python-abx-pkg

maintainer bjornhenriksson · 0 votes · scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged Package builds from a standard PyPI source tarball, which is normal AUR practice; the orphaned/re-adopted status is a maintenance concern, not a security risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): Package builds from a standard PyPI source tarball, which is normal AUR practice; the orphaned/re-adopted status is a maintenance concern, not a security risk.

1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

1# Maintainer: Michał Wojdyła < micwoj9292 at gmail dot com >
2
3pkgname=python-abx-pkg
4pkgver=0.6.0
5pkgrel=2
6pkgdesc="System package manager interfaces with Python type hints."
7arch=('any')
8url="https://pypi.org/project/abx-pkg/"
9license=('MIT')
10depends=('python' 'python-platformdirs' 'python-pydantic' 'python-pydantic-core' 'python-typing_extensions')
11makedepends=('python-build' 'python-installer' 'python-hatchling')
12
13source=("https://pypi.python.org/packages/source/a/abx-pkg/abx_pkg-${pkgver}.tar.gz")
14md5sums=('7a1fc9332c5007274111ac21c12bf05b')
15
16build() {
17 cd "$srcdir/abx_pkg-$pkgver"
18 python -m build --no-isolation --wheel
19}
20package() {
21 cd "$srcdir/abx_pkg-$pkgver"
22 python -m installer --destdir="$pkgdir" dist/*.whl
23 install -D -m644 LICENSE \
24 "$pkgdir"/usr/share/licenses/$pkgname/LICENSE
25}
26
27# vim:set ts=2 sw=2 et:
28

Scan history

Scanned at (UTC)SeverityRules
2026-08-03 00:08:14 LOW 2
2026-08-02 00:16:08 LOW 2
2026-08-01 00:11:18 LOW 2
2026-07-31 00:14:10 LOW 2
2026-07-30 17:15:21 MEDIUM 1
2026-06-18 16:11:54 CLEAN 0

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion