cidrtools-cffi

LOW

maintainer GeneArch 1 votes scanned 2026-08-20 15:11:35.617252

View on AUR

Why flagged

The package builds from a git source on GitHub with a SKIP'd checksum but uses a signed tag verified by a known PGP key; the risk is low as it builds its own source and dependencies are reasonable.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from a git source on GitHub with a SKIP'd checksum but uses a signed tag verified by a known PGP key; the risk is low as it builds its own source and dependencies are reasonable.

PKGBUILD

      1# SPDX-License-Identifier: GPL-2.0-or-later
    
      2#
    
      3# Arch Linux PKGBUILD for cidrtools-cffi
    
      4# This builds the latest release tag.
    
      5#
    
      6# Maintainer: Gene C <arch@sapience.com>
    
      7# Contributor: 
    
      8# 
    
      9pkgname='cidrtools-cffi'
    
      10pkgdesc='Python CFFI bindings for the cidrtools C-library'
    
      11_gitname='cidrtools-cffi'
    
      12
    
      13pkgver="1.0.3"
    
      14pkgrel=1
    
      15url="https://github.com/gene-git/cidrtools-cffi"
    
      16
    
      17arch=(x86_64)
    
      18license=(GPL-2.0-or-later)
    
      19
    
      20depends=(
    
      21    'cidrtools'
    
      22    'glibc'
    
      23    'python>=3.14' 
    
      24    'python-cffi'
    
      25)
    
      26makedepends=(
    
      27    'bash'
    
      28    'git'
    
      29    'meson'
    
      30    'meson-python'
    
      31    'uv'
    
      32    'python-uv-build'
    
      33    'rsync'
    
      34)
    
      35checkdepends=(
    
      36    'python-pytest' 
    
      37    'python-pytest-asyncio'
    
      38)
    
      39# Used by mkpkg
    
      40_mkpkg_depends=(
    
      41    'python>minor'
    
      42    'python-cffi>minor'
    
      43)
    
      44
    
      45#
    
      46# Verifying Signed Tag
    
      47#   Add arch@sapience.com key to keyring then use the source line with "?signed"
    
      48#   Key available via keys/pgp, WKD or dowload from https://www.sapience.com/tech
    
      49#   Note that upstream release procedure requires every tagged release have new tag
    
      50#
    
      51validpgpkeys=( '7CCA1BA66669F3273DB52678E5B81343AB9809E1')   # Gene C
    
      52
    
      53#source=("git+https://github.com/gene-git/${_gitname}#tag=${pkgver}?signed")
    
      54 source=("git+https://github.com/gene-git/${_gitname}#tag=${pkgver}")
    
      55sha512sums=('SKIP')
    
      56
    
      57build() {
    
      58    cd "${_gitname}"
    
      59    ./scripts/do-build
    
      60}
    
      61
    
      62check() {
    
      63    cd "${_gitname}"
    
      64    ./scripts/run-tests
    
      65}
    
      66
    
      67package() {
    
      68    cd "${_gitname}"
    
      69    ./scripts/do-install ${pkgdir}
    
      70}
    
      71# vim:set ts=4 sts=4 sw=4 et:
    
      72

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-20 15:11:35	Low	2