jcvi
LOW
maintainer imjiaoyuan
0 votes
scanned 2026-11-03 08:04:08.432872
Why flagged
The package installs dependencies into a virtual environment but uses system site-packages for official dependencies; the ambiguous pattern involves a variable-named package install via 'uv pip install', but it only installs the built wheel and its non-system dependencies, posing minimal risk.
Triggered rules
Low
AI review of an ambiguous pattern
llm_review
The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it LOW (confidence 95%): The package installs dependencies into a virtual environment but uses system site-packages for official dependencies; the ambiguous pattern involves a variable-named package install via 'uv pip install', but it only installs the built wheel and its non-system dependencies, posing minimal risk.
-
PKGBUILD:62
uv pip install --python "$pkgdir$_venv/bin/python" dist/*.whl
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: imjiaoyuan <imjiaoyuan@gmail.com>
2
3
pkgname=jcvi
4
pkgver=1.6.9
5
pkgrel=1
6
pkgdesc="Python utility libraries on genome assembly, annotation and comparative genomics"
7
arch=('x86_64')
8
url="https://github.com/tanghaibao/jcvi"
9
license=('BSD-3-Clause')
10
11
# Official-repo deps (core/extra). They land in the SYSTEM site-packages; the
12
# bundled venv is created with --system-site-packages so its python finds them
13
# there at runtime (CPython merges system site-packages into sys.path). This
14
# avoids bundling numpy/scipy/matplotlib/scikit-image and keeps the package small.
15
depends=(
16
'python' 'file'
17
'python-numpy' 'python-scipy' 'python-matplotlib' 'python-seaborn'
18
'python-scikit-image' 'python-networkx' 'python-jinja' 'python-rich'
19
'python-natsort' 'python-more-itertools' 'python-boto3' 'python-pypdf'
20
'python-pytesseract' 'python-graphviz' 'python-wand' 'python-webcolors'
21
'imagemagick' 'graphviz' 'tesseract'
22
)
23
optdepends=('bedtools: interval operations via pybedtools' 'blast+: BLAST searches')
24
25
# Build against the SYSTEM numpy so the compiled Cython extensions match the
26
# numpy ABI used at runtime (system numpy, via --system-site-packages).
27
makedepends=(
28
'uv'
29
'python-build'
30
'python-wheel'
31
'python-setuptools'
32
'python-hatchling'
33
'python-hatch-vcs'
34
'cython'
35
'python-numpy'
36
)
37
options=('!strip' '!debug' '!emptydirs')
38
source=("$pkgname-$pkgver.tar.gz::$url/archive/v$pkgver.tar.gz")
39
sha256sums=('3afdd90f2097187883a88157255f10bbcdf72dfa2d852b0377f39cbcfd5e4689')
40
41
_venv="/opt/$pkgname"
42
43
build() {
44
# Run from $srcdir (the PARENT dir), NOT inside the source tree: jcvi ships a
45
# build.py that would shadow `python -m build` via -m module lookup and then
46
# silently do nothing. Passing the source dir as an argument avoids that.
47
cd "$srcdir"
48
# hatch-vcs cannot read git tags from a release tarball, so pretend the version.
49
# --no-isolation: compile the Cython extensions against the system numpy.
50
SETUPTOOLS_SCM_PRETEND_VERSION="$pkgver" \
51
python -m build --wheel --no-isolation "$pkgname-$pkgver"
52
}
53
54
package() {
55
cd "$pkgname-$pkgver"
56
57
# venv that inherits the system site-packages (include-system-site-packages=true):
58
# at runtime its python sees the official deps (numpy/scipy/...) from the system.
59
uv venv --system-site-packages --python "$(command -v python)" "$pkgdir$_venv"
60
61
# Install jcvi + its full dependency closure into the venv.
62
uv pip install --python "$pkgdir$_venv/bin/python" dist/*.whl
63
64
# Strip every package the SYSTEM already provides (the pacman depends + their
65
# transitive deps). This guarantees the venv never shadows the system versions
66
# and keeps the package small: what stays is only the non-official packages
67
# (biopython, pysam, pybedtools, ortools, goatools, ete4, ...). This is the
68
# --no-deps idea done automatically -- the venv ends up with zero numpy etc.
69
local sys_site venv_site
70
sys_site=$(python -c "import site; print(site.getsitepackages()[0])")
71
venv_site=$(find "$pkgdir$_venv" -type d -name site-packages -print -quit)
72
local strip=() base name
73
while IFS= read -r d; do
74
base=$(basename "$d" .dist-info) # e.g. numpy-2.5.1
75
name=${base%-*} # e.g. numpy (drop version)
76
if compgen -G "$sys_site/$name-*.dist-info" >/dev/null \
77
|| compgen -G "$sys_site/${name//_/-}-*.dist-info" >/dev/null; then
78
strip+=("$name")
79
fi
80
done < <(find "$venv_site" -maxdepth 1 -name '*.dist-info' -type d)
81
if ((${#strip[@]})); then
82
uv pip uninstall --python "$pkgdir$_venv/bin/python" "${strip[@]}" >/dev/null
83
fi
84
85
# Drop the build-path metadata leak (avoids the $srcdir warning).
86
rm -f "$venv_site"/jcvi-*.dist-info/direct_url.json
87
88
# Relocate paths baked into venv scripts during build.
89
find "$pkgdir$_venv/bin" -type f -exec sed -i "s|$pkgdir||g" {} +
90
sed -i "s|$pkgdir||g" "$pkgdir$_venv/pyvenv.cfg"
91
92
# Console wrapper so `jcvi` is on PATH.
93
install -Dm755 /dev/stdin "$pkgdir/usr/bin/$pkgname" <<EOF
94
#!/bin/sh
95
exec $_venv/bin/$pkgname "\$@"
96
EOF
97
98
install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
99
}
100
Changes since previous scan
--- PKGBUILD @ 2026-10-31 15:58+++ PKGBUILD @ 2026-11-03 08:04@@ -1,7 +1,7 @@ # Maintainer: imjiaoyuan <imjiaoyuan@gmail.com> pkgname=jcvi-pkgver=1.6.8+pkgver=1.6.9 pkgrel=1 pkgdesc="Python utility libraries on genome assembly, annotation and comparative genomics" arch=('x86_64')@@ -36,7 +36,7 @@ ) options=('!strip' '!debug' '!emptydirs') source=("$pkgname-$pkgver.tar.gz::$url/archive/v$pkgver.tar.gz")-sha256sums=('25eb9bd0c52b03ddb7df96bc6db335970e91d996ea06ba3993894208cfdc1cbe')+sha256sums=('3afdd90f2097187883a88157255f10bbcdf72dfa2d852b0377f39cbcfd5e4689') _venv="/opt/$pkgname" Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-03 08:04:08 | Low | 1 |
| 2026-10-31 15:58:34 | Clean | 1 |
| 2026-09-19 03:30:07 | Clean | 1 |
| 2026-09-04 13:57:51 | Clean | 1 |
| 2026-09-04 00:03:13 | Low | 1 |
| 2026-09-03 00:15:47 | Low | 1 |
| 2026-09-02 00:02:31 | Low | 1 |
| 2026-09-01 00:11:19 | Low | 1 |
| 2026-08-31 00:19:57 | Low | 1 |
| 2026-08-30 00:04:14 | Low | 1 |
| 2026-08-29 00:29:17 | Low | 1 |
| 2026-08-28 00:07:31 | Low | 1 |
| 2026-08-27 00:08:17 | Low | 1 |
| 2026-08-26 00:12:07 | Low | 1 |
| 2026-08-25 00:14:31 | Low | 2 |
| 2026-08-24 00:17:16 | Low | 2 |
| 2026-08-23 00:10:13 | Low | 2 |
| 2026-08-22 15:17:41 | Low | 2 |
| 2026-08-22 03:16:42 | Low | 2 |
| 2026-08-22 00:02:17 | Low | 2 |