python-cppyy-cling

maintainer orphaned · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads source code from the project's own GitHub and the official CERN host for ROOT; both are project-owned and expected for building, despite the non-whitelisted ROOT download host.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads source code from the project's own GitHub and the official CERN host for ROOT; both are project-owned and expected for building, despite the non-whitelisted ROOT download host.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:43 https://root.cern.ch/download/root_v$_root_version.source.tar.gz

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Jakub Klinkovský <lahwaacz at archlinux dot org>
    
      2
    
      3_name=cppyy-cling
    
      4pkgname=python-$_name
    
      5pkgver=6.32.8
    
      6pkgrel=1
    
      7# ROOT version always has zero-padded two-digit patch version (e.g. 6.32.8 -> 6.32.08)
    
      8# check https://github.com/wlav/cppyy-backend/blob/master/cling/create_src_directory.py#L42
    
      9_root_version=$(printf "%s.%02d" ${pkgver%.*} ${pkgver##*.})
    
      10pkgdesc="Cling backend for cppyy"
    
      11arch=(x86_64)
    
      12url="https://github.com/wlav/cppyy-backend"
    
      13license=(
    
      14  BSD-3-Clause-LBNL   # cppyy-cling
    
      15  LGPL-2.1-or-later   # ROOT
    
      16  NCSA                # LLVM, Cling
    
      17)
    
      18depends=(
    
      19  clang
    
      20  gcc-libs
    
      21  glibc
    
      22  python
    
      23  zstd
    
      24)
    
      25makedepends=(
    
      26  cmake
    
      27  python-build
    
      28  python-installer
    
      29  python-setuptools
    
      30  python-wheel
    
      31)
    
      32# cppyy-cling and ROOT have a weird relationship: Cling is developed as part of ROOT without
    
      33# separate releases, so it is basically forked and patched in the cppyy-backend project.
    
      34# It also builds and installs some binaries provided by ROOT (rootcling, genreflex).
    
      35# On the other hand, ROOT has PyROOT which uses cppyy, so it forks it back to build it
    
      36# against the ROOT-provided Cling. There are also some licensing reasons...
    
      37# See details: https://github.com/wlav/cppyy-backend/issues/33#issuecomment-2598877502
    
      38conflicts=(root)
    
      39provides=($_name)
    
      40replaces=($_name)
    
      41source=(
    
      42  $url/archive/refs/tags/$_name-$pkgver.tar.gz
    
      43  https://root.cern.ch/download/root_v$_root_version.source.tar.gz
    
      44)
    
      45b2sums=('ce9b62bca2e31ba13bda8fde3f792b7926ea812380af38ef488c8b68dca1634d4c5d050f38ae0cd7be5d7d69219791294216f84ebd89bcdf1cb81ad56edd7aca'
    
      46        '8810322ea518607a81cddeec41645ced272ca0ddbb2bc36a7710d49b6d52a4d897fd369d4f201653a6c7a6ef278121a529b69e62e99c49f13dc0a9ca224ef07d')
    
      47
    
      48# LTO breaks LLVM
    
      49options=(!lto)
    
      50
    
      51prepare() {
    
      52  cd cppyy-backend-$_name-$pkgver/cling
    
      53
    
      54  # patch out cmake dependency from pyproject.toml
    
      55  sed -i 's|requires = \["cmake", |requires = [|' pyproject.toml
    
      56
    
      57  # copy the "interpreter" directory from ROOT, same as downloaded by the create_src_directory.py script
    
      58  cp -ar -t src "$srcdir"/root-$_root_version/interpreter
    
      59
    
      60  # apply all patches same as the create_src_directory.py script
    
      61  # check https://github.com/wlav/cppyy-backend/blob/master/cling/create_src_directory.py#L116-L121
    
      62  local patch_files=('typedef_of_private' 'optlevel2_forced' 'explicit_template'
    
      63                     'alias_template' 'incomplete_types' 'clang_printing'
    
      64                     'improv_load' 'pch' 'win64rtti' 'win64s2' 'locales' 'build'
    
      65                     'system_dirs')
    
      66  local fdiff
    
      67  for fdiff in "${patch_files[@]}"; do
    
      68    patch -p1 -i "patches/$fdiff.diff"
    
      69  done
    
      70}
    
      71
    
      72build() {
    
      73  cd cppyy-backend-$_name-$pkgver/cling
    
      74  python -m build --wheel --no-isolation
    
      75}
    
      76
    
      77package() {
    
      78  cd cppyy-backend-$_name-$pkgver/cling
    
      79  python -m installer --destdir="$pkgdir" dist/*.whl
    
      80
    
      81  # install licenses
    
      82  install -vDm 644 LICENSE.txt -t "$pkgdir"/usr/share/licenses/$pkgname/
    
      83  install -vDm 644 src/LGPL2_1.txt -t "$pkgdir"/usr/share/licenses/$pkgname/
    
      84  install -vDm 644 src/interpreter/cling/LICENSE.TXT "$pkgdir"/usr/share/licenses/$pkgname/LICENSE_cling.txt
    
      85}
    
      86

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2