt/$_pkgname/frontend/"
70
cp -a frontend/node_modules "$pkgdir/opt/$_pkgname/frontend/"
71
72
# Fix python venv shebang paths (makes the venv portable to /opt/tracefinity)
73
find "$pkgdir/opt/$_pkgname/venv/bin" -type f -exec sed -i "s|$srcdir/venv|/opt/$_pkgname/venv|g" {} +
74
75
# Inject the package version into the backend systemd service
76
sed -i "/^Environment=\"STORAGE_PATH=/a Environment=\"APP_VERSION=${pkgver}\"" "$srcdir/tracefinity-backend.service"
77
78
install -Dm644 "$srcdir/tracefinity-backend.service" -t "$pkgdir/usr/lib/systemd/system/"
79
install -Dm644 "$srcdir/tracefinity-frontend.service" -t "$pkgdir/usr/lib/systemd/system/"
80
install -Dm644 "$srcdir/tracefinity.sysusers" "$pkgdir/usr/lib/sysusers.d/$_pkgname.conf"
81
install -Dm644 "$srcdir/tracefinity.tmpfiles" "$pkgdir/usr/lib/tmpfiles.d/$_pkgname.conf"
82
83
install -Dm600 "$srcdir/tracefinity.env" "$pkgdir/etc/$_pkgname/$_pkgname.env"
84
install -Dm644 "$srcdir/tracefinity.nginx.conf" "$pkgdir/etc/$_pkgname/nginx.example.conf"
85
86
install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
87
}
88
Changes since previous scan
--- PKGBUILD @ 2026-07-27 00:24+++ PKGBUILD @ 2026-08-03 00:08@@ -1,7 +1,7 @@ # Maintainer: Aaron Coach <aur@awc.id.au> pkgname=tracefinity _pkgname=tracefinity-pkgver=0.7.0+pkgver=0.8.0 pkgrel=1 pkgdesc="Generate custom gridfinity bins with AI, from photos of your tools" arch=('x86_64')@@ -21,7 +21,7 @@ "tracefinity.nginx.conf" "tracefinity.env") -sha256sums=('398f7a87625d47c66c36484ad670d6f476f3cdfab9121600ce244066d10ffdab'+sha256sums=('9a59eca820d441117c67167c09b4b9b35a2ddb8f0e3b2066b3d23a07ed256163' 'd4f393ee489dc518bf42a93d8ace1322bc7edd68d96a5d676a7f0b00f948e773' '7e50478cde51f9c618eeeb09e7529f9471b2e0bd463c72987fb7415eba3adf35' '7be50bd94eefbbb8907f5f150761b76e16f65f7a2527f2bb371cac426303cf2d'@@ -72,6 +72,9 @@ # Fix python venv shebang paths (makes the venv portable to /opt/tracefinity) find "$pkgdir/opt/$_pkgname/venv/bin" -type f -exec sed -i "s|$srcdir/venv|/opt/$_pkgname/venv|g" {} + + # Inject the package version into the backend systemd service+ sed -i "/^Environment=\"STORAGE_PATH=/a Environment=\"APP_VERSION=${pkgver}\"" "$srcdir/tracefinity-backend.service"+ install -Dm644 "$srcdir/tracefinity-backend.service" -t "$pkgdir/usr/lib/systemd/system/" install -Dm644 "$srcdir/tracefinity-frontend.service" -t "$pkgdir/usr/lib/systemd/system/" install -Dm644 "$srcdir/tracefinity.sysusers" "$pkgdir/usr/lib/sysusers.d/$_pkgname.conf"Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | MEDIUM | 3 |
| 2026-08-02 00:16:08 | MEDIUM | 3 |
| 2026-08-01 00:11:18 | MEDIUM | 3 |
| 2026-07-31 00:14:10 | MEDIUM | 3 |
| 2026-07-30 00:17:23 | MEDIUM | 3 |
| 2026-07-29 00:25:53 | MEDIUM | 3 |
| 2026-07-28 00:07:28 | MEDIUM | 3 |
| 2026-07-27 01:34:00 | MEDIUM | 3 |
| 2026-07-27 00:24:32 | LOW | 3 |
| 2026-07-26 00:07:32 | LOW | 3 |
| 2026-07-25 00:13:44 | LOW | 3 |
| 2026-07-24 00:02:28 | LOW | 3 |
| 2026-07-23 00:14:47 | LOW | 3 |
| 2026-07-22 00:29:32 | LOW | 3 |
| 2026-07-21 00:24:15 | LOW | 3 |
| 2026-07-20 00:19:49 | LOW | 3 |
| 2026-07-19 05:10:21 | MEDIUM | 2 |
| 2026-07-19 00:17:08 | LOW | 3 |
| 2026-07-18 00:14:48 | LOW | 3 |
| 2026-07-17 00:06:16 | LOW | 3 |