python-a2a-sdk-telemetry

MEDIUM
maintainer medaminezghal 1 votes base python-a2a-sdk scanned 2026-11-01 14:00:44.307000
View on AUR
Why flagged
This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.
Triggered rules

Medium Recently orphaned & re-adopted orphaned_readopted
This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.
PKGBUILD

      1# Maintainer: enihcam <enihcam@noreply.gitcode.com>
    
      2# Contributor: Google LLC <googleapis-packages@google.com>
    
      3
    
      4pkgbase=python-a2a-sdk
    
      5pkgname=(
    
      6  python-a2a-sdk
    
      7  python-a2a-sdk-fastapi
    
      8  python-a2a-sdk-grpc
    
      9  python-a2a-sdk-telemetry
    
      10  python-a2a-sdk-signing
    
      11  python-a2a-sdk-postgresql
    
      12  python-a2a-sdk-mysql
    
      13  python-a2a-sdk-sqlite
    
      14  python-a2a-sdk-db-cli
    
      15)
    
      16pkgver=1.1.0
    
      17pkgrel=3
    
      18arch=('any')
    
      19url='https://github.com/a2aproject/a2a-python'
    
      20license=('Apache-2.0')
    
      21
    
      22# Runtime dependencies for the core package. Also inherited by every
    
      23# split-package because they all depend on python-a2a-sdk.
    
      24#
    
      25# Notes on removed candidates:
    
      26#   - culsans: upstream gates it to `python_full_version < '3.13'`; Arch
    
      27#     ships python 3.14 (cachyos-v3) or 3.13 (extra), so on the supported
    
      28#     Arch python versions a2a falls back to the stdlib queue and
    
      29#     culsans is never imported. No Arch package exists.
    
      30_common_deps=(
    
      31  'python'
    
      32  'python-httpx'
    
      33  'python-httpx-sse'
    
      34  'python-pydantic'
    
      35  'python-protobuf'
    
      36  'python-google-api-core'
    
      37  'python-googleapis-common-protos'
    
      38  'python-json-rpc'
    
      39  'python-packaging'
    
      40  # The a2a-db console script imports alembic; ship it with core so the
    
      41  # binary works out-of-the-box. Tiny dep.
    
      42  'python-alembic'
    
      43)
    
      44
    
      45makedepends=(
    
      46  'git'                         # uv-dynamic-versioning probes git tags
    
      47  'python-build'
    
      48  'python-installer'
    
      49  'python-wheel'
    
      50  'python-hatchling'
    
      51  'python-uv-dynamic-versioning'
    
      52)
    
      53
    
      54# Extra runtime deps that check() needs to import a2a. These are NOT
    
      55# build-time; makepkg installs them into the host before running check().
    
      56# All eight are already in _common_deps — duplicating only the ones the
    
      57# check actually exercises.
    
      58checkdepends=(
    
      59  'python-httpx'
    
      60  'python-httpx-sse'
    
      61  'python-pydantic'
    
      62  'python-protobuf'
    
      63  'python-google-api-core'
    
      64  'python-googleapis-common-protos'
    
      65  'python-json-rpc'
    
      66  'python-packaging'
    
      67)
    
      68
    
      69source=(
    
      70  "https://files.pythonhosted.org/packages/c7/7e/8ac10bbf8b15b16574355f39b17dbdf617a282c27b41c7ff2116e30336df/a2a_sdk-${pkgver}.tar.gz"
    
      71)
    
      72sha256sums=('e8102dad1b36709dbdc3d19319e38e6dfa3b3a79c30416030eb2d482576be204')
    
      73
    
      74# Core package (first entry in pkgname=)
    
      75pkgdesc='Python SDK for the Agent2Agent (A2A) Protocol v1.0'
    
      76depends=("${_common_deps[@]}")
    
      77optdepends=(
    
      78  'python-cryptography: Fernet-encrypted push notification config storage'
    
      79  'python-a2a-sdk-fastapi: FastAPI integration (HTTP+JSON server)'
    
      80  'python-a2a-sdk-grpc: gRPC transport'
    
      81  'python-a2a-sdk-telemetry: OpenTelemetry instrumentation'
    
      82  'python-a2a-sdk-signing: JWT-based request signing'
    
      83  'python-a2a-sdk-postgresql: PostgreSQL task store'
    
      84  'python-a2a-sdk-mysql: MySQL task store'
    
      85  'python-a2a-sdk-sqlite: SQLite task store'
    
      86  'python-a2a-sdk-db-cli: a2a-db console script (requires alembic, shipped)'
    
      87)
    
      88
    
      89prepare() {
    
      90  cd "$srcdir/a2a_sdk-$pkgver"
    
      91  # The sdist tarball has no .git/ history. uv-dynamic-versioning reads git
    
      92  # tags by default; bypass with the static pkgver we already know.
    
      93  export UV_DYNAMIC_VERSIONING_BYPASS="$pkgver"
    
      94}
    
      95
    
      96build() {
    
      97  cd "$srcdir/a2a_sdk-$pkgver"
    
      98  python -m build --wheel --no-isolation
    
      99}
    
      100
    
      101check() {
    
      102  cd "$srcdir/a2a_sdk-$pkgver"
    
      103
    
      104  # 1. build() must have produced the wheel.
    
      105  test -f dist/*.whl || { echo 'no wheel at dist/'; return 1; }
    
      106
    
      107  # 2. Extract the wheel into a throwaway prefix and validate that the
    
      108  #    a2a core imports + the a2a-db console-script entry point are both
    
      109  #    present. checkdepends gave us the runtime deps at /usr; setting
    
      110  #    PYTHONPATH lets us pull a2a/ off the extracted tree without
    
      111  #    touching $HOME/.local or /usr.
    
      112  local _tmp
    
      113  _tmp=$(mktemp -d)
    
      114  python -m zipfile -e dist/*.whl "$_tmp"
    
      115
    
      116  local _wheel
    
      117  _wheel=$(printf '%s' dist/*.whl)
    
      118  PYTHONPATH="$_tmp" _CHECK_WHEEL="$_wheel" python <<'PY'
    
      119import os, sys, zipfile
    
      120import a2a, a2a.types, a2a.server, a2a.client, a2a.utils
    
      121print(f'a2a importable: {a2a.__file__}')
    
      122
    
      123# Confirm a2a-db is declared as a console-script entry point by inspecting
    
      124# the wheel's entry_points.txt directly (no install needed).
    
      125wheel = os.environ['_CHECK_WHEEL']
    
      126expected = 'a2a-db = a2a.a2a_db_cli:run_migrations'
    
      127with zipfile.ZipFile(wheel) as z:
    
      128    hits = [n for n in z.namelist() if n.endswith('entry_points.txt')]
    
      129    assert hits, 'wheel has no entry_points.txt'
    
      130    body = z.read(hits[0]).decode()
    
      131    assert expected in body, f'expected {expected!r} in entry_points.txt, got:\n{body}'
    
      132print(f'a2a-db entry point registered: {expected}')
    
      133PY
    
      134  local _rc=$?
    
      135  rm -rf "$_tmp"
    
      136  return "$_rc"
    
      137}
    
      138
    
      139package_python-a2a-sdk() {
    
      140  cd "$srcdir/a2a_sdk-$pkgver"
    
      141  # pyproject-installer needs both --destdir AND --prefix=/usr; without --prefix
    
      142  # the sysconfig-derived scheme points at the build-time python prefix (the
    
      143  # venv), not at /usr. Together they yield /usr/lib/pythonX.Y/site-packages/...
    
      144  # and /usr/bin/<console-script>.
    
