python-p4python
LOW
maintainer orphaned
0 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The package downloads source code from pythonhosted.org (standard PyPI host) and a Perforce API binary from perforce.com, both legitimate sources; the build uses official project sources and no unverified or executable payloads are run.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads source code from pythonhosted.org (standard PyPI host) and a Perforce API binary from perforce.com, both legitimate sources; the build uses official project sources and no unverified or executable payloads are run.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:15
'http://ftp.perforce.com/perforce/r18.1/bin.linux26x86_64/p4api.tgz')
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Adrian Bacircea <adrian.bacircea@gmail.com>
2
# Packager: Adrian Bacircea <adrian.bacircea@gmail.com>
3
# Contributor: Alex Whitt <alex.joseph.whitt@gmail.com>
4
5
_pkgsrcname=p4python
6
pkgname=python-p4python
7
pkgver=2018.2.1743033
8
p4apiver=2018.1.1957529
9
pkgrel=2
10
pkgdesc="Interface to Perforce API for Python 3"
11
url="https://www.perforce.com/perforce/doc.current/manuals/p4script/03_python.html"
12
arch=('any')
13
license=('custom')
14
source=($pkgname-$pkgver.tar.gz::"https://files.pythonhosted.org/packages/36/5a/0a1b192cdecd31cb8bc0d0ba39c73ffd84ce823053d0004823a1fdbe1440/p4python-2018.2.1743033.tar.gz"
15
'http://ftp.perforce.com/perforce/r18.1/bin.linux26x86_64/p4api.tgz')
16
sha256sums=('caa37ea520566f50181b042a474eb8012ff8dcbcc0512874170ad34bea1ba0c0'
17
'331fad2257e4c427e1f864032f8125821865f2ecad3c643574cf4157f9ca7295')
18
makedepends=('python-setuptools')
19
depends=('openssl-1.0' 'python')
20
21
prepare() {
22
# Clean up if needed
23
rm -rf python-$_pkgsrcname-$pkgver
24
25
sed -i 's/OpenSSL (\\d)\\.(\\d)\\.(\\d)(\\S+)\\s+\\d+ \\S+ \\d+/OpenSSL (\\d)\\.(\\d)\\.(\\d)(.*)/g' \
26
${_pkgsrcname}-${pkgver}/setup.py
27
sed -i 's/pattern.match(version_string)/pattern.search(version_string)/g' \
28
${_pkgsrcname}-${pkgver}/setup.py
29
30
# Copy folder, so we can cleanly build for both python versions
31
mv $_pkgsrcname-$pkgver python-$_pkgsrcname-$pkgver
32
33
cd ${srcdir}
34
tar -xf p4api.tgz
35
}
36
37
build() {
38
cd python-$_pkgsrcname-$pkgver
39
python setup.py build \
40
--ssl '/usr/lib/openssl-1.0' \
41
--apidir ${srcdir}/p4api-${p4apiver}
42
}
43
44
package() {
45
cd $srcdir/python-$_pkgsrcname-$pkgver
46
47
python setup.py install --root="$pkgdir/" --skip-build --optimize=1 \
48
--apidir ${srcdir}/p4api-${p4apiver}
49
install -Dm644 LICENSE.txt $pkgdir/usr/share/licenses/$pkgname/LICENSE
50
}
51
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 00:13:55 | Low | 2 |
| 2026-10-28 00:06:54 | Low | 2 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |
| 2026-10-14 00:06:47 | Low | 2 |
| 2026-10-13 00:23:45 | Low | 2 |