python-cheby-git

LOW

maintainer szymon_j 0 votes scanned 2026-10-30 11:59:00.416364

View on AUR

Why flagged

Builds from the project's own official GitLab repository at gitlab.cern.ch; the SKIP checksum is normal for a git source, and all actions are standard Python wheel build/install steps with no remote code execution or exfiltration.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 80%): Builds from the project's own official GitLab repository at gitlab.cern.ch; the SKIP checksum is normal for a git source, and all actions are standard Python wheel build/install steps with no remote code execution or exfiltration.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source=("${_name}-${pkgver}::git+https://gitlab.cern.ch/be-cem-edl/common/cheby#tag=v${pkgver}")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer Szymon Januszek <szymon_j at tutanota dot com>
    
      2
    
      3pkgname=python-cheby-git
    
      4_name=${pkgname#python-%-git}
    
      5pkgver=1.7.2
    
      6pkgrel=1
    
      7pkgdesc="The Cheby project aims at defining a file format to describe the HW/SW interface (the memory map), and a set of tools to generate HDL, drivers, documentation... from these files."
    
      8arch=('any')
    
      9url="https://gitlab.cern.ch/be-cem-edl/common/cheby"
    
      10license=('GPL-3.0-or-later')
    
      11depends=(
    
      12	'python'
    
      13	'python-pyaml'
    
      14)
    
      15makedepends=(python-build python-installer python-wheel)
    
      16source=("${_name}-${pkgver}::git+https://gitlab.cern.ch/be-cem-edl/common/cheby#tag=v${pkgver}")
    
      17sha256sums=('SKIP')
    
      18
    
      19prepare() {
    
      20	git -C "${srcdir}/${_name}-${pkgver}" clean -dfx
    
      21
    
      22	#Remove the license line, keep the file. See: https://peps.python.org/pep-0639/#term-license-expression
    
      23	sed -i 's/"License :: OSI Approved :: GPL-3.0-or-later",//g' "${_name}-${pkgver}/pyproject.toml"
    
      24	sed -i 's/license = {file = "LICENSES\/GPL-3.0-or-later.txt"}/license = "GPL-3.0-or-later"/g' "${_name}-${pkgver}/pyproject.toml"
    
      25	#Fix the linux specifier format
    
      26    sed -i 's/Operating System :: Linux/Operating System :: POSIX :: Linux/g' "${_name}-${pkgver}/pyproject.toml"
    
      27}
    
      28
    
      29build() {
    
      30    cd $_name-$pkgver
    
      31    python -m build --wheel --no-isolation
    
      32}
    
      33
    
      34package() {
    
      35    cd $_name-$pkgver
    
      36    python -m installer --destdir="$pkgdir" dist/*.whl
    
      37}
    
      38

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-30 11:59:00	Low	3
2026-10-30 11:55:28	Medium	2