voe-dl-git
maintainer ViBoSchu
· 1 votes
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The pip install is used to install a wheel built locally from the project's own source code, not an external package; the build process is isolated and uses --no-index, posing no supply-chain risk.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The pip install is used to install a wheel built locally from the project's own source code, not an external package; the build process is isolated and uses --no-index, posing no supply-chain risk.
1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM
pip install of an external package
pip_install_external
`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.
-
PKGBUILD:45
python -m pip install --root="$pkgdir" --prefix=/usr --no-deps --no-index --find-links=dist --ignore-installed --no-compile --root-user-action=ignore voe-dl
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Vincent Schult <viboschu@gmail.com>
2
3
pkgname=voe-dl-git
4
pkgver=1.9.0.r0.g8d27ec3
5
pkgrel=1
6
pkgdesc="A Python-based downloader for videos hosted on voe.sx."
7
arch=('any')
8
url="https://github.com/MPZ-00/voe-dl"
9
license=(GPL-3.0-only)
10
11
depends=(
12
python
13
python-requests
14
python-beautifulsoup4
15
yt-dlp
16
python-wget
17
)
18
19
makedepends=(
20
git
21
python-build
22
python-hatchling
23
python-pip
24
)
25
26
provides=("${pkgname%-git}")
27
conflicts=("${pkgname%-git}")
28
29
source=("${pkgname%-git}::git+$url.git")
30
sha256sums=('SKIP')
31
32
pkgver(){
33
cd "$srcdir/${pkgname%-git}"
34
git describe --long --tags --abbrev=7 | sed 's/^v//;s/\([^-]*-g\)/r\1/;s/-/./g'
35
}
36
37
build() {
38
cd "$srcdir/${pkgname%-git}"
39
python -m build --wheel --no-isolation
40
}
41
42
package(){
43
cd "$srcdir/${pkgname%-git}"
44
45
python -m pip install --root="$pkgdir" --prefix=/usr --no-deps --no-index --find-links=dist --ignore-installed --no-compile --root-user-action=ignore voe-dl
46
}
47
Changes since previous scan
--- PKGBUILD @ 2026-07-06 13:21+++ PKGBUILD @ 2026-08-03 00:08@@ -1,16 +1,15 @@ # Maintainer: Vincent Schult <viboschu@gmail.com> pkgname=voe-dl-git-pkgver=1.8.2.r0.gd81256f+pkgver=1.9.0.r0.g8d27ec3 pkgrel=1 pkgdesc="A Python-based downloader for videos hosted on voe.sx." arch=('any') url="https://github.com/MPZ-00/voe-dl"-license=(GPL-3.0-or-later)+license=(GPL-3.0-only) depends=( python- bash python-requests python-beautifulsoup4 yt-dlp@@ -19,12 +18,15 @@ makedepends=( git + python-build+ python-hatchling+ python-pip ) provides=("${pkgname%-git}") conflicts=("${pkgname%-git}") -source=("${pkgname%-git}::git+https://github.com/MPZ-00/voe-dl.git")+source=("${pkgname%-git}::git+$url.git") sha256sums=('SKIP') pkgver(){@@ -32,21 +34,14 @@ git describe --long --tags --abbrev=7 | sed 's/^v//;s/\([^-]*-g\)/r\1/;s/-/./g' } +build() {+ cd "$srcdir/${pkgname%-git}"+ python -m build --wheel --no-isolation+}+ package(){ cd "$srcdir/${pkgname%-git}" - install -dm755 "$pkgdir/usr/share/${pkgname%-git}"- install -dm755 "$pkgdir/usr/bin"-- install -Dm644 dl.py "$pkgdir/usr/share/${pkgname%-git}/dl.py"-- cat > "$pkgdir/usr/bin/${pkgname%-git}" << EOF-#!/bin/bash-exec python /usr/share/${pkgname%-git}/dl.py "\$@"-EOF-- chmod 755 "$pkgdir/usr/bin/${pkgname%-git}"-- install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"+ python -m pip install --root="$pkgdir" --prefix=/usr --no-deps --no-index --find-links=dist --ignore-installed --no-compile --root-user-action=ignore voe-dl } Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 2 |
| 2026-08-02 00:16:08 | LOW | 2 |
| 2026-08-01 09:20:18 | MEDIUM | 1 |
| 2026-07-06 13:21:03 | CLEAN | 0 |
| 2026-06-18 16:11:54 | CLEAN | 0 |