python-nipy

maintainer hottea · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads data files from the project's own domain (nipy.org) for building; these are non-executable data assets, not prebuilt binaries, and the source is plausibly official, so the risk is low despite the non-whitelisted host.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads data files from the project's own domain (nipy.org) for building; these are non-executable data assets, not prebuilt binaries, and the source is plausibly official, so the risk is low despite the non-whitelisted host.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:32 'http://nipy.org/data-packages/nipy-templates-0.3.tar.gz'

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Butui Hu <hot123tea123@gmail.com>
    
      2
    
      3_pkgname=nipy
    
      4pkgname=python-nipy
    
      5pkgver=0.6.1
    
      6pkgrel=3
    
      7pkgdesc='Neuroimaging in Python FMRI analysis package'
    
      8arch=('x86_64')
    
      9url='http://nipy.org/nipy'
    
      10license=('BSD-3-Clause')
    
      11depends=(
    
      12  openblas
    
      13  python-nibabel
    
      14  python-numpy
    
      15  python-scipy
    
      16  python-sympy
    
      17  python-transforms3d
    
      18)
    
      19makedepends=(
    
      20  cmake
    
      21  cython
    
      22  git
    
      23  meson-python
    
      24  python-build
    
      25  python-installer
    
      26  python-setuptools
    
      27  python-wheel
    
      28)
    
      29# data files from https://nipy.org/data-packages/
    
      30source=(
    
      31  "https://github.com/nipy/nipy/pull/589.patch"
    
      32  'http://nipy.org/data-packages/nipy-templates-0.3.tar.gz'
    
      33  'http://nipy.org/data-packages/nipy-data-0.3.tar.gz'
    
      34  "${_pkgname}-${pkgver}::git+https://github.com/nipy/nipy.git")
    
      35sha512sums=('e01b353a6535e4f5fb4c968aad8e2f7c6111c8323f41d129645af51780307a4c2991afe52f9975f8791412736762e59ee65a9924d2218ff34ff5cc53c84e6254'
    
      36            '3af927b8dde0b10ca45899016bce5e4f5b25ef285b2339a63346bfbfa99cc1a0e2f0728336c3ac7e32d4c05375f36fdfa7cf97cdfd26b42834cb3cb631d593b9'
    
      37            'ea8ed3537fb00596c16fa8b3464a2da54845ce9782e7bb40eb1157eb94de53892dda99bb4f22a829493cd59cfb47551f39de7641bf65a33678e97e5a4974de1a'
    
      38            'SKIP')
    
      39
    
      40prepare() {
    
      41  # we don't use ninja from PyPI to build the package
    
      42  sed -i "/ninja/d" "${srcdir}/${_pkgname}-${pkgver}/pyproject.toml"
    
      43  patch -d "${srcdir}/${_pkgname}-${pkgver}" -p1 -i "${srcdir}/589.patch"
    
      44}
    
      45
    
      46build() {
    
      47  cd "${srcdir}/${_pkgname}-${pkgver}"
    
      48  python -m build --wheel --no-isolation
    
      49
    
      50  cd "${srcdir}/nipy-data-0.3"
    
      51  python -m build --wheel --no-isolation
    
      52
    
      53  cd "${srcdir}/nipy-templates-0.3"
    
      54  python -m build --wheel --no-isolation
    
      55}
    
      56
    
      57package() {
    
      58  cd "${srcdir}/${_pkgname}-${pkgver}"
    
      59  python -m installer --destdir="${pkgdir}" dist/*.whl
    
      60  install -Dm644 LICENSE -t "${pkgdir}/usr/share/licenses/${pkgname}"
    
      61  
    
      62  cd "${srcdir}/nipy-data-0.3"
    
      63  python -m installer --destdir="${pkgdir}" dist/*.whl
    
      64  
    
      65  cd "${srcdir}/nipy-templates-0.3"
    
      66  python -m installer --destdir="${pkgdir}" dist/*.whl
    
      67}
    
      68# vim:set ts=2 sw=2 et:
    
      69

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2