python-cppyy-cling
LOW
maintainer orphaned
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads source code from the project's own GitHub and the official CERN host for ROOT; both are project-owned and expected for building, despite the non-whitelisted ROOT download host.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads source code from the project's own GitHub and the official CERN host for ROOT; both are project-owned and expected for building, despite the non-whitelisted ROOT download host.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:43
https://root.cern.ch/download/root_v$_root_version.source.tar.gz
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Jakub Klinkovský <lahwaacz at archlinux dot org>
2
3
_name=cppyy-cling
4
pkgname=python-$_name
5
pkgver=6.32.8
6
pkgrel=1
7
# ROOT version always has zero-padded two-digit patch version (e.g. 6.32.8 -> 6.32.08)
8
# check https://github.com/wlav/cppyy-backend/blob/master/cling/create_src_directory.py#L42
9
_root_version=$(printf "%s.%02d" ${pkgver%.*} ${pkgver##*.})
10
pkgdesc="Cling backend for cppyy"
11
arch=(x86_64)
12
url="https://github.com/wlav/cppyy-backend"
13
license=(
14
BSD-3-Clause-LBNL # cppyy-cling
15
LGPL-2.1-or-later # ROOT
16
NCSA # LLVM, Cling
17
)
18
depends=(
19
clang
20
gcc-libs
21
glibc
22
python
23
zstd
24
)
25
makedepends=(
26
cmake
27
python-build
28
python-installer
29
python-setuptools
30
python-wheel
31
)
32
# cppyy-cling and ROOT have a weird relationship: Cling is developed as part of ROOT without
33
# separate releases, so it is basically forked and patched in the cppyy-backend project.
34
# It also builds and installs some binaries provided by ROOT (rootcling, genreflex).
35
# On the other hand, ROOT has PyROOT which uses cppyy, so it forks it back to build it
36
# against the ROOT-provided Cling. There are also some licensing reasons...
37
# See details: https://github.com/wlav/cppyy-backend/issues/33#issuecomment-2598877502
38
conflicts=(root)
39
provides=($_name)
40
replaces=($_name)
41
source=(
42
$url/archive/refs/tags/$_name-$pkgver.tar.gz
43
https://root.cern.ch/download/root_v$_root_version.source.tar.gz
44
)
45
b2sums=('ce9b62bca2e31ba13bda8fde3f792b7926ea812380af38ef488c8b68dca1634d4c5d050f38ae0cd7be5d7d69219791294216f84ebd89bcdf1cb81ad56edd7aca'
46
'8810322ea518607a81cddeec41645ced272ca0ddbb2bc36a7710d49b6d52a4d897fd369d4f201653a6c7a6ef278121a529b69e62e99c49f13dc0a9ca224ef07d')
47
48
# LTO breaks LLVM
49
options=(!lto)
50
51
prepare() {
52
cd cppyy-backend-$_name-$pkgver/cling
53
54
# patch out cmake dependency from pyproject.toml
55
sed -i 's|requires = \["cmake", |requires = [|' pyproject.toml
56
57
# copy the "interpreter" directory from ROOT, same as downloaded by the create_src_directory.py script
58
cp -ar -t src "$srcdir"/root-$_root_version/interpreter
59
60
# apply all patches same as the create_src_directory.py script
61
# check https://github.com/wlav/cppyy-backend/blob/master/cling/create_src_directory.py#L116-L121
62
local patch_files=('typedef_of_private' 'optlevel2_forced' 'explicit_template'
63
'alias_template' 'incomplete_types' 'clang_printing'
64
'improv_load' 'pch' 'win64rtti' 'win64s2' 'locales' 'build'
65
'system_dirs')
66
local fdiff
67
for fdiff in "${patch_files[@]}"; do
68
patch -p1 -i "patches/$fdiff.diff"
69
done
70
}
71
72
build() {
73
cd cppyy-backend-$_name-$pkgver/cling
74
python -m build --wheel --no-isolation
75
}
76
77
package() {
78
cd cppyy-backend-$_name-$pkgver/cling
79
python -m installer --destdir="$pkgdir" dist/*.whl
80
81
# install licenses
82
install -vDm 644 LICENSE.txt -t "$pkgdir"/usr/share/licenses/$pkgname/
83
install -vDm 644 src/LGPL2_1.txt -t "$pkgdir"/usr/share/licenses/$pkgname/
84
install -vDm 644 src/interpreter/cling/LICENSE.TXT "$pkgdir"/usr/share/licenses/$pkgname/LICENSE_cling.txt
85
}
86
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |