anna-git
LOW
maintainer yar
0 votes
scanned 2026-10-30 05:55:14.937539
Why flagged
The package builds from a public Git repository with no checksum verification, but it is a legitimate source for a development version; the dependencies and build process are standard for a Python CLI tool, and no malicious behavior is evident.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Low
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from a public Git repository with no checksum verification, but it is a legitimate source for a development version; the dependencies and build process are standard for a Python CLI tool, and no malicious behavior is evident.
PKGBUILD
1
pkgname=anna-git
2
gitname=annas-archive-cli
3
pkgver=0.2.0rc4
4
pkgrel=1
5
pkgdesc="anna's archive cli"
6
arch=(any)
7
url=https://github.com/meurz/$gitname
8
license=(MIT)
9
depends=(
10
python-beautifulsoup4
11
python-click
12
python-httpx
13
python-socksio
14
)
15
makedepends=(
16
git
17
python-build
18
python-hatchling
19
python-installer
20
)
21
checkdepends=(
22
python-pytest
23
)
24
source=("git+$url.git")
25
sha256sums=('SKIP')
26
27
build() {
28
cd "$srcdir/$gitname"
29
python -m build --wheel --no-isolation
30
}
31
32
check() {
33
cd "$srcdir/$gitname"
34
PYTHONPATH="$PWD/src" python -m pytest -q
35
}
36
37
package() {
38
cd "$srcdir/$gitname"
39
python -m installer --destdir="$pkgdir" dist/*.whl
40
}
41
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-30 05:55:14 | Low | 2 |