python-minerva-git
LOW
maintainer Auerhuhn
0 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The package downloads source code from the project's official GitHub repository and a diagram from Google Docs; the latter is used as documentation and not executed, posing minimal risk despite the non-whitelisted host.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads source code from the project's official GitHub repository and a diagram from Google Docs; the latter is used as documentation and not executed, posing minimal risk despite the non-whitelisted host.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:33
"pipeline-diagram.png::https://docs.google.com/drawings/d/e/2PACX-1vTMkQc8ZJoiJ2AOeFGMkK0QTNx1hSG5wDrG5seLdJ3i61E4ag7wH7VFey44qhvuXotvOKxOw-mFS-VE/pub?w=850&h=761"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Claudia Pellegrino <aur ät cpellegrino.de>
2
3
pkgname=python-minerva-git
4
_gitpkgname=minerva
5
pkgver=r137.b9fb6d8
6
pkgrel=1
7
pkgdesc='32-bit RISC-V soft processor'
8
arch=('any')
9
url='https://github.com/minerva-cpu/minerva'
10
license=('BSD-3-Clause')
11
depends=(
12
'python'
13
'python-amaranth'
14
'python-amaranth-soc'
15
)
16
makedepends=(
17
'git'
18
'python-build'
19
'python-installer'
20
'python-pdm-backend'
21
'python-wheel'
22
)
23
checkdepends=(
24
'python-pdm'
25
'symbiyosys'
26
'yices'
27
)
28
provides=("python-minerva=${pkgver}")
29
conflicts=('python-minerva')
30
31
source=(
32
"${_gitpkgname}::git+https://github.com/minerva-cpu/minerva.git"
33
"pipeline-diagram.png::https://docs.google.com/drawings/d/e/2PACX-1vTMkQc8ZJoiJ2AOeFGMkK0QTNx1hSG5wDrG5seLdJ3i61E4ag7wH7VFey44qhvuXotvOKxOw-mFS-VE/pub?w=850&h=761"
34
)
35
36
sha512sums=(
37
'SKIP'
38
'SKIP'
39
)
40
41
pkgver() {
42
printf "r%s.%s" \
43
"$(git -C "${_gitpkgname}" rev-list --count HEAD)" \
44
"$(git -C "${_gitpkgname}" rev-parse --short HEAD)"
45
}
46
47
prepare() {
48
cd "${_gitpkgname}"
49
50
echo >&2 'Patching tests to use symbiyosys instead of yowasp-yosys'
51
sed -i -e 's/yowasp-sby/sby/' minerva/test/utils.py
52
53
echo >&2 'Adjusting image links'
54
sed -i -e 's/\(!\[Pipeline Diagram Image\]\)([^)]*)/\1(.\/pipeline-diagram.png)/' \
55
README.md
56
}
57
58
build() {
59
cd "${_gitpkgname}"
60
python -m build --wheel --no-isolation
61
}
62
63
check() {
64
cd "${_gitpkgname}"
65
PDM_USE_VENV=false SBY=sby YOSYS=yosys python -m unittest discover -v
66
}
67
68
package() {
69
cd "${_gitpkgname}"
70
71
echo >&2 'Packaging the wheel'
72
python -I -m installer --destdir="${pkgdir}" dist/*.whl
73
74
echo >&2 'Packaging the documentation'
75
install -D -m 644 -t "${pkgdir}/usr/share/doc/${pkgname}" \
76
README.md ../pipeline-diagram.png
77
78
echo >&2 'Packaging the license'
79
install -D -m 644 -t "${pkgdir}/usr/share/licenses/${pkgname}" \
80
LICENSE.txt
81
}
82
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 00:13:55 | Low | 2 |
| 2026-10-28 00:06:54 | Low | 2 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |
| 2026-10-14 00:06:47 | Low | 2 |
| 2026-10-13 00:23:45 | Low | 2 |