fava-portfolio-returns (CLEAN)

Triggered rules

Clean AI review downgraded a static finding llm_review

The static rules flagged this LOW, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it CLEAN (confidence 95%): The package builds from a verifiable source tarball hosted on GitHub, uses standard build tools, and installs only the project's own code and declared dependencies without executing untrusted remote scripts or binaries.

1 higher static finding superseded - not the current verdict (shown for transparency)

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

PKGBUILD

      1# Maintainer: AlphaJack <alphajack at tuta dot io>
    
      2
    
      3pkgname="fava-portfolio-returns"
    
      4pkgver=2.7.0
    
      5pkgrel=1
    
      6pkgdesc="Show portfolio returns in Fava"
    
      7arch=("any")
    
      8url="https://github.com/andreasgerstmayr/fava-portfolio-returns"
    
      9license=("GPL-2.0-only")
    
      10depends=("beancount" "fava" "python" "python-dateutil" "python-numpy" "python-pandas" "python-protobuf" "python-scipy")
    
      11makedepends=("esbuild" "npm" "python-build" "python-hatch-vcs" "python-hatchling" "python-installer" "python-wheel")
    
      12source=("$pkgname-$pkgver.tar.gz::$url/archive/refs/tags/v$pkgver.tar.gz")
    
      13sha256sums=('3b5b6c42c03cb3463296e3f33d43ca6128b642dcf4b66c4a8dcf490ff271ba2f')
    
      14
    
      15build(){
    
      16 cd "$pkgname-$pkgver/frontend"
    
      17 # install scripts are blocked by npm, bundle with the system esbuild instead
    
      18 npm ci --ignore-scripts
    
      19 esbuild src/extension.ts --bundle --format=esm --loader:.css=file --outfile=../src/fava_portfolio_returns/FavaPortfolioReturns.js --minify
    
      20 cd ..
    
      21 export SETUPTOOLS_SCM_PRETEND_VERSION="$pkgver"
    
      22 python -m build --wheel --no-isolation
    
      23}
    
      24
    
      25package(){
    
      26 cd "$pkgname-$pkgver"
    
      27 python -m installer --destdir="$pkgdir" dist/*.whl
    
      28 install -D -m 644 "COPYING" -t "$pkgdir/usr/share/licenses/$pkgname"
    
      29}
    
      30

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-02 00:26:00	Clean	2
2026-11-01 22:01:45	Low	1