python-minerva-git
LOW
maintainer Auerhuhn
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads source code from the project's official GitHub repository and a diagram from Google Docs; the latter is used as documentation and not executed, posing minimal risk despite the non-whitelisted host.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads source code from the project's official GitHub repository and a diagram from Google Docs; the latter is used as documentation and not executed, posing minimal risk despite the non-whitelisted host.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:33
"pipeline-diagram.png::https://docs.google.com/drawings/d/e/2PACX-1vTMkQc8ZJoiJ2AOeFGMkK0QTNx1hSG5wDrG5seLdJ3i61E4ag7wH7VFey44qhvuXotvOKxOw-mFS-VE/pub?w=850&h=761"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Claudia Pellegrino <aur ät cpellegrino.de>
2
3
pkgname=python-minerva-git
4
_gitpkgname=minerva
5
pkgver=r137.b9fb6d8
6
pkgrel=1
7
pkgdesc='32-bit RISC-V soft processor'
8
arch=('any')
9
url='https://github.com/minerva-cpu/minerva'
10
license=('BSD-3-Clause')
11
depends=(
12
'python'
13
'python-amaranth'
14
'python-amaranth-soc'
15
)
16
makedepends=(
17
'git'
18
'python-build'
19
'python-installer'
20
'python-pdm-backend'
21
'python-wheel'
22
)
23
checkdepends=(
24
'python-pdm'
25
'symbiyosys'
26
'yices'
27
)
28
provides=("python-minerva=${pkgver}")
29
conflicts=('python-minerva')
30
31
source=(
32
"${_gitpkgname}::git+https://github.com/minerva-cpu/minerva.git"
33
"pipeline-diagram.png::https://docs.google.com/drawings/d/e/2PACX-1vTMkQc8ZJoiJ2AOeFGMkK0QTNx1hSG5wDrG5seLdJ3i61E4ag7wH7VFey44qhvuXotvOKxOw-mFS-VE/pub?w=850&h=761"
34
)
35
36
sha512sums=(
37
'SKIP'
38
'SKIP'
39
)
40
41
pkgver() {
42
printf "r%s.%s" \
43
"$(git -C "${_gitpkgname}" rev-list --count HEAD)" \
44
"$(git -C "${_gitpkgname}" rev-parse --short HEAD)"
45
}
46
47
prepare() {
48
cd "${_gitpkgname}"
49
50
echo >&2 'Patching tests to use symbiyosys instead of yowasp-yosys'
51
sed -i -e 's/yowasp-sby/sby/' minerva/test/utils.py
52
53
echo >&2 'Adjusting image links'
54
sed -i -e 's/\(!\[Pipeline Diagram Image\]\)([^)]*)/\1(.\/pipeline-diagram.png)/' \
55
README.md
56
}
57
58
build() {
59
cd "${_gitpkgname}"
60
python -m build --wheel --no-isolation
61
}
62
63
check() {
64
cd "${_gitpkgname}"
65
PDM_USE_VENV=false SBY=sby YOSYS=yosys python -m unittest discover -v
66
}
67
68
package() {
69
cd "${_gitpkgname}"
70
71
echo >&2 'Packaging the wheel'
72
python -I -m installer --destdir="${pkgdir}" dist/*.whl
73
74
echo >&2 'Packaging the documentation'
75
install -D -m 644 -t "${pkgdir}/usr/share/doc/${pkgname}" \
76
README.md ../pipeline-diagram.png
77
78
echo >&2 'Packaging the license'
79
install -D -m 644 -t "${pkgdir}/usr/share/licenses/${pkgname}" \
80
LICENSE.txt
81
}
82
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |