python-jsrun

maintainer Dominiquini · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package installs a prebuilt wheel from the project's own official GitHub release assets with verified sha256 checksums; the pip install is used only to unpack the local .whl file (--no-deps, --isolated) rather than fetching anything external, so there is no meaningful supply-chain risk beyond trusting the upstream project's own release infrastructure.

Triggered rules

LOW pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums. Severity reduced: python-* packages routinely use pip.

PKGBUILD:42 PIP_CONFIG_FILE=/dev/null pip install --isolated --root="${pkgdir}" --ignore-installed --no-warn-script-location --root-user-action ignore --no-deps *.whl

LOW AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is LOW (confidence 80%): The package installs a prebuilt wheel from the project's own official GitHub release assets with verified sha256 checksums; the pip install is used only to unpack the local .whl file (--no-deps, --isolated) rather than fetching anything external, so there is no meaningful supply-chain risk beyond trusting the upstream project's own release infrastructure.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Rafael Dominiquini <rafaeldominiquini at gmail dot com>
    
      2
    
      3_appauthor="imfing"
    
      4_appname="jsrun"
    
      5
    
      6pkgname="python-${_appname}"
    
      7pkgver=0.1.0
    
      8pkgrel=1
    
      9pkgdesc="Modern JavaScript runtime in Python, powered by V8 and bridged by Rust"
    
      10
    
      11_pypi_package=${pkgname##python-}
    
      12_pypi_version=${pkgver}
    
      13
    
      14license=('MIT')
    
      15
    
      16arch=('x86_64' 'aarch64')
    
      17_barch=('cp314-cp314-manylinux_2_28_x86_64' 'cp314-cp314-manylinux_2_28_aarch64')
    
      18
    
      19_url_pypi="https://pypi.org/project/${_pypi_package}/"
    
      20_url_github="https://github.com/${_appauthor}/${_appname}"
    
      21__url_github_raw="https://raw.githubusercontent.com/${_appauthor}/${_appname}"
    
      22url="${_url_github}"
    
      23
    
      24makedepends=('python-setuptools' 'python-wheel' 'python-build' 'python-installer' 'python-uv-build' 'python-maturin' 'python-hatchling')
    
      25depends=('glibc' 'libgcc' 'python')
    
      26
    
      27source=("README-${pkgver}.md::${__url_github_raw}/v${pkgver}/README.md"
    
      28		"LICENSE-${pkgver}::${__url_github_raw}/v${pkgver}/LICENSE")
    
      29source_x86_64=("${_url_github}/releases/download/v${pkgver}/${_appname}-${pkgver}-${_barch[0]}.whl")
    
      30source_aarch64=("${_url_github}/releases/download/v${pkgver}/${_appname}-${pkgver}-${_barch[1]}.whl")
    
      31sha256sums=('61ee6dcccc9f526585d7e8863ccdf0134889276afb04a8e824f6ecdaba594ddc'
    
      32            '010b9cc868c2bebbed7c50f88682d275bea3bda6e8e799a84aa9c7551db52491')
    
      33sha256sums_x86_64=('a524f336e1a21545e584586e48714400cbbe975ebb09960fae6290211bc3cce0')
    
      34sha256sums_aarch64=('a3f0299c6e38c043108e3ed6796195ac0bcb2a195671602c2f76f7914a4906c5')
    
      35
    
      36noextract=("${source_x86_64[@]##*/}" "${source_aarch64[@]##*/}")
    
      37
    
      38
    
      39package() {
    
      40	cd "${srcdir}/"
    
      41
    
      42	PIP_CONFIG_FILE=/dev/null pip install --isolated --root="${pkgdir}" --ignore-installed --no-warn-script-location --root-user-action ignore --no-deps *.whl
    
      43
    
      44	python -O -m compileall "${pkgdir}"
    
      45
    
      46	install -Dm644 "README-${pkgver}.md" "${pkgdir}/usr/share/doc/${pkgname}/README.md"
    
      47
    
      48	install -Dm644 "LICENSE-${pkgver}" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      49}
    
      50

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	3
2026-08-01 00:11:18	LOW	3
2026-07-31 00:14:10	LOW	3
2026-07-30 00:17:23	LOW	3
2026-07-29 00:25:53	LOW	3
2026-07-28 00:07:28	LOW	3
2026-07-27 00:24:32	LOW	3
2026-07-26 00:07:32	LOW	3
2026-07-25 00:13:44	LOW	3
2026-07-24 00:02:28	LOW	3
2026-07-23 00:14:47	LOW	3
2026-07-22 00:29:32	LOW	3
2026-07-21 00:24:15	LOW	3
2026-07-20 00:19:49	LOW	3
2026-07-19 19:14:27	LOW	3
2026-07-19 19:12:02	LOW	3