      145  python -m installer --destdir="$pkgdir" --prefix=/usr dist/*.whl
    
      146  # shellcheck disable=SC2128 # $pkgname here is a single string in the per-package function body
    
      147  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      148}
    
      149
    
      150# Split-packages below are meta-packages: they pull extra dependencies but
    
      151# install no new files (the extra deps are runtime-only).
    
      152
    
      153package_python-a2a-sdk-fastapi() {
    
      154  pkgdesc='FastAPI integration for python-a2a-sdk'
    
      155  depends=(
    
      156    'python-a2a-sdk'
    
      157    'python-fastapi'
    
      158    'python-sse-starlette'
    
      159    'python-starlette'
    
      160  )
    
      161  optdepends=('uvicorn: ASGI server (recommended)')
    
      162}
    
      163
    
      164package_python-a2a-sdk-grpc() {
    
      165  pkgdesc='gRPC transport for python-a2a-sdk'
    
      166  # Notes on removed candidates:
    
      167  #   - grpcio-reflection: listed in upstream's grpc extra but not
    
      168  #     actually imported anywhere in src/a2a/. No Arch package exists;
    
      169  #     users that want gRPC server reflection can install it from PyPI.
    
      170  #   - grpcio-status: not in [core]/[extra]; available as
    
      171  #     python-grpcio-status in the AUR. Listed as a depends (not
    
      172  #     optdepends) so the grpc split pulls it in transitively.
    
      173  depends=(
    
      174    'python-a2a-sdk'
    
      175    'python-grpcio'
    
      176    'python-grpcio-tools'
    
      177    'python-grpcio-status'
    
      178    'openssl'
    
      179    'c-ares'
    
      180    'zlib'
    
      181  )
    
      182}
    
      183
    
      184package_python-a2a-sdk-telemetry() {
    
      185  pkgdesc='OpenTelemetry instrumentation for python-a2a-sdk'
    
      186  depends=(
    
      187    'python-a2a-sdk'
    
      188    'python-opentelemetry-api'
    
      189    'python-opentelemetry-sdk'
    
      190  )
    
      191}
    
      192
    
      193package_python-a2a-sdk-signing() {
    
      194  pkgdesc='JWT-based request signing for python-a2a-sdk'
    
      195  depends=('python-a2a-sdk' 'python-pyjwt')
    
      196}
    
      197
    
      198package_python-a2a-sdk-postgresql() {
    
      199  pkgdesc='PostgreSQL task store for python-a2a-sdk'
    
      200  depends=(
    
      201    'python-a2a-sdk'
    
      202    'python-sqlalchemy'
    
      203    'python-asyncpg'
    
      204    'postgresql-libs'
    
      205  )
    
      206}
    
      207
    
      208package_python-a2a-sdk-mysql() {
    
      209  pkgdesc='MySQL task store for python-a2a-sdk'
    
      210  # Arch ships the MariaDB client library as `mariadb-libs` (not
    
      211  # `libmariadb` — that name doesn't exist).
    
      212  depends=(
    
      213    'python-a2a-sdk'
    
      214    'python-sqlalchemy'
    
      215    'python-aiomysql'
    
      216    'mariadb-libs'
    
      217  )
    
      218}
    
      219
    
      220package_python-a2a-sdk-sqlite() {
    
      221  pkgdesc='SQLite task store for python-a2a-sdk'
    
      222  depends=(
    
      223    'python-a2a-sdk'
    
      224    'python-sqlalchemy'
    
      225    'python-aiosqlite'
    
      226  )
    
      227}
    
      228
    
      229package_python-a2a-sdk-db-cli() {
    
      230  pkgdesc='a2a-db console script dependencies for python-a2a-sdk'
    
      231  depends=(
    
      232    'python-a2a-sdk'
    
      233    'python-alembic'
    
      234  )
    
      235}
Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 14:00:44	Medium	1
2026-07-14 00:09:48	Clean	2
2026-07-13 05:40:50	Low	1