viseron

maintainer AlD · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The pip installs run inside a venv against the project's own requirements.txt (from the official GitHub source tarball with checksums), which is normal Python packaging practice; the only real concern is that pip resolves dependencies at build time from PyPI, but this is standard for Python AUR packages and not meaningfully more dangerous than any other pip-based build.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 70%): The pip installs run inside a venv against the project's own requirements.txt (from the official GitHub source tarball with checksums), which is normal Python packaging practice; the only real concern is that pip resolves dependencies at build time from PyPI, but this is standard for Python AUR packages and not meaningfully more dangerous than any other pip-based build.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:112 pip install --upgrade pip
PKGBUILD:113 pip install -r requirements.txt

PKGBUILD

2 offending line(s) highlighted

      1pkgname=viseron
    
      2pkgver=3.5.3
    
      3pkgrel=1
    
      4pkgdesc="Self-hosted, local only NVR with object detection"
    
      5arch=('x86_64')
    
      6url="https://github.com/roflcoopter/viseron"
    
      7license=('MIT')
    
      8depends=(
    
      9    'ffmpeg'
    
      10    'go2rtc'
    
      11    'postgresql-libs'
    
      12    'python'
    
      13    'python-dlib'
    
      14    'python-gobject'
    
      15    'python-numpy'
    
      16    'python-pillow'
    
      17    'python-psycopg2'
    
      18    'python-pytorch'
    
      19    'python-requests'
    
      20    'python-scikit-learn'
    
      21    'python-torchvision'
    
      22    'python-yaml'
    
      23    'cpulimit'
    
      24)
    
      25optdepends=(
    
      26    'libedgetpu: for USB Coral support'
    
      27    'cuda: for GPU support'
    
      28)
    
      29makedepends=(
    
      30    'cmake'
    
      31    'gcc'
    
      32    'gobject-introspection'
    
      33    'nodejs'
    
      34    'npm'
    
      35    'pkgconf'
    
      36    'python-pip'
    
      37    'python-wheel'
    
      38)
    
      39source=(
    
      40    "$pkgname-$pkgver.tar.gz::https://github.com/roflcoopter/viseron/archive/refs/tags/v${pkgver}.tar.gz"
    
      41    "https://raw.githubusercontent.com/AlexxIT/go2rtc/v1.9.9/www/video-rtc.js"
    
      42    "viseron.service"
    
      43    "viseron-go2rtc.service"
    
      44    "viseron.sysusers"
    
      45    "viseron.tmpfiles"
    
      46    "viseron-nginx.conf"
    
      47    '01-setup.patch'
    
      48    '02-arch-fixes.patch'
    
      49    '03-arch-ffmpeg-path.patch'
    
      50    '04-go2rtc-config-path.patch'
    
      51    '05-arch-python3.14-fork.patch'
    
      52    '06-disable-playwright.patch'
    
      53
    
      54)
    
      55b2sums=('9a830c0c18dca0576a210cf71fb494283b0ad90b0eb9973574c545c32fca446886ef1782e081cdc9bd7c011fbf20c33ef0cb156923cf2939220c200b6a27b99f'
    
      56        '45897a2392b7b84a630999ba6c9680754c0902cdd0907ef3a26a3a36f761ed479dc1fa6d21262d93081c92bbe1852efadde85542f67c31f5a63e2a75da628208'
    
      57        '5566b37aaa83c3f8d7862ea4148f5d71855c337d932c57fe4ec16466df6b0ff21ef3a90861237581beb7ef2cfadaac2ca581c65cb8eea532a9be0c98a8cb740b'
    
      58        'bf5c9abe11e112157d67e267fc906702ee13ce6937cf31a3a434acc55f45f0fcb09488a21391d8f8e15968da59b3e5b3caa9dc1b94a9371cedf5fd1ab08fc629'
    
      59        '9f7963c50af8ced548f868a3a2d6bfe7819feb9870244ef5efd8b22bdbe9465b4eece7f2208482b272bb3c8f91c1fe48fe9c85f4e1f3b213be93edfd9a0eea8e'
    
      60        'a452832d65227f565bc18ca5a6bc0dfc3cb59a82ba44dbf5d788d4809b6e44c42445c760357dc48d5074d0d3131607eac8b47dfd1b46e29bd84f25c189b4cd65'
    
      61        '8869068c2d23078adc84670b30c8db39754e4cc07f115cf74060dfc1b2037ff9aaacbda56a295b4d9f10314e026f575ac8d1794a60ea43da52adf94294473ea1'
    
