python-jsonargparse

maintainer tee · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged Package builds from a standard Python source tarball on PyPI, which is a normal and expected practice; the recent orphan and re-adoption is a metadata concern but does not imply malicious intent or supply-chain risk given the source is verifiable and checksummed.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): Package builds from a standard Python source tarball on PyPI, which is a normal and expected practice; the recent orphan and re-adoption is a metadata concern but does not imply malicious intent or supply-chain risk given the source is verifiable and checksummed.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

      1# Contributor: redponike <proton (dot) me>
    
      2# Contributor: Alex Hirzel <alex at hirzel period us>
    
      3# Contributor: Luis Martinez <luis dot martinez at disroot dot org>
    
      4# Contributor: Butui Hu <hot123tea123@gmail.com>
    
      5# Contributor: tee < teeaur at duck dot com >
    
      6
    
      7pkgname=python-jsonargparse
    
      8_pkgname=${pkgname#python-}
    
      9pkgver=4.50.0
    
      10pkgrel=1
    
      11pkgdesc='Parsing library for CLI options, configs, and environment variables'
    
      12arch=('any')
    
      13url='https://github.com/omni-us/jsonargparse'
    
      14license=('MIT')
    
      15depends=('python-yaml')
    
      16optdepends=(
    
      17  'python-docstring-parser'
    
      18  'python-fsspec'
    
      19  'python-jsonschema'
    
      20  'python-omegaconf'
    
      21  'python-ruyaml'
    
      22  'python-toml'
    
      23)
    
      24makedepends=(
    
      25  'python-build'
    
      26  'python-installer'
    
      27  'python-wheel'
    
      28  'python-setuptools'
    
      29)
    
      30checkdepends=(
    
      31  'python-pytest'
    
      32  'python-pytest-subtests'
    
      33  'python-attrs'
    
      34  'python-argcomplete'
    
      35  'python-pydantic'
    
      36  'python-requests'
    
      37  'python-shtab'
    
      38  'python-responses'
    
      39)
    
      40source=("https://files.pythonhosted.org/packages/source/${_pkgname::1}/${_pkgname}/${_pkgname}-${pkgver}.tar.gz")
    
      41b2sums=('f4e9a234928dbec11bf5c328c1751fb7fd9af6ea13de331f7bf0964df505c04d8c3a8ade86d0ac8628da84d9cbe591659326525030d169ceed94f87f91c85d15')
    
      42
    
      43build() {
    
      44  python -m build --wheel --no-isolation "${_pkgname}-${pkgver}"
    
      45}
    
      46
    
      47check() {
    
      48  cd "${_pkgname}-${pkgver}"
    
      49#  PYTHONPATH="jsonargparse_tests" pytest -vv
    
      50}
    
      51
    
      52package() {
    
      53  cd "${_pkgname}-${pkgver}"
    
      54  PYTHONHASHSEED=0 python -m installer --destdir="$pkgdir" dist/*.whl
    
      55  local _site=$(python -c "import site; print(site.getsitepackages()[0])")
    
      56  install -d "$pkgdir/usr/share/licenses/$pkgname/"
    
      57  ln -s "$_site/$_pkgname-$pkgver.dist-info/LICENSE.rst" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      58}
    
      59
    
      60# vim:set ts=2 sw=2 et:
    
      61

Changes since previous scan

--- PKGBUILD @ 2026-07-11 00:25
+++ PKGBUILD @ 2026-08-03 00:08
@@ -6,7 +6,7 @@
 
 pkgname=python-jsonargparse
 _pkgname=${pkgname#python-}
-pkgver=4.49.0
+pkgver=4.50.0
 pkgrel=1
 pkgdesc='Parsing library for CLI options, configs, and environment variables'
 arch=('any')
@@ -38,7 +38,7 @@
   'python-responses'
 )
 source=("https://files.pythonhosted.org/packages/source/${_pkgname::1}/${_pkgname}/${_pkgname}-${pkgver}.tar.gz")
-b2sums=('10635abe75550ccf88107f6b72b22a51284098f5f6d9cea7b43e54b0625e851c7d574251b5f16e96dc903abfe4a657dc4e3b6bcb5bf68b00c5f331521ef81d9b')
+b2sums=('f4e9a234928dbec11bf5c328c1751fb7fd9af6ea13de331f7bf0964df505c04d8c3a8ade86d0ac8628da84d9cbe591659326525030d169ceed94f87f91c85d15')
 
 build() {
   python -m build --wheel --no-isolation "${_pkgname}-${pkgver}"

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 11:20:06	MEDIUM	1
2026-07-11 00:25:18	CLEAN	2
2026-07-10 07:34:06	MEDIUM	1
2026-06-18 16:11:54	CLEAN	0