python-pmdarima

MEDIUM

maintainer Smoolak 2 votes scanned 2026-09-20 19:33:19.533630

View on AUR

Why flagged

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:46 'gasoline.csv::http://alkaline-ml.com/datasets/gasoline.csv'

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Smoolak <smoolak@gmail.com>
    
      2# Contributor: Anton Kudelin <kudelin at proton dot me>
    
      3
    
      4_pyname=pmdarima
    
      5pkgname=python-${_pyname}
    
      6pkgver=2.1.1
    
      7pkgrel=3
    
      8pkgdesc="Python's forecast::auto.arima equivalent"
    
      9arch=('x86_64' 'aarch64')
    
      10url='https://github.com/alkaline-ml/pmdarima'
    
      11license=('MIT')
    
      12depends=(
    
      13  'cython'
    
      14  'openblas'
    
      15  'python'
    
      16  'python-joblib'
    
      17  'python-numpy'
    
      18  'python-packaging'
    
      19  'python-pandas'
    
      20  'python-scikit-learn'
    
      21  'python-scipy>=1.13.0'
    
      22  'python-setuptools'
    
      23  'python-statsmodels>=0.14.5'
    
      24  'python-urllib3'
    
      25)
    
      26optdepends=(
    
      27  'python-matplotlib: plotting and visualization utilities'
    
      28  'python-pytest: bundled upstream compatibility and test helpers'
    
      29)
    
      30makedepends=(
    
      31  'meson'
    
      32  'meson-python'
    
      33  'ninja'
    
      34  'python-build'
    
      35  'python-installer'
    
      36  'python-wheel'
    
      37)
    
      38checkdepends=(
    
      39  'python-matplotlib'
    
      40  'python-pytest'
    
      41  'python-pytest-benchmark'
    
      42  'python-pytest-mpl'
    
      43)
    
      44source=(
    
      45  "${_pyname}-${pkgver}.tar.gz::${url}/archive/refs/tags/v${pkgver}.tar.gz"
    
      46  'gasoline.csv::http://alkaline-ml.com/datasets/gasoline.csv'
    
      47)
    
      48sha256sums=(
    
      49  '4debd209df0bb4eb772015350bf16ef9b48c0ff8ff6ba497270d9007e2a02ab1'
    
      50  '59ba35cda906b1b3ab695eeecba25cbc3c145168b455dda0ae44443ae7372287'
    
      51)
    
      52
    
      53build() {
    
      54  cd "${_pyname}-${pkgver}"
    
      55  GITHUB_REF="refs/tags/v${pkgver}" \
    
      56    python -m build --wheel --no-isolation
    
      57}
    
      58
    
      59check() {
    
      60  local checkroot="${srcdir}/check-install"
    
      61  local site_packages
    
      62  local data_root="${srcdir}/check-data"
    
      63  local port_file="${srcdir}/check-port"
    
      64  local server_pid port test_rc=0
    
      65  rm -rf "$checkroot"
    
      66  python -m installer --destdir="$checkroot" \
    
      67    "${_pyname}-${pkgver}"/dist/*.whl
    
      68  site_packages=$(python -c 'import sysconfig; print(sysconfig.get_path("platlib"))')
    
      69
    
      70  # One upstream test deliberately downloads the gasoline fixture and then
    
      71  # verifies its memory and disk-cache behavior. Serve the checksum-pinned
    
      72  # upstream fixture over loopback so that the complete test remains exercised
    
      73  # in an offline build environment; only the disposable installed test copy
    
      74  # has its endpoint redirected, never the packaged source or artifact.
    
      75  rm -rf "$data_root" "$port_file"
    
      76  install -Dm644 "$srcdir/gasoline.csv" "$data_root/gasoline.csv"
    
      77  python - "$data_root" "$port_file" <<'PY' \
    
      78    >"${srcdir}/check-http.log" 2>&1 &
    
      79from functools import partial
    
      80from http.server import SimpleHTTPRequestHandler, ThreadingHTTPServer
    
      81from pathlib import Path
    
      82import sys
    
      83
    
      84root, port_file = sys.argv[1:]
    
      85handler = partial(SimpleHTTPRequestHandler, directory=root)
    
      86server = ThreadingHTTPServer(("127.0.0.1", 0), handler)
    
      87Path(port_file).write_text(str(server.server_port), encoding="ascii")
    
      88server.serve_forever()
    
      89PY
    
      90  server_pid=$!
    
