openjiuwen

maintainer enihcam · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a Python wheel from PyPI for an obscure, low-vote package (openjiuwen) from a Chinese forge (gitcode.com), then uses pip inside a venv to install build tools (pip, build, installer, wheel, setuptools) from PyPI without pinned versions or checksums, creating a supply-chain risk; the package itself has very few votes and is recently uploaded, making the PyPI source unverifiable as a trusted project artifact.

Triggered rules

MEDIUM pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:102 pip install --upgrade pip
PKGBUILD:103 pip install build installer wheel setuptools

MEDIUM AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 65%): The package downloads a Python wheel from PyPI for an obscure, low-vote package (openjiuwen) from a Chinese forge (gitcode.com), then uses pip inside a venv to install build tools (pip, build, installer, wheel, setuptools) from PyPI without pinned versions or checksums, creating a supply-chain risk; the package itself has very few votes and is recently uploaded, making the PyPI source unverifiable as a trusted project artifact.

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Your Name <you@example.com>
    
      2# Co-maintainer: enihcam <enihcam@noreply.gitcode.com> (pending coordination)
    
      3
    
      4# -----------------------------------------------------------------------------
    
      5# Build/runtime notes
    
      6#
    
      7# Upstream runtime dependencies that have NO Arch package (neither [extra] nor
    
      8# AUR) and are therefore omitted from depends=/optdepends=. Users pip-install
    
      9# these manually if their workflow needs them:
    
      10#
    
      11#   python-prompt-toolkit   # required by [cli] extra; used by `openjiuwen` REPL
    
      12#   python-pyoxigraph       # RDF store backend
    
      13#   python-cacheout         # in-process cache
    
      14#   python-mermaid-py       # Mermaid diagram rendering
    
      15#   python-pulsar           # optional pulsar client
    
      16#   python-a2a-sdk          # [all-a2a] extra (a2a-sdk[http-server]==1.0.0)
    
      17#   python-uiautomator2     # [mobile-gui] extra
    
      18#   python-gaussdb          # optional GaussDB client
    
      19#   python-gitcode-api      # gitcode.com API client
    
      20#   python-portalocker      # cross-process file lock
    
      21#
    
      22# Upstream pins requires-python = "<3.14,>=3.11" but Arch's current `python`
    
      23# package is 3.14, which violates the upper bound. We therefore depend on the
    
      24# `python313` AUR package so the constraint is satisfied at runtime. The
    
      25# build/install step runs inside an ephemeral python3.13 venv because the
    
      26# `python-build`/`python-installer`/`python-wheel`/`python-setuptools`
    
      27# packages in [extra] are built for Arch's python (3.14) and are therefore
    
      28# importable only from /usr/bin/python, not /usr/bin/python3.13.
    
      29# -----------------------------------------------------------------------------
    
      30
    
      31pkgname=openjiuwen
    
      32pkgver=0.1.15.post3
    
      33pkgrel=1
    
      34pkgdesc="Agent framework SDK: agents, workflows, harness, single_agent API, and team MCP server"
    
      35arch=(any)
    
      36url="https://gitcode.com/openJiuwen/agent-core"
    
      37license=(Apache-2.0)
    
      38
    
      39depends=(
    
      40  'python313'
    
      41  # CLI extras — required for the three console scripts to actually run
    
      42  'python-click'
    
      43  'python-rich'
    
      44  # Core runtime
    
      45  'python-aiohttp'
    
      46  'python-requests'
    
      47  'python-dateutil'
    
      48  'python-filelock'
    
      49  'python-aiofiles'
    
      50  'python-sqlalchemy'
    
      51  'python-sqlmodel'
    
      52  'python-openai'
    
      53  'python-tiktoken'
    
      54  'python-fastmcp'           # AUR
    
      55  'python-mcp'
    
      56  'python-beautifulsoup4'
    
      57  'python-pdfplumber'        # AUR
    
      58  'python-openpyxl'
    
      59  'python-numpy'
    
      60  'python-pycryptodome'
    
      61  'python-charset-normalizer'
    
