python-atproto-git

maintainer tuukkasalo · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from the project's own Git repository, which is a normal practice for -git AUR packages; the recently orphaned flag does not indicate inherent danger.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from the project's own Git repository, which is a normal practice for -git AUR packages; the recently orphaned flag does not indicate inherent danger.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

      1# -*- sh -*-
    
      2
    
      3# Maintainer: Klaus Alexander Seiﬆrup <$(echo 0x1fd+d59decfa=40 | tr 0-9+a-f=x ka-i@p-u.l)>
    
      4
    
      5pkgname='python-atproto-git'
    
      6_pkgname="${pkgname/-git/}"
    
      7_srcname="${_pkgname/python-/}"
    
      8pkgdesc='The AT Protocol (Bluesky) SDK for Python (development version)'
    
      9pkgver=0.0.69.r4.g15b9499
    
      10pkgrel=1
    
      11url='https://github.com/MarshalX/atproto'
    
      12arch=('any')
    
      13license=(
    
      14  'MIT'
    
      15  'CC0-1.0'
    
      16)
    
      17makedepends=(
    
      18  'git'
    
      19  'python-build'
    
      20  'python-installer'
    
      21  'python-poetry-dynamic-versioning'
    
      22  'python-wheel'
    
      23)
    
      24depends=(
    
      25  'python'
    
      26  'python-click'
    
      27  'python-cryptography'
    
      28  'python-dnspython'
    
      29  'python-httpx'
    
      30  'python-libipld'
    
      31  'python-pydantic'
    
      32  'python-typing_extensions'
    
      33  'python-websockets'
    
      34)
    
      35provides=("$_pkgname"{,_{cli,client,codegen,core,crypto,firehose,identity,lexicon,server}})
    
      36conflicts=("${provides[@]}")
    
      37options=('!strip')
    
      38source=("git+$url.git")
    
      39sha256sums=('SKIP')
    
      40
    
      41pkgver() {
    
      42  cd "$_srcname"
    
      43
    
      44  git describe --tags --long | sed 's/^v//;s/\([^-]*-g\)/r\1/;s/-/./g'
    
      45}
    
      46
    
      47build() {
    
      48  cd "$_srcname"
    
      49
    
      50  export PYTHNOWARNINGS=ignore
    
      51  python -m build --wheel --no-isolation
    
      52}
    
      53
    
      54package() {
    
      55  cd "$_srcname"
    
      56
    
      57  python -m installer --destdir="$pkgdir" dist/*.whl
    
      58
    
      59  install -Dm0644 -t "$pkgdir/usr/share/licenses/$pkgname" LICENSE
    
      60  install -Dm0644 -t "$pkgdir/usr/share/doc/$pkgname" \
    
      61    {CHANGES,README,SECURITY}.md
    
      62  cp -fa examples "$pkgdir/usr/share/doc/$pkgname/"
    
      63
    
      64  for _dir in doc licenses; do
    
      65    pushd "$pkgdir/usr/share/$_dir"
    
      66    ln -fsr "$pkgname" "$_pkgname"
    
      67    popd
    
      68  done > /dev/null
    
      69}
    
      70
    
      71# eof
    
      72

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-08-03 00:08
@@ -5,14 +5,14 @@
 pkgname='python-atproto-git'
 _pkgname="${pkgname/-git/}"
 _srcname="${_pkgname/python-/}"
-pkgver=0.0.62.r3.g7ed3650
+pkgdesc='The AT Protocol (Bluesky) SDK for Python (development version)'
+pkgver=0.0.69.r4.g15b9499
 pkgrel=1
-pkgdesc='The AT Protocol (Bluesky) SDK for Python (development version)'
+url='https://github.com/MarshalX/atproto'
 arch=('any')
-url='https://github.com/MarshalX/atproto'
 license=(
-  'MIT'        # SPDX-License-Identifier: MIT (main package)
-  'CC0-1.0'    # SPDX-License-Identifier: CC0-1.0 (examples)
+  'MIT'
+  'CC0-1.0'
 )
 makedepends=(
   'git'
@@ -22,7 +22,7 @@
   'python-wheel'
 )
 depends=(
-  'python>=3.8'
+  'python'
   'python-click'
   'python-cryptography'
   'python-dnspython'
@@ -32,9 +32,10 @@
   'python-typing_extensions'
   'python-websockets'
 )
-source=("git+$url.git")
 provides=("$_pkgname"{,_{cli,client,codegen,core,crypto,firehose,identity,lexicon,server}})
 conflicts=("${provides[@]}")
+options=('!strip')
+source=("git+$url.git")
 sha256sums=('SKIP')
 
 pkgver() {
@@ -46,6 +47,7 @@
 build() {
   cd "$_srcname"
 
+  export PYTHNOWARNINGS=ignore
   python -m build --wheel --no-isolation
 }
 
@@ -54,10 +56,16 @@
 
   python -m installer --destdir="$pkgdir" dist/*.whl
 
-  install -vDm0644 -t "$pkgdir/usr/share/licenses/$pkgname" LICENSE
-  install -vDm0644 -t "$pkgdir/usr/share/doc/$pkgname" \
+  install -Dm0644 -t "$pkgdir/usr/share/licenses/$pkgname" LICENSE
+  install -Dm0644 -t "$pkgdir/usr/share/doc/$pkgname" \
     {CHANGES,README,SECURITY}.md
-  cp -vfa examples "$pkgdir/usr/share/doc/$pkgname/"
+  cp -fa examples "$pkgdir/usr/share/doc/$pkgname/"
+
+  for _dir in doc licenses; do
+    pushd "$pkgdir/usr/share/$_dir"
+    ln -fsr "$pkgname" "$_pkgname"
+    popd
+  done > /dev/null
 }
 
 # eof

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 17:15:21	MEDIUM	1
2026-07-18 15:58:03	CLEAN	0
2026-06-18 16:11:54	CLEAN	0