alire-git

maintainer orphaned · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The pip install is part of the project's own test suite dependencies, run in an isolated venv during check(), not installing arbitrary external code into the system.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The pip install is part of the project's own test suite dependencies, run in an isolated venv during check(), not installing arbitrary external code into the system.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:38 pip install --upgrade -r requirements.txt

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Jesus Alvarez <jeezusjr at gmail dot com>
    
      2
    
      3pkgname=alire-git
    
      4pkgver=v1.2.0.r125.g9cac98b
    
      5pkgrel=2
    
      6pkgdesc="Ada Alire (alr): A library manager for the Ada Programming Language (git top of tree version)."
    
      7arch=('i686' 'x86_64')
    
      8url="https://alire.ada.dev/"
    
      9license=(GPL3)
    
      10depends=(gnatcoll-core unzip)
    
      11makedepends=(git gprbuild python python-pip)
    
      12provides=("alire")
    
      13conflicts=("alire")
    
      14source=("${pkgname}::git+https://github.com/alire-project/alire.git")
    
      15md5sums=("SKIP")
    
      16
    
      17pkgver() {
    
      18  cd "$pkgname"
    
      19  git describe --tags --abbrev=7 --exclude=nightly | sed 's/\([^-]*-g\)/r\1/;s/-/./g'
    
      20}
    
      21
    
      22
    
      23prepare() {
    
      24  cd "$srcdir/$pkgname"
    
      25  git submodule init
    
      26  git -c protocol.file.allow=always submodule update
    
      27}
    
      28
    
      29build() {
    
      30  cd "$srcdir/$pkgname"
    
      31  ALIRE_OS=linux gprbuild -j0 -p -P alr_env -gnatws -cargs
    
      32}
    
      33
    
      34check() {
    
      35  cd "$srcdir/$pkgname/testsuite"
    
      36  python -m venv alrtest_venv
    
      37  source alrtest_venv/bin/activate
    
      38  pip install --upgrade -r requirements.txt
    
      39  PATH="$srcdir/$pkgname/bin:$PATH" GIT_CONFIG_GLOBAL=/dev/null GIT_CONFIG_SYSTEM=/dev/null ./run.py
    
      40}
    
      41
    
      42package() {
    
      43  cd "$srcdir/$pkgname"
    
      44  ALIRE_OS=linux gprinstall -P alr_env -p --prefix="$pkgdir/usr"
    
      45  install -D scripts/alr-completion.bash "$pkgdir/usr/share/bash-completion/completions/alr"
    
      46}
    
      47
    
      48# vim:set ts=2 sw=2 et:
    
      49

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2