      91  for _ in {1..100}; do
    
      92    [[ -s $port_file ]] && break
    
      93    kill -0 "$server_pid" 2>/dev/null || break
    
      94    sleep 0.05
    
      95  done
    
      96  test -s "$port_file"
    
      97  port=$(<"$port_file")
    
      98  sed -i \
    
      99    "s#url = 'http://alkaline-ml.com/datasets/gasoline.csv'#url = 'http://127.0.0.1:${port}/gasoline.csv'#" \
    
      100    "$checkroot$site_packages/${_pyname}/datasets/gasoline.py"
    
      101  grep -Fqx "url = 'http://127.0.0.1:${port}/gasoline.csv'" \
    
      102    "$checkroot$site_packages/${_pyname}/datasets/gasoline.py"
    
      103
    
      104  # Upstream installs its complete test tree in the wheel and tests that wheel
    
      105  # through this --pyargs surface in cibuildwheel.
    
      106  cd "$srcdir"
    
      107  MPLBACKEND=Agg PYTHONPATH="$checkroot$site_packages" \
    
      108    python -P -m pytest --showlocals --durations=20 --pyargs "${_pyname}" || \
    
      109      test_rc=$?
    
      110  kill "$server_pid" 2>/dev/null || true
    
      111  wait "$server_pid" 2>/dev/null || true
    
      112  return "$test_rc"
    
      113}
    
      114
    
      115package() {
    
      116  python -m installer --compile-bytecode=1 --destdir="$pkgdir" \
    
      117    "${_pyname}-${pkgver}"/dist/*.whl
    
      118  install -Dm644 "${_pyname}-${pkgver}/LICENSE" \
    
      119    "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      120}
    
      121

Changes since previous scan

--- PKGBUILD @ 2026-08-23 00:10
+++ PKGBUILD @ 2026-09-20 19:33
@@ -1,50 +1,121 @@
-# Maintainer: Anton Kudelin <kudelin at proton dot me>
+# Maintainer: Smoolak <smoolak@gmail.com>
+# Contributor: Anton Kudelin <kudelin at proton dot me>
 
 _pyname=pmdarima
-pkgname=python-$_pyname
-pkgver=2.0.4
-pkgrel=1
-pkgdesc="ARIMA estimators for Python"
-arch=(x86_64 aarch64)
-url="https://alkaline-ml.com/pmdarima"
-license=(MIT)
-depends=(python-scikit-learn python-statsmodels python-urllib3 cython)
-optdepends=(python-matplotlib python-pytest)
-makedepends=(python-build python-installer python-setuptools python-wheel)
-checkdepends=(python-pytest)
-source=($pkgname-$pkgver.tar.gz::https://github.com/alkaline-ml/pmdarima/archive/refs/tags/v$pkgver.tar.gz)
-sha256sums=('83eca810992679f2086781a8b58b39558392380c13ac60819b026fffb105cfcd')
-
-prepare() {
-  cat <<EOF > "$srcdir/$_pyname-$pkgver/$_pyname/VERSION"
-$pkgver
-EOF
-}
+pkgname=python-${_pyname}
+pkgver=2.1.1
+pkgrel=3
+pkgdesc="Python's forecast::auto.arima equivalent"
+arch=('x86_64' 'aarch64')
+url='https://github.com/alkaline-ml/pmdarima'
+license=('MIT')
+depends=(
+  'cython'
+  'openblas'
+  'python'
+  'python-joblib'
+  'python-numpy'
+  'python-packaging'
+  'python-pandas'
+  'python-scikit-learn'
+  'python-scipy>=1.13.0'
+  'python-setuptools'
+  'python-statsmodels>=0.14.5'
+  'python-urllib3'
+)
+optdepends=(
+  'python-matplotlib: plotting and visualization utilities'
+  'python-pytest: bundled upstream compatibility and test helpers'
+)
+makedepends=(
+  'meson'
+  'meson-python'
+  'ninja'
+  'python-build'
+  'python-installer'
+  'python-wheel'
+)
+checkdepends=(
+  'python-matplotlib'
+  'python-pytest'
+  'python-pytest-benchmark'
+  'python-pytest-mpl'
+)
+source=(
+  "${_pyname}-${pkgver}.tar.gz::${url}/archive/refs/tags/v${pkgver}.tar.gz"
+  'gasoline.csv::http://alkaline-ml.com/datasets/gasoline.csv'
+)
+sha256sums=(
+  '4debd209df0bb4eb772015350bf16ef9b48c0ff8ff6ba497270d9007e2a02ab1'
+  '59ba35cda906b1b3ab695eeecba25cbc3c145168b455dda0ae44443ae7372287'
+)
 
