yamtrack

LOW

maintainer potatoattack 2 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The pip installs are for pinned runtime dependencies from uv.lock and a specific whitenoise version, both part of building the project from its own source; the dependencies are not from untrusted external sources and are standard for Python packaging.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The pip installs are for pinned runtime dependencies from uv.lock and a specific whitenoise version, both part of building the project from its own source; the dependencies are not from untrusted external sources and are standard for Python packaging.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:55 venv/bin/python -m pip install --upgrade pip setuptools wheel
PKGBUILD:61 venv/bin/pip install --no-cache-dir -r requirements.txt
PKGBUILD:64 venv/bin/pip install --no-cache-dir "whitenoise==6.11.0"

PKGBUILD

3 offending line(s) highlighted

      1# Maintainer: Aaron Coach <aur@awc.id.au>
    
      2
    
      3pkgname=yamtrack
    
      4pkgver=0.26.3
    
      5pkgrel=1
    
      6pkgdesc="Self-hosted media tracker"
    
      7arch=('any')
    
      8url="https://github.com/FuzzyGrim/Yamtrack"
    
      9license=('AGPL3')
    
      10depends=('python' 'valkey')
    
      11makedepends=('python-pip' 'uv')
    
      12backup=('etc/yamtrack/yamtrack.env')
    
      13install="${pkgname}.install"
    
      14provides=("yamtrack=${pkgver}")
    
      15conflicts=("yamtrack-git")
    
      16optdepends=("nginx: reverse proxy" "caddy: reverse proxy" "traefik: reverse proxy")
    
      17
    
      18source=(
    
      19  "${pkgname}-${pkgver}.tar.gz::https://github.com/FuzzyGrim/Yamtrack/archive/refs/tags/v${pkgver}.tar.gz"
    
      20  "0001-arch-state-dir-and-whitenoise.patch"
    
      21  "yamtrack.sysusers"
    
      22  "yamtrack.env"
    
      23  "yamtrack.version.env"
    
      24  "yamtrack.target"
    
      25  "yamtrack-init.service"
    
      26  "yamtrack-web.service"
    
      27  "yamtrack-celery.service"
    
      28  "yamtrack-celery-beat.service"
    
      29  "yamtrack-manage"
    
      30)
    
      31
    
      32sha256sums=('ad567e3c61adcb00cc29e131dfe1c28cb7abe29a2d9b359a21e595e0a38f51d9'
    
      33            '46c31cdc79e0623f2e94b251a96e0d8c6b3a9cec6e8a29a685a553d57a5bbb15'
    
      34            'b802edf0f341b2ec008eedb79b1f4b4c7cec4b89428765a20fa6dd5db30e3a48'
    
      35            '1caecf3ac52fd3c0a9c2ada54d4130aba03ff454185c6b10f04f4cf514c4a3b7'
    
      36            'cf0f5da164ef6effe5f68db54ac6a2511dd48856106d34d5235ab04a13081ae3'
    
      37            '7ad310f36c7d57f76ca3a372221965542c6d42e8746c4aba49716485d5c35f64'
    
      38            '1125e574124897c9c6bf982a5b27202d061efd9b3cac3629dded6c94c57234c3'
    
      39            '04492abfefd01255f04a69283c0b7fc0aeb74acf9da6800fa03911b40993a279'
    
      40            'a2f327de85fb056a32a7127e55433ca3c2a589c4692d288b73250bf3ea940845'
    
      41            '35b59935a9d64f221a4f09691b31edb4a1167d2ea6c2e1b419730ef64c48f57e'
    
      42            '5d7a844bee1a56c367d115c905b2668283c513029a3894ac761e39de7ba2b24d')
    
      43
    
      44prepare() {
    
      45  cd "Yamtrack-${pkgver}"
    
      46
    
      47  # Patch to support YAMTRACK_DATA_DIR for writable state and whitenoise for static files.
    
      48  patch -p1 -i ../0001-arch-state-dir-and-whitenoise.patch
    
      49}
    
      50
    
      51build() {
    
      52  cd "Yamtrack-${pkgver}"
    
      53
    
      54  python -m venv venv
    
      55  venv/bin/python -m pip install --upgrade pip setuptools wheel
    
      56
    
      57  # Generate requirements.txt from uv.lock to keep dependencies pinned perfectly
    
      58  uv export --frozen --no-dev --format requirements-txt -o requirements.txt
    
      59
    
      60  # Install pinned runtime deps into the venv.
    
      61  venv/bin/pip install --no-cache-dir -r requirements.txt
    
      62
    
      63  # Add whitenoise for serving static files.
    
      64  venv/bin/pip install --no-cache-dir "whitenoise==6.11.0"
    
      65}
    
      66
    
      67package() {
    
      68  cd "Yamtrack-${pkgver}"
    
      69
    
      70  install -d "${pkgdir}/usr/share/yamtrack"
    
      71  cp -a src "${pkgdir}/usr/share/yamtrack/src"
    
      72
    
      73  install -d "${pkgdir}/usr/lib/yamtrack"
    
      74  cp -a venv "${pkgdir}/usr/lib/yamtrack/venv"
    
      75
    
      76  # Remove the Unicode "Pi-thon" alias which causes a bsdtar error
    
      77  rm -f "${pkgdir}/usr/lib/yamtrack/venv/bin/𝜋thon"
    
      78
    
      79  install -d "${pkgdir}/usr/lib/sysusers.d"
    
      80  install -m 0644 "${srcdir}/yamtrack.sysusers" "${pkgdir}/usr/lib/sysusers.d/yamtrack.conf"
    
      81
    
      82  install -d "${pkgdir}/etc/yamtrack"
    
      83  install -m 0644 "${srcdir}/yamtrack.env" "${pkgdir}/etc/yamtrack/yamtrack.env"
    
      84
    
      85  sed "s|@PKGVER@|${pkgver}-${pkgrel}|" \
    
      86    "${srcdir}/yamtrack.version.env" >"${srcdir}/yamtrack.version.env.built"
    
      87
    
      88  install -Dm0644 "${srcdir}/yamtrack.version.env.built" \
    
      89    "${pkgdir}/usr/lib/yamtrack/version.env"
    
      90
    
      91  install -d "${pkgdir}/usr/lib/systemd/system"
    
      92  install -m 0644 "${srcdir}/yamtrack.target" "${pkgdir}/usr/lib/systemd/system/yamtrack.target"
    
      93  install -m 0644 "${srcdir}/yamtrack-init.service" "${pkgdir}/usr/lib/systemd/system/yamtrack-init.service"
    
      94  install -m 0644 "${srcdir}/yamtrack-web.service" "${pkgdir}/usr/lib/systemd/system/yamtrack-web.service"
    
      95  install -m 0644 "${srcdir}/yamtrack-celery.service" "${pkgdir}/usr/lib/systemd/system/yamtrack-celery.service"
    
      96  install -m 0644 "${srcdir}/yamtrack-celery-beat.service" "${pkgdir}/usr/lib/systemd/system/yamtrack-celery-beat.service"
    
      97
    
      98  install -Dm0755 "${srcdir}/yamtrack-manage" "${pkgdir}/usr/bin/yamtrack-manage"
    
      99
    
      100  install -Dm 0644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      101}
    
      102

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2