tracefinity

LOW

maintainer potatoattack 1 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package installs Python dependencies from the official PyTorch index and project's own requirements.txt; these are legitimate build dependencies, not untrusted or malicious packages.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package installs Python dependencies from the official PyTorch index and project's own requirements.txt; these are legitimate build dependencies, not untrusted or malicious packages.

2 higher static findings superseded - not the current verdict (shown for transparency)

Medium pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:52 pip install --upgrade pip
PKGBUILD:54 pip install --no-cache-dir torch torchvision --index-url https://download.pytorch.org/whl/cpu
PKGBUILD:55 pip install --no-cache-dir -r backend/requirements.txt

Medium Package install from an untrusted index/registry host install_untrusted_index

An install command is pointed at a custom package index / registry on a non-allowlisted host (--index-url / --registry / --extra-index-url), a classic dependency-confusion vector.

PKGBUILD:54 pip install --no-cache-dir torch torchvision --index-url https://download.pytorch.org/whl/cpu

PKGBUILD

3 offending line(s) highlighted

      1# Maintainer: Aaron Coach <aur@awc.id.au>
    
      2pkgname=tracefinity
    
      3_pkgname=tracefinity
    
      4pkgver=0.9.3
    
      5pkgrel=1
    
      6pkgdesc="Generate custom gridfinity bins with AI, from photos of your tools"
    
      7arch=('x86_64')
    
      8url="https://github.com/tracefinity/tracefinity"
    
      9license=('MIT')
    
      10depends=('nodejs' 'python' 'glibc' 'gcc-libs' 'libglvnd' 'glib2' 'libsm' 'libxext' 'libxrender' 'libheif')
    
      11makedepends=('git' 'python-pip' 'python-virtualenv' 'npm')
    
      12backup=('etc/tracefinity/tracefinity.env')
    
      13optdepends=('nginx: Reverse proxy to combine frontend and backend on a single port')
    
      14install='tracefinity.install'
    
      15
    
      16source=("${pkgname}-${pkgver}.tar.gz::https://github.com/tracefinity/tracefinity/archive/refs/tags/${pkgver}.tar.gz"
    
      17  "tracefinity-backend.service"
    
      18  "tracefinity-frontend.service"
    
      19  "tracefinity.sysusers"
    
      20  "tracefinity.tmpfiles"
    
      21  "tracefinity.nginx.conf"
    
      22  "tracefinity.env")
    
      23
    
      24sha256sums=('edc5da13d09e403e700457bdfaa985db9addd859682e14debe10157bcc11673d'
    
      25            'd4f393ee489dc518bf42a93d8ace1322bc7edd68d96a5d676a7f0b00f948e773'
    
      26            '7e50478cde51f9c618eeeb09e7529f9471b2e0bd463c72987fb7415eba3adf35'
    
      27            '7be50bd94eefbbb8907f5f150761b76e16f65f7a2527f2bb371cac426303cf2d'
    
      28            '69751a017f2f4d5b89b69efaf5958a9db4728e2352ce9476ac677341a201f2a6'
    
      29            '0fe90b1c7354e22f4fe69ac69d5005e35addf86a02069e4ed60e57480a0e911f'
    
      30            'd6ce79dca841cdbde9e68c5dfd2aead1930263c89b03f8db8a2b4e7d06fcfeb1')
    
      31
    
      32build() {
    
      33  cd "$srcdir/$_pkgname-$pkgver"
    
      34
    
      35  msg2 "Building frontend..."
    
      36  cd frontend
    
      37
    
      38  # Remove test files so Next.js doesn't type-check them during the build
    
      39  find src -type f -name "*.test.ts*" -delete
    
      40
    
      41  npm install --cache "$srcdir/npm-cache" --no-audit --no-fund --legacy-peer-deps
    
      42
    
      43  NEXT_TELEMETRY_DISABLED=1 NEXT_PUBLIC_API_URL= npm run build
    
      44
    
      45  msg2 "Pruning frontend development dependencies..."
    
      46  npm prune --omit=dev --legacy-peer-deps
    
      47  cd ..
    
      48
    
      49  msg2 "Building backend virtualenv..."
    
