python-gammu-git
LOW
maintainer dreieck
0 votes
scanned 2026-10-20 00:10:31.152894
Why flagged
The package builds from a git checkout of the official project repository on GitHub, which is a normal and expected practice for -git AUR packages; the non-whitelisted host is GitHub itself, accessed via a variable, but this does not change the trust context, and the source is not a prebuilt binary or executable payload.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from a git checkout of the official project repository on GitHub, which is a normal and expected practice for -git AUR packages; the non-whitelisted host is GitHub itself, accessed via a variable, but this does not change the trust context, and the source is not a prebuilt binary or executable payload.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:48
"${_pkgname}::git+https://${_githost}/${_gituser}/${_gitname}.git"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: dreieck (https://aur.archlinux.org/account/dreieck)
2
# Contributor: Jaroslav Lichtblau <svetlemodry@archlinux.org>
3
# Contributor: Carl Smedstad <carsme@archlinux.org>
4
# Contributor: Felix Yan <felixonmars@archlinux>
5
6
7
_gitname="python-gammu"
8
_pkgname="${_gitname}"
9
pkgname="${_pkgname}-git"
10
pkgver=3.5.0+5.r13361.20260921.a3a6f31bf
11
pkgrel=1
12
pkgdesc="Python bindings for Gammu library. Latest git checkout."
13
arch=(
14
'i686'
15
'x86_64'
16
'aarch64'
17
'armv6h'
18
'armv7h'
19
)
20
_githost='github.com'
21
_gituser='gammu'
22
url="https://${_githost}/${_gituser}/${_gitname}"
23
license=("GPL-2.0-or-later")
24
depends=(
25
'gammu'
26
'glibc'
27
'python>=3'
28
)
29
makedepends=(
30
'git'
31
'python-build'
32
'python-installer'
33
'python-setuptools'
34
'python-wheel'
35
)
36
optdepends=()
37
checkdepends=(
38
'libdbi-drivers'
39
)
40
provides=(
41
"${_pkgname}=${pkgver}"
42
)
43
conflicts=(
44
"${_pkgname}"
45
)
46
47
source=(
48
"${_pkgname}::git+https://${_githost}/${_gituser}/${_gitname}.git"
49
)
50
sha256sums=(
51
'SKIP'
52
)
53
54
prepare() {
55
cd "${srcdir}/${_pkgname}"
56
git log > "${srcdir}/git.log"
57
}
58
59
pkgver() {
60
cd "${srcdir}/${_pkgname}"
61
62
_ver="$(git describe --tags | sed -E -e 's|^[vV]||' -e 's|\-g[0-9a-f]*$||' | tr '-' '+')"
63
_rev="$(git rev-list --count HEAD)"
64
_date="$(git log -1 --date=format:"%Y%m%d" --format="%ad")"
65
_hash="$(git rev-parse --short HEAD)"
66
67
if [ -z "${_ver}" ]; then
68
error "Version could not be determined."
69
return 1
70
else
71
printf '%s' "${_ver}.r${_rev}.${_date}.${_hash}"
72
fi
73
}
74
75
build() {
76
cd "${srcdir}/${_pkgname}"
77
78
python -m build --wheel --no-isolation
79
}
80
81
check() {
82
cd "${srcdir}/${_pkgname}"
83
84
python -m installer --destdir=tmp_install dist/*.whl
85
local site_packages=$(python -c "import site; print(site.getsitepackages()[0])")
86
# The test suite cannot run in the project root as the uncompiled package
87
# there will take precedence over the compiled package installed in
88
# tmp_install, regardless of what PYTHONPATH is set to. To work around this,
89
# copy the tests to the tmp_install directory and run them from there.
90
cp -r test "$PWD/tmp_install/$site_packages"
91
# Tests can be flaky on slower hardware due to timing.
92
python -m unittest discover -vs "$PWD/tmp_install/$site_packages"
93
}
94
95
package() {
96
cd "${srcdir}/${_pkgname}"
97
98
python -m installer --destdir="$pkgdir" --compile-bytecode=2 dist/*.whl
99
100
_docfiles=(
101
"${srcdir}/git.log"
102
AUTHORS
103
NEWS.rst
104
README.rst
105
)
106
_docdirs=()
107
_manfiles=()
108
_infofiles=()
109
_licensefiles=(
110
COPYING
111
)
112
printf '%s\n' " --> installing documentation ..."
113
for _docfile in "${_docfiles[@]}"; do
114
install -D -v -m644 "${_docfile}" "${pkgdir}/usr/share/doc/${_pkgname}/$(basename "${_docfile}")"
115
done
116
for _docdir in "${_docdirs[@]}"; do
117
cp -rv "${_docdir}" "${pkgdir}/usr/share/doc/${_pkgname}/$(basename "${_docdir}")"
118
done
119
for _manfile in "${_manfiles[@]}"; do
120
_section="$(basename "${_manfile}" .gz | sed -E -e 's|^.*\.([^.]*)$|\1|')"
121
install -D -v -m644 "docs/build/man/${_manfile}" "${pkgdir}/usr/share/man/man${_section}/$(basename "${_manfile}")"
122
done
123
for _infofile in "${_infofiles[@]}"; do
124
install -D -v -m644 "${_infofile}" "${pkgdir}/usr/share/info/$(basename "${_infofile}")"
125
done
126
printf '%s\n' " --> installing license ..."
127
for _licensefile in "${_licensefiles[@]}"; do
128
install -D -v -m644 "${_licensefile}" "${pkgdir}/usr/share/licenses/${pkgname}/$(basename "${_licensefile}")"
129
#ln -svr "${pkgdir}/usr/share/licenses/${pkgname}/$(basename "${_licensefile}")" "${pkgdir}/usr/share/doc/${_pkgname}/$(basename "${_licensefile}")"
130
done
131
}
132
133
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |
| 2026-10-14 00:06:47 | Low | 2 |
| 2026-10-13 00:23:45 | Low | 2 |
| 2026-10-12 00:18:51 | Low | 2 |
| 2026-10-11 00:26:05 | Low | 2 |
| 2026-10-10 00:11:52 | Low | 2 |
| 2026-10-09 00:05:33 | Low | 2 |
| 2026-10-08 00:28:03 | Low | 2 |
| 2026-10-07 00:21:34 | Low | 2 |
| 2026-10-06 00:13:36 | Low | 2 |
| 2026-10-05 00:08:03 | Low | 2 |
| 2026-10-04 00:18:08 | Low | 2 |
| 2026-10-03 00:23:04 | Low | 2 |
| 2026-10-02 00:00:32 | Low | 2 |
| 2026-10-01 00:02:06 | Low | 2 |