jupyter-nbgitpuller
LOW
maintainer lahwaacz
0 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The pip install occurs in a test venv during check() for testing purposes and does not install untrusted external packages; it uses system-site-packages and reinstalls only known Jupyter components for test compatibility.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The pip install occurs in a test venv during check() for testing purposes and does not install untrusted external packages; it uses system-site-packages and reinstalls only known Jupyter components for test compatibility.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
pip install of an external package
pip_install_external
`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.
-
PKGBUILD:47
test-env/bin/pip install --no-dependencies --force-reinstall jupyter-core jupyter-server notebook
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Jakub Klinkovský <lahwaacz at archlinux dot org>
2
3
_name=nbgitpuller
4
pkgname=jupyter-$_name
5
pkgver=1.2.2
6
pkgrel=2
7
pkgdesc="Jupyter server extension to sync a git repository one-way to a local path"
8
arch=(any)
9
url="https://github.com/jupyterhub/nbgitpuller"
10
license=(BSD-3-Clause)
11
depends=(
12
git
13
jupyter-server
14
)
15
makedepends=(
16
python-build
17
python-installer
18
python-setuptools
19
python-jupyter-packaging
20
npm
21
)
22
checkdepends=(
23
python-pytest
24
python-pytest-cov
25
jupyter-notebook
26
)
27
source=("$pkgname-$pkgver.tar.gz::$url/archive/refs/tags/$pkgver.tar.gz")
28
b2sums=('f4bb8bf19ad80adf9fa8213768bd72a720e9d1f5b21281a1fbff5c7ac9c7d5e0399ff6671545d29dcdd61bf34e52b2f5fd028096d4ae703ed837d7128ccbfb77')
29
30
prepare() {
31
cd $_name-$pkgver
32
# nbgitpuller assumes notebook<7 for compatibility tests
33
# `jupyter serverextension` is a legacy command, use `jupyter server extension`
34
sed -i 's|"serverextension"|"server", "extension"|' tests/test_api.py
35
}
36
37
build() {
38
cd $_name-$pkgver
39
python -m build --wheel --no-isolation --skip-dependency-check
40
}
41
42
check() {
43
cd $_name-$pkgver
44
python -m venv --system-site-packages test-env
45
test-env/bin/python -m installer dist/*.whl
46
# NOTE: system-wide jupyter does not find nbgitpuller installed in the venv
47
test-env/bin/pip install --no-dependencies --force-reinstall jupyter-core jupyter-server notebook
48
49
# NOTE: the venv must be activated for the tests to run jupyter from the venv
50
source test-env/bin/activate
51
test-env/bin/python -m pytest -v
52
deactivate
53
}
54
55
package() {
56
cd $_name-$pkgver
57
python -m installer --destdir="$pkgdir" dist/*.whl
58
mv "$pkgdir"{/usr,}/etc
59
60
install -vDm 644 LICENSE -t "$pkgdir"/usr/share/licenses/$pkgname
61
}
62
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 00:13:55 | Low | 2 |
| 2026-10-28 00:06:54 | Low | 2 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |
| 2026-10-14 00:06:47 | Low | 2 |
| 2026-10-13 00:23:45 | Low | 2 |