python-marko

LOW

maintainer RubenKelevra 1 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

The package builds from a verifiable source tarball hosted on the project's official GitHub repository, with a valid b2sum; the orphaned/re-adopted status is administrative and does not imply code risk.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from a verifiable source tarball hosted on the project's official GitHub repository, with a valid b2sum; the orphaned/re-adopted status is administrative and does not imply code risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

      1# Maintainer: @RubenKelevra <rubenkelevra@gmail.com>
    
      2# Contributor: Joao Freitas <joaj.freitas@gmail.com>
    
      3
    
      4_pkgname='marko'
    
      5pkgname="python-${_pkgname}"
    
      6pkgver=2.2.4
    
      7pkgrel=1
    
      8pkgdesc='A markdown parser with high extensibility'
    
      9arch=('any')
    
      10url="https://github.com/frostming/${_pkgname}"
    
      11license=('MIT')
    
      12depends=('python>=3.9')
    
      13makedepends=(
    
      14	'python-build'
    
      15	'python-installer'
    
      16	'python-pdm-backend'
    
      17	'python-wheel'
    
      18)
    
      19checkdepends=(
    
      20	'python-pygments'
    
      21	'python-pytest'
    
      22	'python-slugify'
    
      23)
    
      24optdepends=(
    
      25	'python-objprint: enhanced AST representations'
    
      26	'python-pygments: syntax highlighting extension'
    
      27	'python-slugify: table-of-contents slug generation'
    
      28)
    
      29source=("${_pkgname}-${pkgver}.tar.gz::${url}/archive/refs/tags/v${pkgver}.tar.gz")
    
      30b2sums=('1ed0e525729cae387488355f8b2e03f9e9745441d65b9466a12a74b0ec99b922878f4c76089b4c1998946dcf7d7766a4908eb574eff14d50338659a3b8810a12')
    
      31
    
      32build() {
    
      33	cd -- "${_pkgname}-${pkgver}" || return 1
    
      34	python -m build --wheel --no-isolation
    
      35}
    
      36
    
      37check() {
    
      38	cd -- "${_pkgname}-${pkgver}" || return 1
    
      39	python -m pytest tests
    
      40}
    
      41
    
      42package() {
    
      43	cd -- "${_pkgname}-${pkgver}" || return 1
    
      44	python -m installer --destdir="${pkgdir}" --compile-bytecode 0 --compile-bytecode 2 dist/*.whl
    
      45	install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      46}
    
      47

Changes since previous scan

--- PKGBUILD @ 2026-10-11 00:26
+++ PKGBUILD @ 2026-10-17 00:21
@@ -1,27 +1,47 @@
-# Maintainer: Joao Freitas <joaj dot freitas at gmail dot com>
+# Maintainer: @RubenKelevra <rubenkelevra@gmail.com>
+# Contributor: Joao Freitas <joaj.freitas@gmail.com>
 
-pkgname=python-marko
-_name=${pkgname#python-}
-pkgver=2.1.4
+_pkgname='marko'
+pkgname="python-${_pkgname}"
+pkgver=2.2.4
 pkgrel=1
 pkgdesc='A markdown parser with high extensibility'
 arch=('any')
-url='https://pypi.org/project/marko'
+url="https://github.com/frostming/${_pkgname}"
 license=('MIT')
-depends=('python')
-optdepends=()
-makedepends=('python-build' 'python-pdm-backend')
-provides=('python-marko')
-source=("https://files.pythonhosted.org/packages/source/${_name::1}/${_name}/${_name}-${pkgver}.tar.gz")
-sha256sums=('dd7d66f3706732bf8f994790e674649a4fd0a6c67f16b80246f30de8e16a1eac')
+depends=('python>=3.9')
+makedepends=(
+	'python-build'
+	'python-installer'
+	'python-pdm-backend'
+	'python-wheel'
+)
+checkdepends=(
+	'python-pygments'
+	'python-pytest'
+	'python-slugify'
+)
+optdepends=(
+	'python-objprint: enhanced AST representations'
+	'python-pygments: syntax highlighting extension'
+	'python-slugify: table-of-contents slug generation'
+)
+source=("${_pkgname}-${pkgver}.tar.gz::${url}/archive/refs/tags/v${pkgver}.tar.gz")
+b2sums=('1ed0e525729cae387488355f8b2e03f9e9745441d65b9466a12a74b0ec99b922878f4c76089b4c1998946dcf7d7766a4908eb574eff14d50338659a3b8810a12')
 
 build() {
-    cd "$_name-$pkgver"
-    python -m build --wheel --no-isolation
+	cd -- "${_pkgname}-${pkgver}" || return 1
+	python -m build --wheel --no-isolation
+}
+
+check() {
+	cd -- "${_pkgname}-${pkgver}" || return 1
+	python -m pytest tests
 }
 
 package() {
-    cd "$_name-$pkgver"
-    python -m installer --destdir="$pkgdir" dist/*.whl
+	cd -- "${_pkgname}-${pkgver}" || return 1
+	python -m installer --destdir="${pkgdir}" --compile-bytecode 0 --compile-bytecode 2 dist/*.whl
+	install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
 }
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2
2026-10-13 00:23:45	Low	2
2026-10-12 17:14:20	Medium	1
2026-10-11 00:26:05	Clean	2
2026-10-11 00:16:25	Medium	1
2026-06-18 16:11:54	Clean	0