python-phonopy
LOW
maintainer yuhldr
3 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The pip install occurs in a build environment with pinned dependencies and is part of building the project's own wheel from source; the package installs only the built wheel without external runtime installs.
Triggered rules
Low
pip install of an external package
pip_install_external
`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums. Severity reduced: python-* packages routinely use pip.
-
PKGBUILD:41
_buildenv/bin/pip install --upgrade pip
Low
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The pip install occurs in a build environment with pinned dependencies and is part of building the project's own wheel from source; the package installs only the built wheel without external runtime installs.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: yuhldr <yuhldr@qq.com>
2
3
pkgname=('python-phonopy')
4
pkgver=4.4.0
5
pkgrel=1
6
pkgdesc="Phonopy is an open source package for phonon calculations at harmonic and quasi-harmonic levels"
7
arch=('any')
8
url="https://github.com/phonopy/phonopy"
9
license=('BSD')
10
depends=(
11
"python-numpy"
12
"python-yaml"
13
"python-matplotlib"
14
"spglib"
15
"python-h5py"
16
"python-symfc"
17
)
18
optdepends=(
19
"python-seekpath"
20
)
21
makedepends=(
22
python-pip
23
cmake
24
gcc
25
ninja
26
)
27
28
source=("git+https://github.com/phonopy/phonopy.git#tag=v${pkgver}")
29
sha256sums=('SKIP')
30
31
prepare() {
32
cd "$srcdir"/phonopy
33
sed -i 's/cmake\.verbose/build.verbose/g' pyproject.toml
34
}
35
36
build() {
37
cd "$srcdir"/phonopy
38
rm -rf dist
39
40
python -m venv _buildenv
41
_buildenv/bin/pip install --upgrade pip
42
_buildenv/bin/pip install \
43
numpy \
44
scikit-build-core \
45
"nanobind<2.10.0" \
46
setuptools-scm \
47
build
48
49
_buildenv/bin/python -m build --wheel --no-isolation
50
}
51
52
53
package() {
54
cd "$srcdir"/phonopy
55
PIP_CONFIG_FILE=/dev/null pip install \
56
--isolated --root="$pkgdir" \
57
--ignore-installed --no-deps dist/*.whl
58
}
59
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |