phono3py
LOW
maintainer yuhldr
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The pip install in build() installs only build dependencies (numpy, scikit-build-core, etc.) into an isolated venv for building the package, not external executables or untrusted code; this is a standard Python packaging practice.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The pip install in build() installs only build dependencies (numpy, scikit-build-core, etc.) into an isolated venv for building the package, not external executables or untrusted code; this is a standard Python packaging practice.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
pip install of an external package
pip_install_external
`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.
-
PKGBUILD:42
_buildenv/bin/pip install --upgrade pip
PKGBUILD
1 offending line(s) highlighted
1
pkgname=('phono3py')
2
pkgver=4.4.0
3
pkgrel=1
4
pkgdesc="A simulation package of phonon-phonon interaction related properties"
5
arch=('any')
6
url="https://github.com/phonopy/phono3py"
7
license=('BSD')
8
depends=(
9
# "python-phonopy>=2.46.0"
10
# "python-phonopy<2.47"
11
"python-phonopy"
12
"python-scipy"
13
)
14
makedepends=(
15
python-pip
16
cmake
17
gcc
18
ninja
19
)
20
21
22
source=(
23
"git+https://github.com/phonopy/phono3py.git#tag=v${pkgver}"
24
# "lammps.patch"
25
)
26
sha256sums=(
27
'SKIP'
28
# 'SKIP'
29
)
30
31
prepare() {
32
cd "$srcdir"/phono3py
33
sed -i 's/cmake\.verbose/build.verbose/g' pyproject.toml
34
}
35
36
37
build() {
38
cd "$srcdir"/phono3py
39
rm -rf dist
40
41
python -m venv _buildenv
42
_buildenv/bin/pip install --upgrade pip
43
_buildenv/bin/pip install \
44
numpy \
45
"scikit-build-core" \
46
"nanobind<2.10.0" \
47
setuptools-scm \
48
build
49
50
_buildenv/bin/python -m build --wheel --no-isolation
51
}
52
53
54
package() {
55
cd "$srcdir"/phono3py
56
PIP_CONFIG_FILE=/dev/null pip install \
57
--isolated --root="$pkgdir" \
58
--ignore-installed --no-deps dist/*.whl
59
}
60
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |