python-nkeys

CLEAN

maintainer Smoolak 0 votes scanned 2026-09-21 00:26:32.109917

View on AUR

Triggered rules

Clean AI review downgraded a static finding llm_review

The static rules flagged this LOW, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it CLEAN (confidence 95%): The package builds from a verifiable source tarball hosted on the project's official GitHub repository, uses a valid checksum, and runs standard build and test procedures without executing untrusted remote code or introducing supply-chain risks.

1 higher static finding superseded - not the current verdict (shown for transparency)

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

PKGBUILD

      1# Maintainer: Smoolak <smoolak@gmail.com>
    
      2
    
      3pkgname=python-nkeys
    
      4_pkgname=nkeys.py
    
      5pkgver=0.2.1
    
      6pkgrel=1
    
      7pkgdesc="Public-key signature system based on Ed25519 for the NATS ecosystem"
    
      8arch=('any')
    
      9url="https://github.com/nats-io/nkeys.py"
    
      10license=('Apache-2.0')
    
      11depends=(
    
      12    'python>=3.6'
    
      13    'python-pynacl'
    
      14)
    
      15makedepends=(
    
      16    'python-build'
    
      17    'python-installer'
    
      18    'python-setuptools>=68'
    
      19    'python-wheel'
    
      20)
    
      21_archive="$_pkgname-$pkgver"
    
      22source=("$pkgname-$pkgver.tar.gz::$url/archive/refs/tags/v$pkgver.tar.gz")
    
      23sha256sums=('1586d7bd60a89f5b5613c6426361d9550add92a6d7475b95de1729a6ca9ddc8c')
    
      24
    
      25build() {
    
      26    cd "$_archive"
    
      27    python -m build --wheel --no-isolation
    
      28}
    
      29
    
      30check() {
    
      31    cd "$_archive"
    
      32
    
      33    local _checkroot="$srcdir/_check"
    
      34    local _site
    
      35    rm -rf "$_checkroot"
    
      36    python -m installer --destdir="$_checkroot" dist/*.whl
    
      37    _site=$(python -c 'import site; print(site.getsitepackages()[0])')
    
      38
    
      39    # Run the complete upstream unittest suite against the built wheel.
    
      40    cd "$srcdir"
    
      41    PYTHONPATH="$_checkroot$_site" \
    
      42        python -m unittest discover -v -s "$_archive/tests" -p '*_test.py'
    
      43
    
      44    # Exercise the principal key lifecycle: decode, sign, verify and wipe.
    
      45    PYTHONPATH="$_checkroot$_site" python - <<'PY'
    
      46import nkeys
    
      47
    
      48seed = bytearray(b"SUAMLK2ZNL35WSMW37E7UD4VZ7ELPKW7DHC3BWBSD2GCZ7IUQQXZIORRBU")
    
      49key_pair = nkeys.from_seed(seed)
    
      50payload = b"private-nats-challenge"
    
      51signature = key_pair.sign(payload)
    
      52assert key_pair.verify(payload, signature) is True
    
      53assert key_pair.public_key == b"UCK5N7N66OBOINFXAYC2ACJQYFSOD4VYNU6APEJTAVFZB2SVHLKGEW7L"
    
      54try:
    
      55    key_pair.verify(payload + b"-tampered", signature)
    
      56except nkeys.ErrInvalidSignature:
    
      57    pass
    
      58else:
    
      59    raise AssertionError("tampered payload unexpectedly verified")
    
      60key_pair.wipe()
    
      61PY
    
      62}
    
      63
    
      64package() {
    
      65    cd "$_archive"
    
      66    python -m installer --destdir="$pkgdir" dist/*.whl
    
      67    install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      68}
    
      69

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-21 00:26:32	Clean	2
2026-09-20 23:33:19	Low	1