python-minerva-amaranth0.4
maintainer orphaned
· 0 votes
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The non-standard host is only used to download a documentation image (pipeline-diagram.png), which is not executable and poses no code execution risk; the actual code comes from a trusted GitHub repository referenced via git.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The non-standard host is only used to download a documentation image (pipeline-diagram.png), which is not executable and poses no code execution risk; the actual code comes from a trusted GitHub repository referenced via git.
1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:33
"pipeline-diagram.png::https://docs.google.com/drawings/d/e/2PACX-1vTMkQc8ZJoiJ2AOeFGMkK0QTNx1hSG5wDrG5seLdJ3i61E4ag7wH7VFey44qhvuXotvOKxOw-mFS-VE/pub?w=850&h=761"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Claudia Pellegrino <aur ät cpellegrino.de>
2
3
pkgname=python-minerva-amaranth0.4
4
_gitpkgname=minerva
5
_commit=5bac31a40b6d8098ba2f4b7c4906ca667b6155f7
6
pkgver=r128.5bac31a
7
pkgrel=1
8
pkgdesc='32-bit RISC-V soft processor'
9
arch=('any')
10
url='https://github.com/minerva-cpu/minerva'
11
license=('BSD-3-Clause')
12
depends=(
13
'python'
14
'python-amaranth<0.5'
15
'python-jtagtap-git'
16
)
17
makedepends=(
18
'git'
19
'python-build'
20
'python-installer'
21
'python-pdm-backend'
22
'python-wheel'
23
)
24
checkdepends=(
25
'symbiyosys'
26
'yices'
27
)
28
provides=("python-minerva=${pkgver}")
29
conflicts=('python-minerva')
30
31
source=(
32
"${_gitpkgname}::git+https://github.com/minerva-cpu/minerva.git#commit=${_commit}"
33
"pipeline-diagram.png::https://docs.google.com/drawings/d/e/2PACX-1vTMkQc8ZJoiJ2AOeFGMkK0QTNx1hSG5wDrG5seLdJ3i61E4ag7wH7VFey44qhvuXotvOKxOw-mFS-VE/pub?w=850&h=761"
34
)
35
36
sha512sums=(
37
'2815e497c0e594ff94e1831e9086bd51f03c87f9e88a9daafcbc7dd6b9cf7e8e095c56aae7a76fab28f86182af70708c751a2d0e9a3d20bb16f022b3cc22ddcc'
38
'SKIP'
39
)
40
41
pkgver() {
42
printf "r%s.%s" \
43
"$(git -C "${_gitpkgname}" rev-list --count HEAD)" \
44
"$(git -C "${_gitpkgname}" rev-parse --short HEAD)"
45
}
46
47
prepare() {
48
cd "${_gitpkgname}"
49
50
echo >&2 'Adjusting image links'
51
sed -i -e 's/\(!\[Pipeline Diagram Image\]\)([^)]*)/\1(.\/pipeline-diagram.png)/' \
52
README.md
53
}
54
55
build() {
56
cd "${_gitpkgname}"
57
python -m build --wheel --no-isolation
58
}
59
60
check() {
61
cd "${_gitpkgname}"
62
python -m unittest discover -v
63
}
64
65
package() {
66
cd "${_gitpkgname}"
67
68
echo >&2 'Packaging the wheel'
69
python -I -m installer --destdir="${pkgdir}" dist/*.whl
70
71
echo >&2 'Packaging the documentation'
72
install -D -m 644 -t "${pkgdir}/usr/share/doc/${pkgname}" \
73
README.md ../pipeline-diagram.png
74
75
echo >&2 'Packaging the license'
76
install -D -m 644 -t "${pkgdir}/usr/share/licenses/${pkgname}" \
77
LICENSE.txt
78
}
79
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 2 |
| 2026-08-02 00:16:08 | LOW | 2 |
| 2026-08-01 00:11:18 | LOW | 2 |
| 2026-07-31 00:14:10 | LOW | 2 |
| 2026-07-30 00:17:23 | LOW | 2 |
| 2026-07-29 00:25:53 | LOW | 2 |
| 2026-07-28 00:07:28 | LOW | 2 |
| 2026-07-27 00:24:32 | LOW | 2 |
| 2026-07-26 00:07:32 | LOW | 2 |
| 2026-07-25 00:13:44 | LOW | 2 |
| 2026-07-24 00:02:28 | LOW | 2 |
| 2026-07-23 00:14:47 | LOW | 2 |
| 2026-07-22 00:29:32 | LOW | 2 |
| 2026-07-21 00:24:15 | LOW | 2 |
| 2026-07-20 00:19:49 | LOW | 2 |
| 2026-07-19 00:17:08 | LOW | 2 |
| 2026-07-18 00:14:48 | LOW | 2 |
| 2026-07-17 00:06:16 | LOW | 2 |
| 2026-07-16 00:05:41 | LOW | 2 |
| 2026-07-15 00:09:25 | LOW | 2 |