tracefinity

MEDIUM

maintainer potatoattack 1 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package installs Python dependencies from an untrusted index (pytorch.org) which is not a standard PyPI index, posing a supply-chain risk if the host is compromised or spoofed.

Triggered rules

Medium pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:52 pip install --upgrade pip
PKGBUILD:54 pip install --no-cache-dir torch torchvision --index-url https://download.pytorch.org/whl/cpu
PKGBUILD:55 pip install --no-cache-dir -r backend/requirements.txt

Medium Package install from an untrusted index/registry host install_untrusted_index

An install command is pointed at a custom package index / registry on a non-allowlisted host (--index-url / --registry / --extra-index-url), a classic dependency-confusion vector.

PKGBUILD:54 pip install --no-cache-dir torch torchvision --index-url https://download.pytorch.org/whl/cpu

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package installs Python dependencies from an untrusted index (pytorch.org) which is not a standard PyPI index, posing a supply-chain risk if the host is compromised or spoofed.

PKGBUILD

3 offending line(s) highlighted

      1# Maintainer: Aaron Coach <aur@awc.id.au>
    
      2pkgname=tracefinity
    
      3_pkgname=tracefinity
    
      4pkgver=0.10.1
    
      5pkgrel=1
    
      6pkgdesc="Generate custom gridfinity bins with AI, from photos of your tools"
    
      7arch=('x86_64')
    
      8url="https://github.com/tracefinity/tracefinity"
    
      9license=('MIT')
    
      10depends=('nodejs' 'python' 'glibc' 'gcc-libs' 'libglvnd' 'glib2' 'libsm' 'libxext' 'libxrender' 'libheif')
    
      11makedepends=('git' 'python-pip' 'python-virtualenv' 'npm')
    
      12backup=('etc/tracefinity/tracefinity.env')
    
      13optdepends=('nginx: Reverse proxy to combine frontend and backend on a single port')
    
      14install='tracefinity.install'
    
      15
    
      16source=("${pkgname}-${pkgver}.tar.gz::https://github.com/tracefinity/tracefinity/archive/refs/tags/${pkgver}.tar.gz"
    
      17  "tracefinity-backend.service"
    
      18  "tracefinity-frontend.service"
    
      19  "tracefinity.sysusers"
    
      20  "tracefinity.tmpfiles"
    
      21  "tracefinity.nginx.conf"
    
      22  "tracefinity.env")
    
      23
    
      24sha256sums=('f6e86494f0808a3145c83478e146cc3f21d92fe65be52ec7d536137186086054'
    
      25            'd4f393ee489dc518bf42a93d8ace1322bc7edd68d96a5d676a7f0b00f948e773'
    
      26            '7e50478cde51f9c618eeeb09e7529f9471b2e0bd463c72987fb7415eba3adf35'
    
      27            '7be50bd94eefbbb8907f5f150761b76e16f65f7a2527f2bb371cac426303cf2d'
    
      28            '69751a017f2f4d5b89b69efaf5958a9db4728e2352ce9476ac677341a201f2a6'
    
      29            '0fe90b1c7354e22f4fe69ac69d5005e35addf86a02069e4ed60e57480a0e911f'
    
      30            'd6ce79dca841cdbde9e68c5dfd2aead1930263c89b03f8db8a2b4e7d06fcfeb1')
    
      31
    
      32build() {
    
      33  cd "$srcdir/$_pkgname-$pkgver"
    
      34
    
      35  msg2 "Building frontend..."
    
      36  cd frontend
    
      37
    
      38  # Remove test files so Next.js doesn't type-check them during the build
    
      39  find src -type f -name "*.test.ts*" -delete
    
      40
    
      41  npm install --cache "$srcdir/npm-cache" --no-audit --no-fund --legacy-peer-deps
    
      42
    
      43  NEXT_TELEMETRY_DISABLED=1 NEXT_PUBLIC_API_URL= npm run build
    
      44
    
      45  msg2 "Pruning frontend development dependencies..."
    
      46  npm prune --omit=dev --legacy-peer-deps
    
      47  cd ..
    
      48
    
      49  msg2 "Building backend virtualenv..."
    
