gdrivectl

maintainer TheDarkArtist · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The pip install in package() is for a direct, declared dependency (questionary) needed by the project, not an obfuscated or suspicious external package, and is standard in AUR Python packaging when dependencies aren't available as Arch packages.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The pip install in package() is for a direct, declared dependency (questionary) needed by the project, not an obfuscated or suspicious external package, and is standard in AUR Python packaging when dependencies aren't available as Arch packages.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:24 pip install --root="${pkgdir}" --no-deps --ignore-installed questionary

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Kushagra Sharma <tda@thedarkartist.in>
    
      2pkgname=gdrivectl
    
      3pkgver=0.1.0
    
      4pkgrel=1
    
      5pkgdesc="CLI tool to manage Google Docs permissions in bulk — grant, revoke, audit"
    
      6arch=('any')
    
      7url="https://github.com/TheDarkArtist/gdrivectl"
    
      8license=('MIT')
    
      9depends=('python' 'python-google-api-python-client' 'python-google-auth'
    
      10         'python-google-auth-oauthlib' 'python-click' 'python-rich'
    
      11         'python-prompt_toolkit')
    
      12makedepends=('python-build' 'python-installer' 'python-hatchling' 'python-pip')
    
      13source=("https://pypi.org/packages/source/g/gdrivectl/gdrivectl-${pkgver}.tar.gz")
    
      14sha256sums=('8f0e3694ddeccd694dda9a5cd450b0446c5acd2b6a029f20569fba10f846a894')
    
      15
    
      16build() {
    
      17    cd "${srcdir}/${pkgname}-${pkgver}"
    
      18    python -m build --wheel --no-isolation
    
      19}
    
      20
    
      21package() {
    
      22    cd "${srcdir}/${pkgname}-${pkgver}"
    
      23    python -m installer --destdir="${pkgdir}" dist/*.whl
    
      24    pip install --root="${pkgdir}" --no-deps --ignore-installed questionary
    
      25    install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      26}
    
      27

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2