jupyter-nbgitpuller
LOW
maintainer lahwaacz
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The pip install occurs in a test venv during check() for testing purposes and does not install untrusted external packages; it uses system-site-packages and reinstalls only known Jupyter components for test compatibility.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The pip install occurs in a test venv during check() for testing purposes and does not install untrusted external packages; it uses system-site-packages and reinstalls only known Jupyter components for test compatibility.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
pip install of an external package
pip_install_external
`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.
-
PKGBUILD:47
test-env/bin/pip install --no-dependencies --force-reinstall jupyter-core jupyter-server notebook
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Jakub Klinkovský <lahwaacz at archlinux dot org>
2
3
_name=nbgitpuller
4
pkgname=jupyter-$_name
5
pkgver=1.2.2
6
pkgrel=2
7
pkgdesc="Jupyter server extension to sync a git repository one-way to a local path"
8
arch=(any)
9
url="https://github.com/jupyterhub/nbgitpuller"
10
license=(BSD-3-Clause)
11
depends=(
12
git
13
jupyter-server
14
)
15
makedepends=(
16
python-build
17
python-installer
18
python-setuptools
19
python-jupyter-packaging
20
npm
21
)
22
checkdepends=(
23
python-pytest
24
python-pytest-cov
25
jupyter-notebook
26
)
27
source=("$pkgname-$pkgver.tar.gz::$url/archive/refs/tags/$pkgver.tar.gz")
28
b2sums=('f4bb8bf19ad80adf9fa8213768bd72a720e9d1f5b21281a1fbff5c7ac9c7d5e0399ff6671545d29dcdd61bf34e52b2f5fd028096d4ae703ed837d7128ccbfb77')
29
30
prepare() {
31
cd $_name-$pkgver
32
# nbgitpuller assumes notebook<7 for compatibility tests
33
# `jupyter serverextension` is a legacy command, use `jupyter server extension`
34
sed -i 's|"serverextension"|"server", "extension"|' tests/test_api.py
35
}
36
37
build() {
38
cd $_name-$pkgver
39
python -m build --wheel --no-isolation --skip-dependency-check
40
}
41
42
check() {
43
cd $_name-$pkgver
44
python -m venv --system-site-packages test-env
45
test-env/bin/python -m installer dist/*.whl
46
# NOTE: system-wide jupyter does not find nbgitpuller installed in the venv
47
test-env/bin/pip install --no-dependencies --force-reinstall jupyter-core jupyter-server notebook
48
49
# NOTE: the venv must be activated for the tests to run jupyter from the venv
50
source test-env/bin/activate
51
test-env/bin/python -m pytest -v
52
deactivate
53
}
54
55
package() {
56
cd $_name-$pkgver
57
python -m installer --destdir="$pkgdir" dist/*.whl
58
mv "$pkgdir"{/usr,}/etc
59
60
install -vDm 644 LICENSE -t "$pkgdir"/usr/share/licenses/$pkgname
61
}
62
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |