python-p4python
LOW
maintainer orphaned
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads source code from pythonhosted.org (standard PyPI host) and a Perforce API binary from perforce.com, both legitimate sources; the build uses official project sources and no unverified or executable payloads are run.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads source code from pythonhosted.org (standard PyPI host) and a Perforce API binary from perforce.com, both legitimate sources; the build uses official project sources and no unverified or executable payloads are run.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:15
'http://ftp.perforce.com/perforce/r18.1/bin.linux26x86_64/p4api.tgz')
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Adrian Bacircea <adrian.bacircea@gmail.com>
2
# Packager: Adrian Bacircea <adrian.bacircea@gmail.com>
3
# Contributor: Alex Whitt <alex.joseph.whitt@gmail.com>
4
5
_pkgsrcname=p4python
6
pkgname=python-p4python
7
pkgver=2018.2.1743033
8
p4apiver=2018.1.1957529
9
pkgrel=2
10
pkgdesc="Interface to Perforce API for Python 3"
11
url="https://www.perforce.com/perforce/doc.current/manuals/p4script/03_python.html"
12
arch=('any')
13
license=('custom')
14
source=($pkgname-$pkgver.tar.gz::"https://files.pythonhosted.org/packages/36/5a/0a1b192cdecd31cb8bc0d0ba39c73ffd84ce823053d0004823a1fdbe1440/p4python-2018.2.1743033.tar.gz"
15
'http://ftp.perforce.com/perforce/r18.1/bin.linux26x86_64/p4api.tgz')
16
sha256sums=('caa37ea520566f50181b042a474eb8012ff8dcbcc0512874170ad34bea1ba0c0'
17
'331fad2257e4c427e1f864032f8125821865f2ecad3c643574cf4157f9ca7295')
18
makedepends=('python-setuptools')
19
depends=('openssl-1.0' 'python')
20
21
prepare() {
22
# Clean up if needed
23
rm -rf python-$_pkgsrcname-$pkgver
24
25
sed -i 's/OpenSSL (\\d)\\.(\\d)\\.(\\d)(\\S+)\\s+\\d+ \\S+ \\d+/OpenSSL (\\d)\\.(\\d)\\.(\\d)(.*)/g' \
26
${_pkgsrcname}-${pkgver}/setup.py
27
sed -i 's/pattern.match(version_string)/pattern.search(version_string)/g' \
28
${_pkgsrcname}-${pkgver}/setup.py
29
30
# Copy folder, so we can cleanly build for both python versions
31
mv $_pkgsrcname-$pkgver python-$_pkgsrcname-$pkgver
32
33
cd ${srcdir}
34
tar -xf p4api.tgz
35
}
36
37
build() {
38
cd python-$_pkgsrcname-$pkgver
39
python setup.py build \
40
--ssl '/usr/lib/openssl-1.0' \
41
--apidir ${srcdir}/p4api-${p4apiver}
42
}
43
44
package() {
45
cd $srcdir/python-$_pkgsrcname-$pkgver
46
47
python setup.py install --root="$pkgdir/" --skip-build --optimize=1 \
48
--apidir ${srcdir}/p4api-${p4apiver}
49
install -Dm644 LICENSE.txt $pkgdir/usr/share/licenses/$pkgname/LICENSE
50
}
51
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |