python-jsrun

LOW

maintainer Dominiquini 1 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package installs a prebuilt wheel from the project's own official GitHub release assets with verified sha256 checksums; the pip install is used only to unpack the local .whl file (--no-deps, --isolated) rather than fetching anything external, so there is no meaningful supply-chain risk beyond trusting the upstream project's own release infrastructure.

Triggered rules

Low pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums. Severity reduced: python-* packages routinely use pip.

PKGBUILD:42 PIP_CONFIG_FILE=/dev/null pip install --isolated --root="${pkgdir}" --ignore-installed --no-warn-script-location --root-user-action ignore --no-deps *.whl

Low AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is LOW (confidence 80%): The package installs a prebuilt wheel from the project's own official GitHub release assets with verified sha256 checksums; the pip install is used only to unpack the local .whl file (--no-deps, --isolated) rather than fetching anything external, so there is no meaningful supply-chain risk beyond trusting the upstream project's own release infrastructure.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Rafael Dominiquini <rafaeldominiquini at gmail dot com>
    
      2
    
      3_appauthor="imfing"
    
      4_appname="jsrun"
    
      5
    
      6pkgname="python-${_appname}"
    
      7pkgver=0.1.0
    
      8pkgrel=1
    
      9pkgdesc="Modern JavaScript runtime in Python, powered by V8 and bridged by Rust"
    
      10
    
      11_pypi_package=${pkgname##python-}
    
      12_pypi_version=${pkgver}
    
      13
    
      14license=('MIT')
    
      15
    
      16arch=('x86_64' 'aarch64')
    
      17_barch=('cp314-cp314-manylinux_2_28_x86_64' 'cp314-cp314-manylinux_2_28_aarch64')
    
      18
    
      19_url_pypi="https://pypi.org/project/${_pypi_package}/"
    
      20_url_github="https://github.com/${_appauthor}/${_appname}"
    
      21__url_github_raw="https://raw.githubusercontent.com/${_appauthor}/${_appname}"
    
      22url="${_url_github}"
    
      23
    
      24makedepends=('python-setuptools' 'python-wheel' 'python-build' 'python-installer' 'python-uv-build' 'python-maturin' 'python-hatchling')
    
      25depends=('glibc' 'libgcc' 'python')
    
      26
    
      27source=("README-${pkgver}.md::${__url_github_raw}/v${pkgver}/README.md"
    
      28		"LICENSE-${pkgver}::${__url_github_raw}/v${pkgver}/LICENSE")
    
      29source_x86_64=("${_url_github}/releases/download/v${pkgver}/${_appname}-${pkgver}-${_barch[0]}.whl")
    
      30source_aarch64=("${_url_github}/releases/download/v${pkgver}/${_appname}-${pkgver}-${_barch[1]}.whl")
    
      31sha256sums=('61ee6dcccc9f526585d7e8863ccdf0134889276afb04a8e824f6ecdaba594ddc'
    
      32            '010b9cc868c2bebbed7c50f88682d275bea3bda6e8e799a84aa9c7551db52491')
    
      33sha256sums_x86_64=('a524f336e1a21545e584586e48714400cbbe975ebb09960fae6290211bc3cce0')
    
      34sha256sums_aarch64=('a3f0299c6e38c043108e3ed6796195ac0bcb2a195671602c2f76f7914a4906c5')
    
      35
    
      36noextract=("${source_x86_64[@]##*/}" "${source_aarch64[@]##*/}")
    
      37
    
      38
    
      39package() {
    
      40	cd "${srcdir}/"
    
      41
    
      42	PIP_CONFIG_FILE=/dev/null pip install --isolated --root="${pkgdir}" --ignore-installed --no-warn-script-location --root-user-action ignore --no-deps *.whl
    
      43
    
      44	python -O -m compileall "${pkgdir}"
    
      45
    
      46	install -Dm644 "README-${pkgver}.md" "${pkgdir}/usr/share/doc/${pkgname}/README.md"
    
      47
    
      48	install -Dm644 "LICENSE-${pkgver}" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      49}
    
      50

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2