python-lockmgr

LOW

maintainer GeneArch 0 votes scanned 2026-09-10 00:22:44.768965

View on AUR

Why flagged

The package builds from a git tag on GitHub with a SKIP'd checksum but no untrusted remote code execution; source is from the maintainer's plausible project repository, and it is pure Python code for local installation.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from a git tag on GitHub with a SKIP'd checksum but no untrusted remote code execution; source is from the maintainer's plausible project repository, and it is pure Python code for local installation.

PKGBUILD

      1#
    
      2# Arch Linux PKGBUILD for lockmgr 
    
      3# This builds the latest release tag.
    
      4# git HEAD is also well tested.
    
      5#
    
      6# Maintainer: Gene C <arch@sapience.com>
    
      7# Contributor: 
    
      8# 
    
      9pkgname='python-lockmgr'
    
      10pkgdesc='Python Lock Manager Class'
    
      11_gitname='lockmgr'
    
      12
    
      13pkgver="2.0.0"
    
      14pkgrel=1
    
      15url="https://github.com/gene-git/lockmgr"
    
      16
    
      17provides=(lockmgr=$pkgver)
    
      18conflicts=(lockmgr)
    
      19replaces=(lockmgr)
    
      20
    
      21
    
      22arch=(any)
    
      23license=(GPL-2.0-or-later)
    
      24
    
      25# To build docs uncommont sphinx/texlive
    
      26depends=(
    
      27    'python>3.14' 
    
      28    'python-pynotify'
    
      29)
    
      30makedepends=(
    
      31    'git'
    
      32    'meson'
    
      33    'meson-python'
    
      34    'rsync' 
    
      35)
    
      36# Used by package : mkpkg
    
      37_mkpkg_depends=(
    
      38    'python>minor'
    
      39    'python-pynotify>minor'
    
      40)
    
      41
    
      42
    
      43#
    
      44# Verifying Signed Tag
    
      45#   Add arch@sapience.com key to keyring then use the source line with "?signed"
    
      46#   Key available via keys/pgp, WKD or dowload from https://www.sapience.com/tech
    
      47#   Note that upstream release procedure requires every tagged release have new tag
    
      48#
    
      49validpgpkeys=( '7CCA1BA66669F3273DB52678E5B81343AB9809E1')   # Gene C
    
      50
    
      51#source=("git+https://github.com/gene-git/${_gitname}#tag=${pkgver}?signed")
    
      52source=("git+https://github.com/gene-git/${_gitname}#tag=${pkgver}")
    
      53sha512sums=('SKIP')
    
      54
    
      55build() {
    
      56    cd "${_gitname}"
    
      57
    
      58    echo "------------------"
    
      59    echo "  building"
    
      60    echo "------------------"
    
      61    ./scripts/do-build
    
      62}
    
      63
    
      64check() {
    
      65    cd "${_gitname}"
    
      66    echo "------------------"
    
      67    echo "  tests"
    
      68    echo "------------------"
    
      69    ./scripts/run-tests
    
      70}
    
      71
    
      72package() {
    
      73    cd "${_gitname}"
    
      74    echo "------------------"
    
      75    echo "  packaging"
    
      76    echo "------------------"
    
      77
    
      78    ./scripts/do-install ${pkgdir}
    
      79}
    
      80

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-10 00:22:44	Low	2
2026-09-09 23:20:11	Low	2