whoogle-git

LOW

maintainer dr460nf1r3 4 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The pip install is from the project's own requirements.txt within the git source, which is normal for Python packages and not an external untrusted package.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The pip install is from the project's own requirements.txt within the git source, which is normal for Python packages and not an external untrusted package.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:39 pip install -r requirements.txt

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: dr460nf1r3 <dr460nf1r3@garudalinux.org>
    
      2
    
      3pkgname=whoogle-git
    
      4pkgver=0.8.4.r6.g7313edf
    
      5pkgrel=2
    
      6pkgdesc='A self-hosted, ad-free, privacy-respecting metasearch engine'
    
      7arch=(x86_64 aarch64)
    
      8url="https://github.com/benbusby/whoogle-search"
    
      9license=(MIT)
    
      10depends=(python)
    
      11makedepends=(git)
    
      12provides=(whoogle)
    
      13conflicts=(whoogle)
    
      14backup=('etc/default/whoogle')
    
      15source=("git+$url.git"
    
      16  whoogle.service
    
      17  whoogle.conf
    
      18  whoogle)
    
      19sha256sums=('SKIP'
    
      20  'ab6256f3fdaac3ba58ddbb39bb5c24bde53312f0584ae4ed4ae74bc7752a07f4'
    
      21  '51cda92f3ad2166eb2cb63ff80561f48b39688a57b66291d2eee5e1c7fcd8ee3'
    
      22  'e30ff5ecef199ce2a37b097709461c51ca07bdbbcc4609db74203834b62c60b1')
    
      23install=whoogle.install
    
      24
    
      25pkgver() {
    
      26  cd whoogle-search
    
      27  git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g' | sed 's/v//g'
    
      28}
    
      29
    
      30build() {
    
      31  # Following official instructions
    
      32  cd whoogle-search
    
      33  python3 -m venv venv
    
      34  source venv/bin/activate
    
      35
    
      36  # Workaround Python 3.13 breakage
    
      37  sed -i 's/^cssutils==2\.6\.0$/cssutils==2\.7\.0/' requirements.txt
    
      38
    
      39  pip install -r requirements.txt
    
      40
    
      41  # Cleanup unsed
    
      42  rm -r .git .github docs test .dockerignore .gitignore .replit docker-compose.yml Dockerfile heroku.yml MANIFEST.in README.md requirements.txt
    
      43}
    
      44
    
      45package() {
    
      46  install -m0644 -D "$srcdir/whoogle" "$pkgdir/etc/default/whoogle"
    
      47  install -m0644 -D "$srcdir/whoogle.conf" "$pkgdir/usr/lib/sysusers.d/whoogle.conf"
    
      48  install -m0644 -D "$srcdir/whoogle.service" "$pkgdir/usr/lib/systemd/system/whoogle.service"
    
      49  install -Dm0644 "$srcdir/whoogle-search/LICENSE" "$pkgdir/usr/share/licenses/whoogle-search/LICENSE"
    
      50  install -dm0755 "$pkgdir/opt/whoogle-search"
    
      51  cp -r "$srcdir/whoogle-search/" "$pkgdir/opt/"
    
      52}
    
      53

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 17:40:20	Medium	1