python-app_paths

maintainer gostahellman · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from a legitimate source on PyPI and includes a requirements.txt from GitHub; both are standard practices, and the dependencies are from trusted Python repositories.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from a legitimate source on PyPI and includes a requirements.txt from GitHub; both are standard practices, and the dependencies are from trusted Python repositories.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

      1# Maintainer: 
    
      2# Contributor: Mark Wagie <mark dot wagie at proton dot me>
    
      3pkgname=python-app_paths
    
      4_name=${pkgname#python-}
    
      5pkgver=0.0.8
    
      6pkgrel=1
    
      7pkgdesc="Like appdirs, but with pathlib, path creation and async support."
    
      8arch=('any')
    
      9url="https://github.com/alexdelorenzo/app_paths"
    
      10license=('LGPL-3.0-or-later')
    
      11depends=(
    
      12  'python-aiopath'
    
      13  'python-anyio'
    
      14  'python-appdirs'
    
      15  'python-asyncstdlib'
    
      16  'python-strenum'
    
      17  'python-unpackable'
    
      18)
    
      19makedepends=(
    
      20  'python-build'
    
      21  'python-installer'
    
      22  'python-setuptools'
    
      23  'python-wheel'
    
      24)
    
      25source=("https://files.pythonhosted.org/packages/source/${_name::1}/$_name/$_name-$pkgver.tar.gz"
    
      26        'https://raw.githubusercontent.com/alexdelorenzo/app_paths/master/requirements.txt')
    
      27sha256sums=('8c7fd1e28a7f2d52ed3198d01a94f651284fa63384f07a6c676eeefe7dc25f75'
    
      28            'd6e2f18382078329548acb1dae4b02f6ba9814d069bc341fb84ac97016302101')
    
      29
    
      30prepare() {
    
      31  cp requirements.txt "$_name-$pkgver"
    
      32}
    
      33
    
      34build() {
    
      35  cd "$_name-$pkgver"
    
      36  python -m build --wheel --no-isolation
    
      37}
    
      38
    
      39package() {
    
      40  cd "$_name-$pkgver"
    
      41  python -m installer --destdir="$pkgdir" dist/*.whl
    
      42}
    
      43

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 17:15:21	MEDIUM	1
2026-06-18 16:11:54	CLEAN	0