jcvi

maintainer imjiaoyuan · 0 votes · scanned 2026-08-18 00:03:42.021799

LOW

Why flagged The package builds from a legitimate project source and uses standard Python tooling; the variable-named package install via uv pip is part of normal venv dependency resolution and does not introduce untrusted code; the low severity reflects few votes and recent upload, not malicious behavior.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from a legitimate project source and uses standard Python tooling; the variable-named package install via uv pip is part of normal venv dependency resolution and does not introduce untrusted code; the low severity reflects few votes and recent upload, not malicious behavior.

PKGBUILD:62 uv pip install --python "$pkgdir$_venv/bin/python" dist/*.whl

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: imjiaoyuan <imjiaoyuan@gmail.com>
    
      2
    
      3pkgname=jcvi
    
      4pkgver=1.6.6
    
      5pkgrel=1
    
      6pkgdesc="Python utility libraries on genome assembly, annotation and comparative genomics"
    
      7arch=('x86_64')
    
      8url="https://github.com/tanghaibao/jcvi"
    
      9license=('BSD-3-Clause')
    
      10
    
      11# Official-repo deps (core/extra). They land in the SYSTEM site-packages; the
    
      12# bundled venv is created with --system-site-packages so its python finds them
    
      13# there at runtime (CPython merges system site-packages into sys.path). This
    
      14# avoids bundling numpy/scipy/matplotlib/scikit-image and keeps the package small.
    
      15depends=(
    
      16    'python' 'file'
    
      17    'python-numpy' 'python-scipy' 'python-matplotlib' 'python-seaborn'
    
      18    'python-scikit-image' 'python-networkx' 'python-jinja' 'python-rich'
    
      19    'python-natsort' 'python-more-itertools' 'python-boto3' 'python-pypdf'
    
      20    'python-pytesseract' 'python-graphviz' 'python-wand' 'python-webcolors'
    
      21    'imagemagick' 'graphviz' 'tesseract'
    
      22)
    
      23optdepends=('bedtools: interval operations via pybedtools' 'blast+: BLAST searches')
    
      24
    
      25# Build against the SYSTEM numpy so the compiled Cython extensions match the
    
      26# numpy ABI used at runtime (system numpy, via --system-site-packages).
    
      27makedepends=(
    
      28    'uv'
    
      29    'python-build'
    
      30    'python-wheel'
    
      31    'python-setuptools'
    
      32    'python-hatchling'
    
      33    'python-hatch-vcs'
    
      34    'cython'
    
      35    'python-numpy'
    
      36)
    
      37options=('!strip' '!debug' '!emptydirs')
    
      38source=("$pkgname-$pkgver.tar.gz::$url/archive/v$pkgver.tar.gz")
    
      39sha256sums=('5d2c3b372c2086dde0c5cfc69b60a3a6a781d955e22de3a87d84d63e184a098e')
    
      40
    
      41_venv="/opt/$pkgname"
    
      42
    
      43build() {
    
      44    # Run from $srcdir (the PARENT dir), NOT inside the source tree: jcvi ships a
    
      45    # build.py that would shadow `python -m build` via -m module lookup and then
    
      46    # silently do nothing. Passing the source dir as an argument avoids that.
    
      47    cd "$srcdir"
    
      48    # hatch-vcs cannot read git tags from a release tarball, so pretend the version.
    
      49    # --no-isolation: compile the Cython extensions against the system numpy.
    
      50    SETUPTOOLS_SCM_PRETEND_VERSION="$pkgver" \
    
      51        python -m build --wheel --no-isolation "$pkgname-$pkgver"
    
      52}
    
      53
    
      54package() {
    
      55    cd "$pkgname-$pkgver"
    
      56
    
      57    # venv that inherits the system site-packages (include-system-site-packages=true):
    
      58    # at runtime its python sees the official deps (numpy/scipy/...) from the system.
    
      59    uv venv --system-site-packages --python "$(command -v python)" "$pkgdir$_venv"
    
      60
    
      61    # Install jcvi + its full dependency closure into the venv.
    
      62    uv pip install --python "$pkgdir$_venv/bin/python" dist/*.whl
    
      63
    
      64    # Strip every package the SYSTEM already provides (the pacman depends + their
    
      65    # transitive deps). This guarantees the venv never shadows the system versions
    
      66    # and keeps the package small: what stays is only the non-official packages
    
      67    # (biopython, pysam, pybedtools, ortools, goatools, ete4, ...). This is the
    
      68    # --no-deps idea done automatically -- the venv ends up with zero numpy etc.
    
      69    local sys_site venv_site
    
      70    sys_site=$(python -c "import site; print(site.getsitepackages()[0])")
    
      71    venv_site=$(find "$pkgdir$_venv" -type d -name site-packages -print -quit)
    
      72    local strip=() base name
    
      73    while IFS= read -r d; do
    
      74        base=$(basename "$d" .dist-info)   # e.g. numpy-2.5.1
    
      75        name=${base%-*}                    # e.g. numpy (drop version)
    
      76        if compgen -G "$sys_site/$name-*.dist-info" >/dev/null \
    
      77           || compgen -G "$sys_site/${name//_/-}-*.dist-info" >/dev/null; then
    
      78            strip+=("$name")
    
      79        fi
    
      80    done < <(find "$venv_site" -maxdepth 1 -name '*.dist-info' -type d)
    
      81    if ((${#strip[@]})); then
    
      82        uv pip uninstall --python "$pkgdir$_venv/bin/python" "${strip[@]}" >/dev/null
    
      83    fi
    
      84
    
      85    # Drop the build-path metadata leak (avoids the $srcdir warning).
    
      86    rm -f "$venv_site"/jcvi-*.dist-info/direct_url.json
    
      87
    
      88    # Relocate paths baked into venv scripts during build.
    
      89    find "$pkgdir$_venv/bin" -type f -exec sed -i "s|$pkgdir||g" {} +
    
      90    sed -i "s|$pkgdir||g" "$pkgdir$_venv/pyvenv.cfg"
    
      91
    
      92    # Console wrapper so `jcvi` is on PATH.
    
      93    install -Dm755 /dev/stdin "$pkgdir/usr/bin/$pkgname" <<EOF
    
      94#!/bin/sh
    
      95exec $_venv/bin/$pkgname "\$@"
    
      96EOF
    
      97
    
      98    install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      99}
    
      100

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	LOW	2
2026-08-17 00:18:29	LOW	2
2026-08-16 00:03:42	LOW	2
2026-08-15 15:30:38	LOW	2
2026-08-15 00:26:13	LOW	2
2026-08-14 00:03:41	LOW	2
2026-08-13 00:17:07	LOW	2
2026-08-12 01:22:13	LOW	2