vial-keychron-git

maintainer Tymon3310 · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The pip installs are for building the application (pyinstaller and requirements.txt) from the project's own source repository, which is a normal part of packaging and not inherently dangerous.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The pip installs are for building the application (pyinstaller and requirements.txt) from the project's own source repository, which is a normal part of packaging and not inherently dangerous.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:33 python -m pip install --upgrade pip
PKGBUILD:37 pip install pyinstaller
PKGBUILD:38 pip install -r requirements.txt

PKGBUILD

3 offending line(s) highlighted

      1# Maintainer: Tymon3310 <aur@tymon3310.dev>
    
      2
    
      3_pkgname=vial-keychron
    
      4_Pkgname=Vial
    
      5pkgname=vial-keychron-git
    
      6pkgver=r701.99b73db
    
      7pkgrel=1
    
      8pkgdesc="Vial is an open-source cross-platform (Windows, Linux and Mac) GUI and a QMK fork for configuring your keyboard in real time, similar to VIA. Keychron branch."
    
      9arch=('x86_64' 'i686')
    
      10url="https://github.com/Tymon3310/vial-gui"
    
      11license=('GPL-2.0-only')
    
      12options=(!strip !debug)
    
      13depends=('python' 'python-pyqt5' 'python-pip' 'hidapi' 'hicolor-icon-theme')
    
      14makedepends=('git' 'python-setuptools' 'python-wheel')
    
      15provides=("vial" "vial-keychron")
    
      16conflicts=("vial" "vial-appimage" "vial-bin" "vial-keychron-bin")
    
      17source=('vial-gui::git+https://github.com/Tymon3310/vial-gui.git'
    
      18  '59-vial.rules')
    
      19sha256sums=('SKIP'
    
      20  'a6af0820ee6960dccab9ce0df0a898ccd0a50fecd992e341656dd1af78680502')
    
      21
    
      22pkgver() {
    
      23  cd "$srcdir/vial-gui"
    
      24  printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
    
      25}
    
      26
    
      27build() {
    
      28  cd "$srcdir/vial-gui"
    
      29
    
      30  # Install dependencies into a temporary local directory to bundle with pyinstaller
    
      31  python -m venv venv
    
      32  source venv/bin/activate
    
      33  python -m pip install --upgrade pip
    
      34
    
      35  # We install pyinstaller directly through pip in the venv,
    
      36  # because arch doesn't have it in standard repos
    
      37  pip install pyinstaller
    
      38  pip install -r requirements.txt
    
      39
    
      40  # Build the executable using PyInstaller directly (no AppImage)
    
      41  pyinstaller --noconfirm --onedir --windowed --name "Vial" --add-data "src/main/resources:resources" --add-data "src/main/python/resources:resources" --add-data "src/main/python:." src/main/python/main.py
    
      42
    
      43  deactivate
    
      44}
    
      45
    
      46package() {
    
      47  cd "$srcdir/vial-gui"
    
      48
    
      49  # Create directories
    
      50  install -dm755 "$pkgdir/opt/${_pkgname}"
    
      51  install -dm755 "$pkgdir/usr/bin"
    
      52  install -dm755 "$pkgdir/usr/share/applications"
    
      53  install -dm755 "$pkgdir/usr/share/pixmaps"
    
      54  install -dm755 "$pkgdir/usr/lib/udev/rules.d"
    
      55
    
      56  # Copy built application
    
      57  cp -r dist/Vial/* "$pkgdir/opt/${_pkgname}/"
    
      58
    
      59  # Fix permissions
    
      60  find "$pkgdir/opt/${_pkgname}" -type d -exec chmod 755 {} \;
    
      61  find "$pkgdir/opt/${_pkgname}" -type f -exec chmod 644 {} \;
    
      62  chmod 755 "$pkgdir/opt/${_pkgname}/Vial"
    
      63
    
      64  # Desktop file
    
      65  install -Dm644 "misc/Vial.desktop" "$pkgdir/usr/share/applications/${_pkgname}.desktop"
    
      66  sed -i "s|Exec=Vial|Exec=/usr/bin/${_pkgname}|" "$pkgdir/usr/share/applications/${_pkgname}.desktop"
    
      67
    
      68  # Icon
    
      69  install -Dm644 "src/main/icons/linux/1024.png" "$pkgdir/usr/share/pixmaps/${_pkgname}.png"
    
      70  sed -i "s|Icon=Vial|Icon=${_pkgname}|" "$pkgdir/usr/share/applications/${_pkgname}.desktop"
    
      71
    
      72  # Symlink executable
    
      73  ln -s "/opt/${_pkgname}/Vial" "$pkgdir/usr/bin/${_pkgname}"
    
      74
    
      75  # Create udev rule
    
      76  install -Dm644 "$srcdir/59-vial.rules" "$pkgdir/usr/lib/udev/rules.d/59-vial.rules"
    
      77}
    
      78

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2