      62  'python-pysbd'             # AUR
    
      63  'python-oauthlib'
    
      64  'python-dotenv'
    
      65  'python-json-repair'       # AUR
    
      66  'python-tenacity'
    
      67  'python-alembic'
    
      68  'python-anyio'
    
      69  'python-loguru'
    
      70)
    
      71
    
      72makedepends=(
    
      73  'python-build'
    
      74  'python-installer'
    
      75  'python-wheel'
    
      76  'python-setuptools'
    
      77)
    
      78
    
      79optdepends=(
    
      80  'python-transformers: HuggingFace model support (pulls torch transitively)'
    
      81  'python-pymilvus: Milvus vector DB backend [AUR]'
    
      82  'python-dashscope: Aliyun DashScope LLM backend [AUR]'
    
      83  'python-chromadb: Chroma vector DB [AUR]'
    
      84  'python-redis: Redis cache/queue backend'
    
      85  'python-elasticsearch: Elasticsearch backend'
    
      86  'python-asyncpg: PostgreSQL async driver'
    
      87  'python-aiomysql: MySQL async driver'
    
      88  'python-aiosqlite: SQLite async driver'
    
      89  'python-pgvector: PostgreSQL vector type [AUR, orphan-maintained]'
    
      90  'python-aioboto3: S3 / obs backend [AUR]'
    
      91  'python-docx2txt: legacy DOCX text extraction [AUR]'
    
      92  'python-docx: DOCX parsing [AUR]'
    
      93)
    
      94
    
      95source=("https://files.pythonhosted.org/packages/41/47/4e028f70277b5cfa3e3ce6c304de9bcf34f058993104813624b6686eb640/openjiuwen-${pkgver}.tar.gz")
    
      96sha256sums=('a520d51e55a9f30eae7c55956b3dd25c20dedaf6f8f7096b232ca3ba6c7a613b')
    
      97
    
      98build() {
    
      99  cd "${srcdir}/openjiuwen-${pkgver}"
    
      100  python3.13 -m venv "${srcdir}/.venv"
    
      101  source "${srcdir}/.venv/bin/activate"
    
      102  pip install --upgrade pip
    
      103  pip install build installer wheel setuptools
    
      104  python -m build --wheel --no-isolation
    
      105}
    
      106
    
      107check() {
    
      108  cd "${srcdir}/openjiuwen-${pkgver}"
    
      109  source "${srcdir}/.venv/bin/activate"
    
      110  # Smoke test: import the package and verify entry points
    
      111  python -c "import openjiuwen; print('openjiuwen', openjiuwen.__file__)"
    
      112  python -m openjiuwen --help >/dev/null || true
    
      113}
    
      114
    
      115package() {
    
      116  cd "${srcdir}/openjiuwen-${pkgver}"
    
      117  source "${srcdir}/.venv/bin/activate"
    
      118  python -m installer --destdir="${pkgdir}" --prefix=/usr --compile-bytecode=1 dist/*.whl
    
      119  # console scripts are recorded with the build-time venv shebang; rewrite to
    
      120  # the system python313 interpreter so they work after install.
    
      121  for _bin in "${pkgdir}/usr/bin/"*; do
    
      122    [[ -f "${_bin}" && "$(head -1 "${_bin}")" =~ ^#!/.*/python ]] || continue
    
      123    sed -i '1c#!/usr/bin/python3.13' "${_bin}"
    
      124  done
    
      125  install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      126}

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	3
2026-07-26 00:07:32	MEDIUM	3
2026-07-25 00:13:44	MEDIUM	3
2026-07-24 00:02:28	MEDIUM	3
2026-07-23 00:14:47	MEDIUM	3
2026-07-22 00:29:32	MEDIUM	3
2026-07-21 00:24:15	MEDIUM	3
2026-07-20 00:19:49	MEDIUM	3
2026-07-19 00:17:08	MEDIUM	3
2026-07-18 00:14:48	MEDIUM	3
2026-07-17 00:06:16	MEDIUM	3
2026-07-16 00:05:41	MEDIUM	3
2026-07-15 03:47:03	MEDIUM	3