jupyter-nbgitpuller
maintainer lahwaacz
· 0 votes
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The pip install occurs in a test venv during check() for testing purposes and does not install untrusted external packages; it uses system-site-packages and reinstalls only known Jupyter components for test compatibility.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The pip install occurs in a test venv during check() for testing purposes and does not install untrusted external packages; it uses system-site-packages and reinstalls only known Jupyter components for test compatibility.
1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM
pip install of an external package
pip_install_external
`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.
-
PKGBUILD:47
test-env/bin/pip install --no-dependencies --force-reinstall jupyter-core jupyter-server notebook
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Jakub Klinkovský <lahwaacz at archlinux dot org>
2
3
_name=nbgitpuller
4
pkgname=jupyter-$_name
5
pkgver=1.2.2
6
pkgrel=2
7
pkgdesc="Jupyter server extension to sync a git repository one-way to a local path"
8
arch=(any)
9
url="https://github.com/jupyterhub/nbgitpuller"
10
license=(BSD-3-Clause)
11
depends=(
12
git
13
jupyter-server
14
)
15
makedepends=(
16
python-build
17
python-installer
18
python-setuptools
19
python-jupyter-packaging
20
npm
21
)
22
checkdepends=(
23
python-pytest
24
python-pytest-cov
25
jupyter-notebook
26
)
27
source=("$pkgname-$pkgver.tar.gz::$url/archive/refs/tags/$pkgver.tar.gz")
28
b2sums=('f4bb8bf19ad80adf9fa8213768bd72a720e9d1f5b21281a1fbff5c7ac9c7d5e0399ff6671545d29dcdd61bf34e52b2f5fd028096d4ae703ed837d7128ccbfb77')
29
30
prepare() {
31
cd $_name-$pkgver
32
# nbgitpuller assumes notebook<7 for compatibility tests
33
# `jupyter serverextension` is a legacy command, use `jupyter server extension`
34
sed -i 's|"serverextension"|"server", "extension"|' tests/test_api.py
35
}
36
37
build() {
38
cd $_name-$pkgver
39
python -m build --wheel --no-isolation --skip-dependency-check
40
}
41
42
check() {
43
cd $_name-$pkgver
44
python -m venv --system-site-packages test-env
45
test-env/bin/python -m installer dist/*.whl
46
# NOTE: system-wide jupyter does not find nbgitpuller installed in the venv
47
test-env/bin/pip install --no-dependencies --force-reinstall jupyter-core jupyter-server notebook
48
49
# NOTE: the venv must be activated for the tests to run jupyter from the venv
50
source test-env/bin/activate
51
test-env/bin/python -m pytest -v
52
deactivate
53
}
54
55
package() {
56
cd $_name-$pkgver
57
python -m installer --destdir="$pkgdir" dist/*.whl
58
mv "$pkgdir"{/usr,}/etc
59
60
install -vDm 644 LICENSE -t "$pkgdir"/usr/share/licenses/$pkgname
61
}
62
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 2 |
| 2026-08-02 00:16:08 | LOW | 2 |
| 2026-08-01 00:11:18 | LOW | 2 |
| 2026-07-31 00:14:10 | LOW | 2 |
| 2026-07-30 00:17:23 | LOW | 2 |
| 2026-07-29 00:25:53 | LOW | 2 |
| 2026-07-28 00:07:28 | LOW | 2 |
| 2026-07-27 00:24:32 | LOW | 2 |
| 2026-07-26 00:07:32 | LOW | 2 |
| 2026-07-25 00:13:44 | LOW | 2 |
| 2026-07-24 00:02:28 | LOW | 2 |
| 2026-07-23 00:14:47 | LOW | 2 |
| 2026-07-22 00:29:32 | LOW | 2 |
| 2026-07-21 00:24:15 | LOW | 2 |
| 2026-07-20 00:19:49 | LOW | 2 |
| 2026-07-19 00:17:08 | LOW | 2 |
| 2026-07-18 00:14:48 | LOW | 2 |
| 2026-07-17 00:06:16 | LOW | 2 |
| 2026-07-16 00:05:41 | LOW | 2 |
| 2026-07-15 00:09:25 | LOW | 2 |