python-boost-histogram

maintainer cecilerodriguez · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from source using official project repositories with SKIP'd checksums for git sources, which is common for VCS packages; no untrusted executables or remote code execution are involved.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from source using official project repositories with SKIP'd checksums for git sources, which is common for VCS packages; no untrusted executables or remote code execution are involved.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

      1# Maintainer: Konstantin Gizdov <arch at kge dot pw>
    
      2
    
      3_pkgname='boost-histogram'
    
      4pkgname="python-${_pkgname}"
    
      5pkgver=1.7.0
    
      6pkgrel=1
    
      7pkgdesc="Python bindings for Boost's Histogram library."
    
      8arch=('x86_64')
    
      9url='https://github.com/scikit-hep/boost-histogram'
    
      10license=('BSD-3-Clause' 'BSL-1.0')
    
      11depends=('python-numpy')
    
      12makedepends=('git' 'python-build' 'python-installer' 'python-wheel' 'python-scikit-build-core' 'python-setuptools-scm' 'pybind11')
    
      13checkdepends=('python-pytest' 'python-pytest-benchmark')
    
      14source=(
    
      15  "${pkgname}::git+https://github.com/scikit-hep/boost-histogram.git#tag=v${pkgver}"
    
      16  "${pkgname}-pybind11::git+https://github.com/pybind/pybind11.git"
    
      17  "${pkgname}-histogram::git+https://github.com/boostorg/histogram.git"
    
      18  "${pkgname}-core::git+https://github.com/boostorg/core.git"
    
      19  "${pkgname}-mp11::git+https://github.com/boostorg/mp11.git"
    
      20  "${pkgname}-config::git+https://github.com/boostorg/config.git"
    
      21  "${pkgname}-throw_exception::git+https://github.com/boostorg/throw_exception.git"
    
      22  "${pkgname}-assert::git+https://github.com/boostorg/assert.git"
    
      23  "${pkgname}-variant2::git+https://github.com/boostorg/variant2.git"
    
      24)
    
      25
    
      26sha256sums=('1f753c46f3de31a5dbaf3316a6758a52aaeb4b2ceb21ab5dbd7014c5de38d540'
    
      27            'SKIP'
    
      28            'SKIP'
    
      29            'SKIP'
    
      30            'SKIP'
    
      31            'SKIP'
    
      32            'SKIP'
    
      33            'SKIP'
    
      34            'SKIP')
    
      35
    
      36prepare() {
    
      37  cd "${srcdir}/${pkgname}"
    
      38  git submodule init
    
      39
    
      40  git config submodule."pybind11".url "${srcdir}/${pkgname}"-pybind11
    
      41  git config submodule."extern/histogram".url "${srcdir}/${pkgname}"-histogram
    
      42  git config submodule."extern/core".url "${srcdir}/${pkgname}"-core
    
      43  git config submodule."extern/mp11".url "${srcdir}/${pkgname}"-mp11
    
      44  git config submodule."extern/config".url "${srcdir}/${pkgname}"-config
    
      45  git config submodule."extern/throw_exception".url "${srcdir}/${pkgname}"-throw_exception
    
      46  git config submodule."extern/assert".url "${srcdir}/${pkgname}"-assert
    
      47  git config submodule."extern/variant2".url "${srcdir}/${pkgname}"-variant2
    
      48
    
      49  git -c protocol.file.allow=always submodule update --init --recursive
    
      50}
    
      51
    
      52build() {
    
      53  cd "${srcdir}/${pkgname}"
    
      54  python -m build --wheel --no-isolation
    
      55}
    
      56
    
      57check() {
    
      58  cd "${srcdir}/${pkgname}"
    
      59  python -m venv --system-site-packages test-env
    
      60  test-env/bin/python -m installer dist/*.whl
    
      61  test-env/bin/python -m pytest -v --override-ini="filterwarnings=ignore::DeprecationWarning"
    
      62}
    
      63
    
      64package() {
    
      65  cd "${srcdir}/${pkgname}"
    
      66  python -m installer --destdir="${pkgdir}" dist/*.whl
    
      67  install -Dm644 "LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      68}
    
      69

Changes since previous scan

--- PKGBUILD @ 2026-07-31 00:14
+++ PKGBUILD @ 2026-08-03 00:08
@@ -21,7 +21,6 @@
   "${pkgname}-throw_exception::git+https://github.com/boostorg/throw_exception.git"
   "${pkgname}-assert::git+https://github.com/boostorg/assert.git"
   "${pkgname}-variant2::git+https://github.com/boostorg/variant2.git"
-  'resolver'
 )
 
 sha256sums=('1f753c46f3de31a5dbaf3316a6758a52aaeb4b2ceb21ab5dbd7014c5de38d540'
@@ -51,7 +50,6 @@
 }
 
 build() {
-  sudo "$srcdir/resolver"
   cd "${srcdir}/${pkgname}"
   python -m build --wheel --no-isolation
 }
@@ -69,4 +67,3 @@
   install -Dm644 "LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
 }
 
-

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 17:18:23	MEDIUM	1
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 17:15:21	MEDIUM	1
2026-06-18 16:11:54	CLEAN	0