      50  python -m venv "$srcdir/venv"
    
      51  source "$srcdir/venv/bin/activate"
    
      52  pip install --upgrade pip
    
      53
    
      54  pip install --no-cache-dir torch torchvision --index-url https://download.pytorch.org/whl/cpu
    
      55  pip install --no-cache-dir -r backend/requirements.txt
    
      56
    
      57  find "$srcdir/venv" -type d -name "__pycache__" -exec rm -rf {} +
    
      58}
    
      59
    
      60package() {
    
      61  cd "$srcdir/$_pkgname-$pkgver"
    
      62
    
      63  install -d "$pkgdir/opt/$_pkgname"
    
      64  cp -a "$srcdir/venv" "$pkgdir/opt/$_pkgname/"
    
      65
    
      66  install -d "$pkgdir/opt/$_pkgname/backend"
    
      67  cp -a backend/* "$pkgdir/opt/$_pkgname/backend/"
    
      68
    
      69  install -d "$pkgdir/opt/$_pkgname/frontend"
    
      70  cp -a frontend/.next "$pkgdir/opt/$_pkgname/frontend/"
    
      71  cp -a frontend/public "$pkgdir/opt/$_pkgname/frontend/"
    
      72  cp frontend/package*.json "$pkgdir/opt/$_pkgname/frontend/"
    
      73  cp -a frontend/node_modules "$pkgdir/opt/$_pkgname/frontend/"
    
      74
    
      75  # Fix python venv shebang paths (makes the venv portable to /opt/tracefinity)
    
      76  find "$pkgdir/opt/$_pkgname/venv/bin" -type f -exec sed -i "s|$srcdir/venv|/opt/$_pkgname/venv|g" {} +
    
      77
    
      78  # Inject the package version into the backend systemd service
    
      79  sed -i "/^Environment=\"STORAGE_PATH=/a Environment=\"APP_VERSION=${pkgver}\"" "$srcdir/tracefinity-backend.service"
    
      80
    
      81  install -Dm644 "$srcdir/tracefinity-backend.service" -t "$pkgdir/usr/lib/systemd/system/"
    
      82  install -Dm644 "$srcdir/tracefinity-frontend.service" -t "$pkgdir/usr/lib/systemd/system/"
    
      83  install -Dm644 "$srcdir/tracefinity.sysusers" "$pkgdir/usr/lib/sysusers.d/$_pkgname.conf"
    
      84  install -Dm644 "$srcdir/tracefinity.tmpfiles" "$pkgdir/usr/lib/tmpfiles.d/$_pkgname.conf"
    
      85
    
      86  install -Dm600 "$srcdir/tracefinity.env" "$pkgdir/etc/$_pkgname/$_pkgname.env"
    
      87  install -Dm644 "$srcdir/tracefinity.nginx.conf" "$pkgdir/etc/$_pkgname/nginx.example.conf"
    
      88
    
      89  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      90}
    
      91

Changes since previous scan

--- PKGBUILD @ 2026-10-25 00:20
+++ PKGBUILD @ 2026-11-01 00:21
@@ -1,7 +1,7 @@
 # Maintainer: Aaron Coach <aur@awc.id.au>
 pkgname=tracefinity
 _pkgname=tracefinity
-pkgver=0.10.0
+pkgver=0.10.1
 pkgrel=1
 pkgdesc="Generate custom gridfinity bins with AI, from photos of your tools"
 arch=('x86_64')
@@ -21,7 +21,7 @@
   "tracefinity.nginx.conf"
   "tracefinity.env")
 
-sha256sums=('86b1a15da65ecc330555cd1fbae8cf9da30d4811a7c1fb74a44ad31d9fcd78df'
+sha256sums=('f6e86494f0808a3145c83478e146cc3f21d92fe65be52ec7d536137186086054'
             'd4f393ee489dc518bf42a93d8ace1322bc7edd68d96a5d676a7f0b00f948e773'
             '7e50478cde51f9c618eeeb09e7529f9471b2e0bd463c72987fb7415eba3adf35'
             '7be50bd94eefbbb8907f5f150761b76e16f65f7a2527f2bb371cac426303cf2d'

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Medium	3
2026-10-31 00:07:41	Medium	3
2026-10-30 00:29:30	Medium	3
2026-10-29 00:13:55	Medium	3
2026-10-28 00:06:54	Medium	3
2026-10-27 00:23:28	Medium	3
2026-10-26 00:12:40	Medium	3
2026-10-25 03:41:34	Medium	3
2026-10-25 00:20:48	Low	3
2026-10-24 00:14:55	Low	3
2026-10-23 00:02:19	Low	3
2026-10-22 00:13:10	Low	3
2026-10-21 00:12:50	Low	3
2026-10-20 00:10:31	Low	3
2026-10-19 00:03:55	Low	3
2026-10-18 00:06:55	Low	3
2026-10-17 00:21:55	Low	3
2026-10-16 00:12:47	Low	3
2026-10-15 00:28:05	Low	3
2026-10-14 00:06:47	Low	3