      50  python -m venv "$srcdir/venv"
    
      51  source "$srcdir/venv/bin/activate"
    
      52  pip install --upgrade pip
    
      53
    
      54  pip install --no-cache-dir torch torchvision --index-url https://download.pytorch.org/whl/cpu
    
      55  pip install --no-cache-dir -r backend/requirements.txt
    
      56
    
      57  find "$srcdir/venv" -type d -name "__pycache__" -exec rm -rf {} +
    
      58}
    
      59
    
      60package() {
    
      61  cd "$srcdir/$_pkgname-$pkgver"
    
      62
    
      63  install -d "$pkgdir/opt/$_pkgname"
    
      64  cp -a "$srcdir/venv" "$pkgdir/opt/$_pkgname/"
    
      65
    
      66  install -d "$pkgdir/opt/$_pkgname/backend"
    
      67  cp -a backend/* "$pkgdir/opt/$_pkgname/backend/"
    
      68
    
      69  install -d "$pkgdir/opt/$_pkgname/frontend"
    
      70  cp -a frontend/.next "$pkgdir/opt/$_pkgname/frontend/"
    
      71  cp -a frontend/public "$pkgdir/opt/$_pkgname/frontend/"
    
      72  cp frontend/package*.json "$pkgdir/opt/$_pkgname/frontend/"
    
      73  cp -a frontend/node_modules "$pkgdir/opt/$_pkgname/frontend/"
    
      74
    
      75  # Fix python venv shebang paths (makes the venv portable to /opt/tracefinity)
    
      76  find "$pkgdir/opt/$_pkgname/venv/bin" -type f -exec sed -i "s|$srcdir/venv|/opt/$_pkgname/venv|g" {} +
    
      77
    
      78  # Inject the package version into the backend systemd service
    
      79  sed -i "/^Environment=\"STORAGE_PATH=/a Environment=\"APP_VERSION=${pkgver}\"" "$srcdir/tracefinity-backend.service"
    
      80
    
      81  install -Dm644 "$srcdir/tracefinity-backend.service" -t "$pkgdir/usr/lib/systemd/system/"
    
      82  install -Dm644 "$srcdir/tracefinity-frontend.service" -t "$pkgdir/usr/lib/systemd/system/"
    
      83  install -Dm644 "$srcdir/tracefinity.sysusers" "$pkgdir/usr/lib/sysusers.d/$_pkgname.conf"
    
      84  install -Dm644 "$srcdir/tracefinity.tmpfiles" "$pkgdir/usr/lib/tmpfiles.d/$_pkgname.conf"
    
      85
    
      86  install -Dm600 "$srcdir/tracefinity.env" "$pkgdir/etc/$_pkgname/$_pkgname.env"
    
      87  install -Dm644 "$srcdir/tracefinity.nginx.conf" "$pkgdir/etc/$_pkgname/nginx.example.conf"
    
      88
    
      89  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      90}
    
      91

Changes since previous scan

--- PKGBUILD @ 2026-09-10 00:22
+++ PKGBUILD @ 2026-09-17 00:27
@@ -1,7 +1,7 @@
 # Maintainer: Aaron Coach <aur@awc.id.au>
 pkgname=tracefinity
 _pkgname=tracefinity
-pkgver=0.9.2
+pkgver=0.9.3
 pkgrel=1
 pkgdesc="Generate custom gridfinity bins with AI, from photos of your tools"
 arch=('x86_64')
@@ -21,7 +21,7 @@
   "tracefinity.nginx.conf"
   "tracefinity.env")
 
-sha256sums=('70dd8038c5756f9eb13b78fff6a447198ab01d653f12413a08cd4a09ce7f197e'
+sha256sums=('edc5da13d09e403e700457bdfaa985db9addd859682e14debe10157bcc11673d'
             'd4f393ee489dc518bf42a93d8ace1322bc7edd68d96a5d676a7f0b00f948e773'
             '7e50478cde51f9c618eeeb09e7529f9471b2e0bd463c72987fb7415eba3adf35'
             '7be50bd94eefbbb8907f5f150761b76e16f65f7a2527f2bb371cac426303cf2d'

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	3
2026-09-16 00:03:17	Low	3
2026-09-15 00:25:31	Low	3
2026-09-14 00:27:57	Low	3
2026-09-13 00:19:54	Low	3
2026-09-12 00:25:17	Low	3
2026-09-11 00:19:22	Low	3
2026-09-10 05:20:15	Medium	2
2026-09-10 00:22:44	Low	3
2026-09-09 00:04:09	Low	3
2026-09-08 00:18:08	Low	3
2026-09-07 00:30:15	Low	3
2026-09-06 00:17:06	Low	3
2026-09-05 00:16:27	Low	3
2026-09-04 00:03:13	Low	3
2026-09-03 00:15:47	Low	3
2026-09-02 00:02:31	Low	3
2026-09-01 00:11:19	Low	3
2026-08-31 05:44:47	Medium	2
2026-08-31 00:19:57	Medium	3