python-openfermionprojectq

maintainer orphaned · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The pip install in check() is used to temporarily install a dependency for testing from PyPI, which is a standard practice; it does not execute untrusted code or install malicious packages.

Triggered rules

LOW pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums. Severity reduced: python-* packages routinely use pip.

PKGBUILD:46 PYTHONUSERBASE=$PWD/tmp python3 -m pip install projectq > /dev/null

LOW AI review llm_review

An AI model (qwen/qwen3-235b-a22b-07-25) reviewed this and agrees it is LOW (confidence 95%): The pip install in check() is used to temporarily install a dependency for testing from PyPI, which is a standard practice; it does not execute untrusted code or install malicious packages.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Damien Nguyen <damien1@huawei.com>
    
      2
    
      3_name=openfermionprojectq
    
      4pkgbase=python-${_name}
    
      5pkgname=(${pkgbase} python-${_name}-hiq)
    
      6
    
      7pkgver=0.2
    
      8pkgrel=2
    
      9pkgdesc="A plugin allowing OpenFermion to interaface with ProjectQ."
    
      10arch=('any')
    
      11url="https://github.com/quantumlib/OpenFermion-ProjectQ/"
    
      12license=('Apache')
    
      13makedepends=('python-pip'
    
      14	     'python-setuptools')
    
      15checkdepends=(# AUR dependencies
    
      16              'python-openfermion-0.11'
    
      17	      'python-h5py'
    
      18	      'jupyter-nbformat')
    
      19source=("https://files.pythonhosted.org/packages/source/${_name::1}/$_name/$_name-$pkgver.tar.gz"
    
      20	"fix-failing-test.patch"
    
      21	"openfermion-0.11.0.patch")
    
      22sha256sums=('bbaf9d2906a2f5893fa4ea49ce16a3dad640063ec365b21c8970bc88216820fd'
    
      23            '56753a2b5237e7e6194bb964dba6a17350828b6321078cc3a217a2bac59d06ef'
    
      24            'b20875b96e7eaed9db2871986043677fa8243c3dad6e10fb4302a03c22dace38')
    
      25
    
      26prepare() {
    
      27  cd "$srcdir/$_name-$pkgver"
    
      28  patch -p1 -i "$srcdir/fix-failing-test.patch"
    
      29  patch -p1 -i "$srcdir/openfermion-0.11.0.patch"
    
      30}
    
      31
    
      32build() {
    
      33  cd "$srcdir/$_name-$pkgver"
    
      34  python setup.py build
    
      35}
    
      36
    
      37check() {
    
      38  cd "$srcdir/$_name-$pkgver"
    
      39
    
      40  # Not adding either python-projectq or python-hiq-projectq to makedepends as
    
      41  # they conflitct one another.
    
      42  # However, make sure that we have at least one of them installed in order to
    
      43  # run the tests
    
      44  if ! python -c 'import projectq' 2> /dev/null ; then
    
      45    echo "Installing ProjectQ to temporary folder"
    
      46    PYTHONUSERBASE=$PWD/tmp python3 -m pip install projectq > /dev/null
    
      47  fi
    
      48
    
      49  PYTHONUSERBASE=$PWD/tmp python -m pytest --color=yes -x
    
      50
    
      51  rm -rf tmp
    
      52}
    
      53
    
      54package_python-openfermionprojectq() {
    
      55  conflicts=('python-openfermionprojectq-hiq')
    
      56  depends+=('python-openfermion-0.11'
    
      57	    'python-projectq')
    
      58  cd "$srcdir/$_name-$pkgver"
    
      59  python setup.py install --root="$pkgdir" --optimize=1 --skip-build
    
      60}
    
      61
    
      62package_python-openfermionprojectq-hiq() {
    
      63  pkgdesc="A plugin allowing OpenFermion to interaface with HiQ-ProjectQ."
    
      64  conflicts=('python-openfermionprojectq')
    
      65  groups=(python-hiq)
    
      66  depends+=('python-openfermion-0.11'
    
      67	    'python-hiq-projectq')
    
      68  cd "$srcdir/$_name-$pkgver"
    
      69  python setup.py install --root="$pkgdir" --optimize=1 --skip-build
    
      70}
    
      71
    
      72# vim:set ts=2 sw=2 et:
    
      73

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2