python-meshcore-git
LOW
maintainer dreieck
1 votes
scanned 2026-10-20 00:10:31.152894
Why flagged
The source is a git repository from GitHub, a standard and trusted host, even though referenced via a variable; the package builds from source and installs only Python wheel artifacts and documentation, posing minimal risk.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a git repository from GitHub, a standard and trusted host, even though referenced via a variable; the package builds from source and installs only Python wheel artifacts and documentation, posing minimal risk.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:57
"${_pkgname}::git+https://${_githost}/${_gituser}/${_pyname}.git"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: dreieck (https://aur.archlinux.org/account/dreieck)
2
3
_pyname="meshcore_py"
4
_pkgname="python-meshcore"
5
pkgname="${_pkgname}-git"
6
pkgver=2.3.14.r424.20260919.b32d820
7
pkgrel=2
8
pkgdesc="Python library for interacting with MeshCore companion radio nodes."
9
groups=("meshcore")
10
arch=(
11
'any'
12
)
13
_githost='github.com'
14
# _gituser='fdlamotte'
15
_gituser='meshcore-dev'
16
url="https://${_githost}/${_gituser}/${_pyname}"
17
license=("MIT")
18
depends=(
19
'python>=3.10'
20
'python-bleak'
21
'python-pyserial-asyncio-fast'
22
'python-pycayennelpp'
23
'python-pycryptodome'
24
)
25
makedepends=(
26
'git'
27
'python-build'
28
'python-hatchling'
29
'python-installer'
30
'python-setuptools>=61.0.0'
31
'python-wheel'
32
)
33
optdepends=(
34
"python-cryptography: For example script '/usr/share/doc/python-meshcore/examples/ble_sign_example.py'."
35
"python-ollama: For example script '/usr/share/doc/python-meshcore/examples/serial_meshcore_ollama.py'."
36
"python-pytest: To run tests ('/usr/share/doc/python-meshcore/tests/')."
37
"python-pytest-asyncio: To run tests ('/usr/share/doc/python-meshcore/tests/')."
38
)
39
### Do not run 'check()' since it requires a connection to a MeshCore device.
40
# checkdepends=(
41
# 'python-pytest'
42
# 'python-pytest-asyncio'
43
# # 'python-black'
44
# # 'python-ruff'
45
# )
46
provides=(
47
"${_pkgname}=${pkgver}"
48
"python-meshcore_py=${pkgver}"
49
"python-meshcore_py-git=${pkgver}"
50
)
51
conflicts=(
52
"${_pkgname}"
53
"python-meshcore_py"
54
)
55
56
source=(
57
"${_pkgname}::git+https://${_githost}/${_gituser}/${_pyname}.git"
58
)
59
sha256sums=(
60
'SKIP'
61
)
62
63
prepare() {
64
cd "${srcdir}/${_pkgname}"
65
66
git log > "${srcdir}/git.log"
67
}
68
69
pkgver() {
70
cd "${srcdir}/${_pkgname}"
71
72
_ver="$(git describe --tags | sed -E -e 's|^companion-||' -e 's|^[vV]||' -e 's|\-g[0-9a-f]*$||' | tr '-' '+')"
73
_rev="$(git rev-list --count HEAD)"
74
_date="$(git log -1 --date=format:"%Y%m%d" --format="%ad")"
75
_hash="$(git rev-parse --short HEAD)"
76
77
if [ -z "${_ver}" ]; then
78
error "Version could not be determined."
79
return 1
80
else
81
printf '%s' "${_ver}.r${_rev}.${_date}.${_hash}"
82
fi
83
}
84
85
build() {
86
cd "${srcdir}/${_pkgname}"
87
printf '%s\n' " --> building ..."
88
python -m build --wheel --no-isolation
89
}
90
91
### Do not run 'check()' since it requires a connection to a MeshCore device.
92
# check() {
93
# cd "${srcdir}/${_pkgname}"
94
#
95
# pytest
96
# }
97
98
package() {
99
cd "${srcdir}/${_pkgname}"
100
printf '%s\n' " --> installing ..."
101
python -m installer --destdir="$pkgdir" --compile-bytecode=2 dist/*.whl
102
103
_docfiles=(
104
"${srcdir}/git.log"
105
README.md
106
)
107
_docdirs=(
108
examples
109
tests
110
)
111
_manfiles=()
112
_infofiles=()
113
_licensefiles=(
114
LICENSE
115
)
116
printf '%s\n' " --> installing documentation ..."
117
for _docfile in "${_docfiles[@]}"; do
118
install -D -v -m644 "${_docfile}" "${pkgdir}/usr/share/doc/${_pkgname}/$(basename "${_docfile}")"
119
done
120
for _docdir in "${_docdirs[@]}"; do
121
cp -rv "${_docdir}" "${pkgdir}/usr/share/doc/${_pkgname}/$(basename "${_docdir}")"
122
done
123
for _manfile in "${_manfiles[@]}"; do
124
_section="$(basename "${_manfile}" .gz | sed -E -e 's|^.*\.([^.]*)$|\1|')"
125
install -D -v -m644 "docs/build/man/${_manfile}" "${pkgdir}/usr/share/man/man${_section}/$(basename "${_manfile}")"
126
done
127
for _infofile in "${_infofiles[@]}"; do
128
install -D -v -m644 "${_infofile}" "${pkgdir}/usr/share/info/$(basename "${_infofile}")"
129
done
130
printf '%s\n' " --> installing license ..."
131
for _licensefile in "${_licensefiles[@]}"; do
132
install -D -v -m644 "${_licensefile[@]}" "${pkgdir}/usr/share/licenses/${pkgname}/$(basename "${_licensefile}")"
133
ln -svr "${pkgdir}/usr/share/licenses/${pkgname}/$(basename "${_licensefile}")" "${pkgdir}/usr/share/doc/${_pkgname}/$(basename "${_licensefile}")"
134
done
135
}
136
137
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |
| 2026-10-14 00:06:47 | Low | 2 |
| 2026-10-13 00:23:45 | Low | 2 |
| 2026-10-12 00:18:51 | Low | 2 |
| 2026-10-11 00:26:05 | Low | 2 |
| 2026-10-10 00:11:52 | Low | 2 |
| 2026-10-09 00:05:33 | Low | 2 |
| 2026-10-08 00:28:03 | Low | 2 |
| 2026-10-07 00:21:34 | Low | 2 |
| 2026-10-06 00:13:36 | Low | 2 |
| 2026-10-05 00:08:03 | Low | 2 |
| 2026-10-04 00:18:08 | Low | 2 |
| 2026-10-03 00:23:04 | Low | 2 |
| 2026-10-02 00:00:32 | Low | 2 |
| 2026-10-01 00:02:06 | Low | 2 |