python-google-cloud-trace

maintainer karinrnning · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from a source tarball hosted on the official Python package index (pypi.org), which is a trusted source; the flagged pattern is due to package orphaning history, not malicious content or supply-chain risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from a source tarball hosted on the official Python package index (pypi.org), which is a trusted source; the flagged pattern is due to package orphaning history, not malicious content or supply-chain risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

      1# Maintainer: Brody <archfan at brodix dot de>
    
      2
    
      3_pyname=google_cloud_trace
    
      4pkgname=python-google-cloud-trace
    
      5pkgver=1.18.0
    
      6pkgrel=1
    
      7pkgdesc='Google Cloud Trace API client library'
    
      8url=https://github.com/googleapis/google-cloud-python
    
      9arch=(any)
    
      10license=(Apache-2.0)
    
      11depends=(
    
      12  python
    
      13  python-google-api-core
    
      14  python-google-auth
    
      15  python-proto-plus
    
      16  python-protobuf
    
      17)
    
      18makedepends=(
    
      19  python-build
    
      20  python-installer
    
      21  python-setuptools
    
      22  python-wheel
    
      23)
    
      24optdepends=()
    
      25source=(${pkgname}-${pkgver}.tar.gz::https://files.pythonhosted.org/packages/source/${_pyname:0:1}/${_pyname}/${_pyname}-${pkgver}.tar.gz)
    
      26b2sums=('8a32fba2ed1a5edb4cf53992f4812f5d3c2a3b796e6370139f41cd4133ead91c87481d95cf9d42000d6c39c561a29db32f464a54572b856a831ff83c89b10313')
    
      27
    
      28build() {
    
      29  cd ${_pyname}-${pkgver}
    
      30
    
      31  python -m build \
    
      32    --wheel \
    
      33    --no-isolation
    
      34}
    
      35
    
      36package() {
    
      37  cd ${_pyname}-${pkgver}
    
      38
    
      39  python -m installer \
    
      40    --destdir="${pkgdir}" \
    
      41    dist/*.whl
    
      42
    
      43  install -Dm644 -t "${pkgdir}"/usr/share/doc/${pkgname} README.rst
    
      44  install -Dm644 -t "${pkgdir}"/usr/share/licenses/${pkgname} LICENSE
    
      45}
    
      46
    
      47# vim: ts=2 sw=2 et:
    
      48

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 17:15:21	MEDIUM	1
2026-06-18 16:11:54	CLEAN	0