python-beancount-import

CLEAN

maintainer AlphaJack 0 votes scanned 2026-11-02 00:26:00.633185

View on AUR

Triggered rules

Clean AI review downgraded a static finding llm_review

The static rules flagged this LOW, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it CLEAN (confidence 95%): The package builds from source hosted on the project's official GitHub repository, uses standard build tools, and installs only the project's own wheel; the flagged low-vote count and recent upload are not security risks.

1 higher static finding superseded - not the current verdict (shown for transparency)

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

PKGBUILD

      1# Maintainer: AlphaJack <alphajack at tuta dot io>
    
      2# Contributor: Carlos José Ruiz-Henestrosa Ruiz <ruizh.cj@gmail.com>
    
      3
    
      4pkgname="python-beancount-import"
    
      5_name="beancount-import"
    
      6pkgver=1.5.0
    
      7pkgrel=1
    
      8pkgdesc="Semi-automatic importer from external data sources into beancount"
    
      9arch=("any")
    
      10url="https://github.com/jbms/beancount-import"
    
      11license=("GPL-2.0-only")
    
      12depends=("beancount"
    
      13         "beangulp"
    
      14         "beanquery"
    
      15         "python"
    
      16         "python-atomicwrites"
    
      17         "python-cachetools"
    
      18         "python-dateutil"
    
      19         "python-jsonschema"
    
      20         "python-nltk"
    
      21         "python-numpy"
    
      22         "python-scikit-learn"
    
      23         "python-scipy"
    
      24         "python-tornado"
    
      25         "python-typing_extensions"
    
      26         "python-watchdog")
    
      27makedepends=("esbuild" "npm" "python-build" "python-installer" "python-setuptools" "python-setuptools-scm" "python-wheel")
    
      28source=("$_name-$pkgver.tar.gz::$url/archive/refs/tags/v$pkgver.tar.gz")
    
      29sha256sums=('a7249d5feeb3ff3dba498336cf5778535029f28ad148f2ab5d5731dd9d867af3')
    
      30
    
      31prepare(){
    
      32 cd "$_name-$pkgver"
    
      33 # the frontend is bundled in build(), setup.py would bundle it again with npm's esbuild
    
      34 sed -i 's/self.skip_rebuild = False/self.skip_rebuild = True/' setup.py
    
      35}
    
      36
    
      37build(){
    
      38 cd "$_name-$pkgver/frontend"
    
      39 # install scripts are blocked by npm, bundle with the system esbuild instead
    
      40 npm ci --ignore-scripts
    
      41 esbuild --bundle app.tsx --sourcemap --minify --outdir=../beancount_import/frontend_dist --define:global=window "--define:process.env.NODE_ENV='production'"
    
      42 cd ..
    
      43 export SETUPTOOLS_SCM_PRETEND_VERSION="$pkgver"
    
      44 python -m build --wheel --no-isolation
    
      45}
    
      46
    
      47package(){
    
      48 cd "$_name-$pkgver"
    
      49 python -m installer --destdir="$pkgdir" dist/*.whl
    
      50 install -D -m 644 LICENSE -t "$pkgdir/usr/share/licenses/$pkgname"
    
      51}
    
      52

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-02 00:26:00	Clean	2
2026-11-01 22:01:45	Low	1