yamtrack

maintainer potatoattack · 2 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The pip install commands are used to install pinned dependencies from a locally generated requirements.txt and a specific whitenoise version, both within a project-owned build environment; this is standard for Python packages and not inherently dangerous.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The pip install commands are used to install pinned dependencies from a locally generated requirements.txt and a specific whitenoise version, both within a project-owned build environment; this is standard for Python packages and not inherently dangerous.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:55 venv/bin/python -m pip install --upgrade pip setuptools wheel
PKGBUILD:61 venv/bin/pip install --no-cache-dir -r requirements.txt
PKGBUILD:64 venv/bin/pip install --no-cache-dir "whitenoise==6.11.0"

PKGBUILD

3 offending line(s) highlighted

      1# Maintainer: Aaron Coach <aur@awc.id.au>
    
      2
    
      3pkgname=yamtrack
    
      4pkgver=0.25.3
    
      5pkgrel=1
    
      6pkgdesc="Self-hosted media tracker"
    
      7arch=('any')
    
      8url="https://github.com/FuzzyGrim/Yamtrack"
    
      9license=('AGPL3')
    
      10depends=('python' 'valkey')
    
      11makedepends=('python-pip' 'uv')
    
      12backup=('etc/yamtrack/yamtrack.env')
    
      13install="${pkgname}.install"
    
      14provides=("yamtrack=${pkgver}")
    
      15conflicts=("yamtrack-git")
    
      16optdepends=("nginx: reverse proxy" "caddy: reverse proxy" "traefik: reverse proxy")
    
      17
    
      18source=(
    
      19  "${pkgname}-${pkgver}.tar.gz::https://github.com/FuzzyGrim/Yamtrack/archive/refs/tags/v${pkgver}.tar.gz"
    
      20  "0001-arch-state-dir-and-whitenoise.patch"
    
      21  "yamtrack.sysusers"
    
      22  "yamtrack.env"
    
      23  "yamtrack.version.env"
    
      24  "yamtrack.target"
    
      25  "yamtrack-init.service"
    
      26  "yamtrack-web.service"
    
      27  "yamtrack-celery.service"
    
      28  "yamtrack-celery-beat.service"
    
      29  "yamtrack-manage"
    
      30)
    
      31
    
      32sha256sums=('da50edba56cef0531f9387ec0d29bd99f1fd1a7f2adcd4423f46500771535488'
    
      33            '491b49f33107a36727db4fd181b5f1da1d43a564737a3656d90d3acc22816a36'
    
      34            'b802edf0f341b2ec008eedb79b1f4b4c7cec4b89428765a20fa6dd5db30e3a48'
    
      35            '1caecf3ac52fd3c0a9c2ada54d4130aba03ff454185c6b10f04f4cf514c4a3b7'
    
      36            'cf0f5da164ef6effe5f68db54ac6a2511dd48856106d34d5235ab04a13081ae3'
    
      37            '7ad310f36c7d57f76ca3a372221965542c6d42e8746c4aba49716485d5c35f64'
    
      38            '1125e574124897c9c6bf982a5b27202d061efd9b3cac3629dded6c94c57234c3'
    
      39            '04492abfefd01255f04a69283c0b7fc0aeb74acf9da6800fa03911b40993a279'
    
      40            'a2f327de85fb056a32a7127e55433ca3c2a589c4692d288b73250bf3ea940845'
    
      41            '35b59935a9d64f221a4f09691b31edb4a1167d2ea6c2e1b419730ef64c48f57e'
    
      42            '5d7a844bee1a56c367d115c905b2668283c513029a3894ac761e39de7ba2b24d')
    
      43
    
      44prepare() {
    
      45  cd "Yamtrack-${pkgver}"
    
      46
    
      47  # Patch to support YAMTRACK_DATA_DIR for writable state and whitenoise for static files.
    
      48  patch -p1 -i ../0001-arch-state-dir-and-whitenoise.patch
    
      49}
    
      50
    
      51build() {
    
      52  cd "Yamtrack-${pkgver}"
    
      53
    
      54  python -m venv venv
    
      55  venv/bin/python -m pip install --upgrade pip setuptools wheel
    
      56
    
      57  # Generate requirements.txt from uv.lock to keep dependencies pinned perfectly
    
      58  uv export --frozen --no-dev --format requirements-txt -o requirements.txt
    
      59
    
      60  # Install pinned runtime deps into the venv.
    
      61  venv/bin/pip install --no-cache-dir -r requirements.txt
    
      62
    
      63  # Add whitenoise for serving static files.
    
      64  venv/bin/pip install --no-cache-dir "whitenoise==6.11.0"
    
      65}
    
      66
    
      67package() {
    
      68  cd "Yamtrack-${pkgver}"
    
      69
    
      70  install -d "${pkgdir}/usr/share/yamtrack"
    
      71  cp -a src "${pkgdir}/usr/share/yamtrack/src"
    
      72
    
      73  install -d "${pkgdir}/usr/lib/yamtrack"
    
      74  cp -a venv "${pkgdir}/usr/lib/yamtrack/venv"
    
      75
    
      76  # Remove the Unicode "Pi-thon" alias which causes a bsdtar error
    
      77  rm -f "${pkgdir}/usr/lib/yamtrack/venv/bin/𝜋thon"
    
      78
    
      79  install -d "${pkgdir}/usr/lib/sysusers.d"
    
      80  install -m 0644 "${srcdir}/yamtrack.sysusers" "${pkgdir}/usr/lib/sysusers.d/yamtrack.conf"
    
      81
    
      82  install -d "${pkgdir}/etc/yamtrack"
    
      83  install -m 0644 "${srcdir}/yamtrack.env" "${pkgdir}/etc/yamtrack/yamtrack.env"
    
      84
    
      85  sed "s|@PKGVER@|${pkgver}-${pkgrel}|" \
    
      86    "${srcdir}/yamtrack.version.env" >"${srcdir}/yamtrack.version.env.built"
    
      87
    
      88  install -Dm0644 "${srcdir}/yamtrack.version.env.built" \
    
      89    "${pkgdir}/usr/lib/yamtrack/version.env"
    
      90
    
      91  install -d "${pkgdir}/usr/lib/systemd/system"
    
      92  install -m 0644 "${srcdir}/yamtrack.target" "${pkgdir}/usr/lib/systemd/system/yamtrack.target"
    
      93  install -m 0644 "${srcdir}/yamtrack-init.service" "${pkgdir}/usr/lib/systemd/system/yamtrack-init.service"
    
      94  install -m 0644 "${srcdir}/yamtrack-web.service" "${pkgdir}/usr/lib/systemd/system/yamtrack-web.service"
    
      95  install -m 0644 "${srcdir}/yamtrack-celery.service" "${pkgdir}/usr/lib/systemd/system/yamtrack-celery.service"
    
      96  install -m 0644 "${srcdir}/yamtrack-celery-beat.service" "${pkgdir}/usr/lib/systemd/system/yamtrack-celery-beat.service"
    
      97
    
      98  install -Dm0755 "${srcdir}/yamtrack-manage" "${pkgdir}/usr/bin/yamtrack-manage"
    
      99
    
      100  install -Dm 0644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      101}
    
      102

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2