      62        'a3171e1dd064c362048b11aed8d5ca2144882f9d214a5a60875a0b207067cab788631b52fb42f483deb36f39b15d0cd150cf220a3f651eb304d609be64db0192'
    
      63        '1615bfdcb91866a721c6f0d496fb34a9fdaaf995b82278c7afa7445d7043007f7a735b208e234b9338705010eb7013815b15116abb6fcd10cd86e52e0945764e'
    
      64        '3a9dd8e33300e8d8b4404ee29b0bd4c597afb79edf0c84dbfd4df37b6ebf0fd242437061c02e966b96782f523b729bed449eb74e3acd299651dbd869ceaab11c'
    
      65        'acf86c47b8f18ca7fbd102673ea976ba00b20b5473a40d19fe43cb9a10957a58092dbfcbd8c0e1e4b9475106f41b58285166b0327e435065bd4b12cc7bb968af'
    
      66        '1dd80f11d7b4a6ab3dda035da8d00d46822125f680cee1d934ba552f40b17af58c5231ebad3610f932f72ad7f4ad4c963dd7fbd0fd924145de9f196d0620bee2'
    
      67        '33d3f613c9c73eb8e4c2071759bd7765a411a47db9a52aad23979f547829116c319eb1a4841c290d7b08ffa7ab2ae83d7c2ed43e51b9c91a2727ec4c6b247e61')
    
      68
    
      69prepare() {
    
      70  cd "$pkgname-$pkgver"
    
      71
    
      72  local p
    
      73  for p in "$srcdir"/*.patch; do
    
      74    if [ -f "$p" ]; then
    
      75      msg2 "Applying patch: $(basename "$p")"
    
      76      patch -Np1 -i "$p"
    
      77    fi
    
      78  done
    
      79
    
      80  sed -i 's/==/>=/' requirements.txt
    
      81}
    
      82
    
      83build() {
    
      84  export NODE_OPTIONS=--max-old-space-size=4096
    
      85
    
      86  cd "$pkgname-$pkgver"
    
      87
    
      88  pushd frontend > /dev/null
    
      89  npm ci --legacy-peer-deps
    
      90  cp "${srcdir}/video-rtc.js" src/components/player/liveplayer/
    
      91
    
      92  npm run build
    
      93  popd
    
      94
    
      95  mkdir -p viseron/frontend
    
      96  cp -r frontend/dist/* viseron/frontend/
    
      97}
    
      98
    
      99package() {
    
      100  cd "$pkgname-$pkgver"
    
      101
    
      102  install -Dm644 "$srcdir/viseron.service" "$pkgdir/usr/lib/systemd/system/viseron.service"
    
      103  install -Dm644 "$srcdir/viseron-go2rtc.service" "$pkgdir/usr/lib/systemd/system/viseron-go2rtc.service"
    
      104  install -Dm644 "$srcdir/viseron.sysusers" "$pkgdir/usr/lib/sysusers.d/viseron.conf"
    
      105  install -Dm644 "$srcdir/viseron.tmpfiles" "$pkgdir/usr/lib/tmpfiles.d/viseron.conf"
    
      106  install -Dm644 "$srcdir/viseron-nginx.conf" "$pkgdir/usr/share/doc/$pkgname/nginx.conf.example"
    
      107
    
      108  install -d "$pkgdir/usr/lib/viseron"
    
      109  python -m venv --system-site-packages "$pkgdir/usr/lib/viseron"
    
      110  source "$pkgdir/usr/lib/viseron/bin/activate"
    
      111
    
      112  pip install --upgrade pip
    
      113  pip install -r requirements.txt
    
      114
    
      115  # Viseron expects to run from its source tree.
    
      116  cp -r manager.py viseron "$pkgdir/usr/lib/viseron/"
    
      117
    
      118  pip cache purge
    
      119  find "$pkgdir/usr/lib/viseron" -type d -name "__pycache__" -exec rm -rf {} +
    
      120}
    
      121

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	3
2026-07-23 00:14:47	LOW	3
2026-07-22 00:29:32	LOW	3
2026-07-21 00:24:15	LOW	3
2026-07-20 00:19:49	LOW	3
2026-07-19 00:17:08	LOW	3
2026-07-18 00:14:48	LOW	3
2026-07-17 00:06:16	LOW	3
2026-07-16 00:05:41	LOW	3
2026-07-15 00:09:25	LOW	3