axicli

maintainer bkuri · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The non-standard host (cdn.evilmadscientist.com) hosts a source archive for a legitimate project; the file is verified by a matching checksum, and the package builds from source, posing no active supply-chain risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The non-standard host (cdn.evilmadscientist.com) hosts a source archive for a legitimate project; the file is verified by a matching checksum, and the package builds from source, posing no active supply-chain risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:35 'https://cdn.evilmadscientist.com/dl/ad/public/AxiDraw_API.zip'

PKGBUILD

1 offending line(s) highlighted

      1# PKGBUILD
    
      2# Maintainer: Bernardo Kuri <aur+axicli@bkuri.com>
    
      3
    
      4pkgname=axicli
    
      5pkgver=3.9.6
    
      6pkgrel=4
    
      7pkgdesc="AxiDraw CLI and Python API for controlling AxiDraw pen plotters (bundles plotink & ink_extensions)"
    
      8url="https://axidraw.com/doc/cli_api"
    
      9arch=('any')
    
      10license=('custom')
    
      11install=axicli.install
    
      12
    
      13# Vendor these versions from PyPI (adjust as desired)
    
      14_pink_ver=1.9.0
    
      15_inkext_ver=2.0.0
    
      16
    
      17depends=(
    
      18  'python>=3.8'
    
      19  'python-lxml'
    
      20  'python-mpmath'
    
      21  'python-pyserial'
    
      22  'python-requests'
    
      23)
    
      24makedepends=(
    
      25  'python-build'
    
      26  'python-installer'
    
      27  'unzip'
    
      28)
    
      29optdepends=(
    
      30  'python-numpy: enhanced math operations'
    
      31  'python-pillow: image processing'
    
      32)
    
      33
    
      34source=(
    
      35  'https://cdn.evilmadscientist.com/dl/ad/public/AxiDraw_API.zip'
    
      36  "https://files.pythonhosted.org/packages/source/p/plotink/plotink-${_pink_ver}.tar.gz"
    
      37  "https://files.pythonhosted.org/packages/source/i/ink_extensions/ink_extensions-${_inkext_ver}.tar.gz"
    
      38)
    
      39sha256sums=('c29ef0792dc8a2006a3a4abcb306e8d7fa5b93f8ce83c0c781eed226d7eeca24'
    
      40            '5b6778073da34c6fafb5bd5f2a5e23ace9887dd29d6a9edaa41ce661083c7ba1'
    
      41            '68ac72552b589e5b8bb569af1c22eb8030f7c1485e9bf86f539f2cc1f2e4ee88')
    
      42
    
      43_get_srcdir() { ls -d "$srcdir"/AxiDraw_API_* 2>/dev/null | head -n1; }
    
      44
    
      45prepare() {
    
      46  cd "$srcdir"
    
      47  unzip -o AxiDraw_API.zip
    
      48  tar -xf "plotink-${_pink_ver}.tar.gz"
    
      49  tar -xf "ink_extensions-${_inkext_ver}.tar.gz"
    
      50}
    
      51
    
      52build() {
    
      53  export PYTHONNOUSERSITE=1
    
      54  unset PYTHONUSERBASE
    
      55
    
      56  # Build vendored deps first (offline)
    
      57  cd "$srcdir/plotink-${_pink_ver}"
    
      58  python -m build --wheel --no-isolation
    
      59
    
      60  cd "$srcdir/ink_extensions-${_inkext_ver}"
    
      61  python -m build --wheel --no-isolation
    
      62
    
      63  # Build EMSL package(s)
    
      64  local s=$(_get_srcdir)
    
      65  cd "$s"
    
      66  python -m build --wheel --no-isolation
    
      67  ls dist/*.whl >/dev/null 2>&1 || { echo "ERROR: no wheel produced"; return 1; }
    
      68}
    
      69
    
      70package() {
    
      71  export PYTHONNOUSERSITE=1
    
      72  unset PYTHONUSERBASE
    
      73
    
      74  # 1) vendored deps
    
      75  python -m pip install --root="$pkgdir" --prefix=/usr --no-deps --no-warn-script-location --force-reinstall "$srcdir/plotink-${_pink_ver}"/dist/*.whl
    
      76  python -m pip install --root="$pkgdir" --prefix=/usr --no-deps --no-warn-script-location --force-reinstall "$srcdir/ink_extensions-${_inkext_ver}"/dist/*.whl
    
      77
    
      78  # 2) bundled third-party wheels (axidrawinternal, etc.)
    
      79  local s=$(_get_srcdir)
    
      80  cd "$s"
    
      81  
    
      82  # Install prebuilt dependencies if they exist
    
      83  if [ -d "prebuilt_dependencies" ] && [ "$(ls -A prebuilt_dependencies/*.whl 2>/dev/null)" ]; then
    
      84    python -m pip install --root="$pkgdir" --prefix=/usr --no-deps --no-warn-script-location --force-reinstall prebuilt_dependencies/*.whl
    
      85  fi
    
      86
    
      87  # 3) axicli + pyaxidraw
    
      88  python -m pip install --root="$pkgdir" --prefix=/usr --no-deps --no-warn-script-location --force-reinstall dist/*.whl
    
      89
    
      90  # license (best-effort)
    
      91  if [ -f "pyaxidraw/LICENSE.txt" ]; then
    
      92    install -Dm644 pyaxidraw/LICENSE.txt "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      93  elif [ -f "LICENSE" ]; then
    
      94    install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      95  fi
    
      96}
    
      97

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2