 build() {
-  cd "$srcdir/$_pyname-$pkgver"
-  python -m build \
-    --wheel \
-    --no-isolation \
-    --skip-dependency-check
+  cd "${_pyname}-${pkgver}"
+  GITHUB_REF="refs/tags/v${pkgver}" \
+    python -m build --wheel --no-isolation
 }
 
 check() {
-  cd "$srcdir/$_pyname-$pkgver"
-  python -m venv --system-site-packages test-env
-  test-env/bin/python -m installer dist/*.whl
-  mv $_pyname/tests .
-  rm -r $_pyname
-  test-env/bin/python -m pytest -v
+  local checkroot="${srcdir}/check-install"
+  local site_packages
+  local data_root="${srcdir}/check-data"
+  local port_file="${srcdir}/check-port"
+  local server_pid port test_rc=0
+  rm -rf "$checkroot"
+  python -m installer --destdir="$checkroot" \
+    "${_pyname}-${pkgver}"/dist/*.whl
+  site_packages=$(python -c 'import sysconfig; print(sysconfig.get_path("platlib"))')
+
+  # One upstream test deliberately downloads the gasoline fixture and then
+  # verifies its memory and disk-cache behavior. Serve the checksum-pinned
+  # upstream fixture over loopback so that the complete test remains exercised
+  # in an offline build environment; only the disposable installed test copy
+  # has its endpoint redirected, never the packaged source or artifact.
+  rm -rf "$data_root" "$port_file"
+  install -Dm644 "$srcdir/gasoline.csv" "$data_root/gasoline.csv"
+  python - "$data_root" "$port_file" <<'PY' \
+    >"${srcdir}/check-http.log" 2>&1 &
+from functools import partial
+from http.server import SimpleHTTPRequestHandler, ThreadingHTTPServer
+from pathlib import Path
+import sys
+
+root, port_file = sys.argv[1:]
+handler = partial(SimpleHTTPRequestHandler, directory=root)
+server = ThreadingHTTPServer(("127.0.0.1", 0), handler)
+Path(port_file).write_text(str(server.server_port), encoding="ascii")
+server.serve_forever()
+PY
+  server_pid=$!
+  for _ in {1..100}; do
+    [[ -s $port_file ]] && break
+    kill -0 "$server_pid" 2>/dev/null || break
+    sleep 0.05
+  done
+  test -s "$port_file"
+  port=$(<"$port_file")
+  sed -i \
+    "s#url = 'http://alkaline-ml.com/datasets/gasoline.csv'#url = 'http://127.0.0.1:${port}/gasoline.csv'#" \
+    "$checkroot$site_packages/${_pyname}/datasets/gasoline.py"
+  grep -Fqx "url = 'http://127.0.0.1:${port}/gasoline.csv'" \
+    "$checkroot$site_packages/${_pyname}/datasets/gasoline.py"
+
+  # Upstream installs its complete test tree in the wheel and tests that wheel
+  # through this --pyargs surface in cibuildwheel.
+  cd "$srcdir"
+  MPLBACKEND=Agg PYTHONPATH="$checkroot$site_packages" \
+    python -P -m pytest --showlocals --durations=20 --pyargs "${_pyname}" || \
+      test_rc=$?
+  kill "$server_pid" 2>/dev/null || true
+  wait "$server_pid" 2>/dev/null || true
+  return "$test_rc"
 }
 
 package() {
-  cd "$srcdir/$_pyname-$pkgver"
-  python -m installer \
-    --destdir="$pkgdir" \
-    --compile-bytecode=1 \
-    dist/*.whl
-
-  install -Dm755 LICENSE -t "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
+  python -m installer --compile-bytecode=1 --destdir="$pkgdir" \
+    "${_pyname}-${pkgver}"/dist/*.whl
+  install -Dm644 "${_pyname}-${pkgver}/LICENSE" \
+    "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
 }
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-20 19:33:19	Medium	1
2026-08-23 00:10:13	Clean	0
2026-08-22 00:02:17	Low	2
2026-08-21 00:01:35	Low	2
2026-08-20 00:05:13	Low	2
2026-08-19 00:15:45	Low	2
2026-08-18 00:03:42	Low	2
2026-08-17 00:18:29	Low	2
2026-08-16 00:03:42	Low	2
2026-08-15 00:26:13	Low	2
2026-08-14 00:03:41	Low	2
2026-08-13 00:17:07	Low	2
2026-08-12 00:27:08	Low	2
2026-08-11 00:07:57	Low	2
2026-08-10 00:09:14	Low	2
2026-08-09 00:07:45	Low	2
2026-08-08 00:18:14	Low	2
2026-08-07 00:19:04	Low	2
2026-08-06 00:26:13	Low	2
2026-08-05 00:12:14	Low	2