python-pmdarima

MEDIUM

maintainer Smoolak 2 votes scanned 2026-11-04 06:06:05.494099

View on AUR

Why flagged

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:57 'gasoline.csv::https://alkaline-ml.com/datasets/gasoline.csv'

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Smoolak <smoolak@gmail.com>
    
      2# Contributor: Anton Kudelin <kudelin at proton dot me>
    
      3
    
      4_pyname=pmdarima
    
      5pkgname=python-${_pyname}
    
      6pkgver=2.1.1
    
      7pkgrel=5
    
      8pkgdesc="Python's forecast::auto.arima equivalent"
    
      9arch=('x86_64' 'aarch64')
    
      10url='https://github.com/alkaline-ml/pmdarima'
    
      11license=('MIT')
    
      12# Preserve the native extension bytes recorded by the installed wheel.
    
      13options=('!strip')
    
      14depends=(
    
      15  'cython'
    
      16  'openblas'
    
      17  'python'
    
      18  'python-joblib'
    
      19  'python-numpy'
    
      20  'python-packaging'
    
      21  'python-pandas'
    
      22  'python-scikit-learn'
    
      23  'python-scipy'
    
      24  'python-setuptools'
    
      25  'python-statsmodels>=0.14.5'
    
      26  'python-urllib3'
    
      27)
    
      28# Alternative SciPy packages may expose an unversioned capability.
    
      29# Keep the upstream/API minimum on the concrete providers.
    
      30conflicts=(
    
      31  'python-scipy<1.13.0'
    
      32  'python-scipy-git<1.13.0'
    
      33  'python-scipy-mkl<1.13.0'
    
      34  'python-scipy-mkl-bin<1.13.0'
    
      35  'python-scipy-mkl-tbb<1.13.0'
    
      36)
    
      37optdepends=(
    
      38  'python-matplotlib: plotting and visualization utilities'
    
      39  'python-pytest: bundled upstream compatibility and test helpers'
    
      40)
    
      41makedepends=(
    
      42  'meson'
    
      43  'meson-python'
    
      44  'ninja'
    
      45  'python-build'
    
      46  'python-installer'
    
      47  'python-wheel'
    
      48)
    
      49checkdepends=(
    
      50  'python-matplotlib'
    
      51  'python-pytest'
    
      52  'python-pytest-benchmark'
    
      53  'python-pytest-mpl'
    
      54)
    
      55source=(
    
      56  "${_pyname}-${pkgver}.tar.gz::${url}/archive/refs/tags/v${pkgver}.tar.gz"
    
      57  'gasoline.csv::https://alkaline-ml.com/datasets/gasoline.csv'
    
      58)
    
      59sha256sums=(
    
      60  '4debd209df0bb4eb772015350bf16ef9b48c0ff8ff6ba497270d9007e2a02ab1'
    
      61  '59ba35cda906b1b3ab695eeecba25cbc3c145168b455dda0ae44443ae7372287'
    
      62)
    
      63
    
      64build() {
    
      65  cd "${_pyname}-${pkgver}"
    
      66  GITHUB_REF="refs/tags/v${pkgver}" \
    
      67    python -m build --wheel --no-isolation
    
      68}
    
      69
    
      70check() {
    
      71  local checkroot="${srcdir}/check-install"
    
      72  local site_packages
    
      73  local data_root="${srcdir}/check-data"
    
      74  local port_file="${srcdir}/check-port"
    
      75  local server_pid port test_rc=0
    
      76  rm -rf "$checkroot"
    
      77  python -m installer --destdir="$checkroot" \
    
      78    "${_pyname}-${pkgver}"/dist/*.whl
    
      79  site_packages=$(python -c 'import sysconfig; print(sysconfig.get_path("platlib"))')
    
      80
    
      81  # One upstream test deliberately downloads the gasoline fixture and then
    
      82  # verifies its memory and disk-cache behavior. Serve the checksum-pinned
    
      83  # upstream fixture over loopback so that the complete test remains exercised
    
      84  # in an offline build environment; only the disposable installed test copy
    
      85  # has its endpoint redirected, never the packaged source or artifact.
    
      86  rm -rf "$data_root" "$port_file"
    
      87  install -Dm644 "$srcdir/gasoline.csv" "$data_root/gasoline.csv"
    
      88  python - "$data_root" "$port_file" <<'PY' \
    
      89    >"${srcdir}/check-http.log" 2>&1 &
    
      90from functools import partial
    
      91from http.server import SimpleHTTPRequestHandler, ThreadingHTTPServer
    
      92from pathlib import Path
    
      93import sys
    
      94
    
      95root, port_file = sys.argv[1:]
    
      96handler = partial(SimpleHTTPRequestHandler, directory=root)
    
      97server = ThreadingHTTPServer(("127.0.0.1", 0), handler)
    
      98Path(port_file).write_text(str(server.server_port), encoding="ascii")
    
      99server.serve_forever()
    
      100PY
    
      101  server_pid=$!
    
      102  for _ in {1..100}; do
    
      103    [[ -s $port_file ]] && break
    
      104    kill -0 "$server_pid" 2>/dev/null || break
    
      105    sleep 0.05
    
      106  done
    
      107  test -s "$port_file"
    
      108  port=$(<"$port_file")
    
      109  sed -i \
    
      110    "s#url = 'http://alkaline-ml.com/datasets/gasoline.csv'#url = 'http://127.0.0.1:${port}/gasoline.csv'#" \
    
      111    "$checkroot$site_packages/${_pyname}/datasets/gasoline.py"
    
      112  grep -Fqx "url = 'http://127.0.0.1:${port}/gasoline.csv'" \
    
      113    "$checkroot$site_packages/${_pyname}/datasets/gasoline.py"
    
      114
    
      115  # Upstream installs its complete test tree in the wheel and tests that wheel
    
      116  # through this --pyargs surface in cibuildwheel.
    
      117  cd "$srcdir"
    
      118  MPLBACKEND=Agg PYTHONPATH="$checkroot$site_packages" \
    
      119    python -P -m pytest --showlocals --durations=20 --pyargs "${_pyname}" || \
    
      120      test_rc=$?
    
      121  kill "$server_pid" 2>/dev/null || true
    
      122  wait "$server_pid" 2>/dev/null || true
    
      123  return "$test_rc"
    
      124}
    
      125
    
      126package() {
    
      127  python -m installer --compile-bytecode=1 --destdir="$pkgdir" \
    
      128    "${_pyname}-${pkgver}"/dist/*.whl
    
      129  install -Dm644 "${_pyname}-${pkgver}/LICENSE" \
    
      130    "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      131}
    
      132

Changes since previous scan

--- PKGBUILD @ 2026-11-04 00:25
+++ PKGBUILD @ 2026-11-04 06:06
@@ -4,11 +4,13 @@
 _pyname=pmdarima
 pkgname=python-${_pyname}
 pkgver=2.1.1
-pkgrel=4
+pkgrel=5
 pkgdesc="Python's forecast::auto.arima equivalent"
 arch=('x86_64' 'aarch64')
 url='https://github.com/alkaline-ml/pmdarima'
 license=('MIT')
+# Preserve the native extension bytes recorded by the installed wheel.
+options=('!strip')
 depends=(
   'cython'
   'openblas'
@@ -18,10 +20,19 @@
   'python-packaging'
   'python-pandas'
   'python-scikit-learn'
-  'python-scipy>=1.13.0'
+  'python-scipy'
   'python-setuptools'
   'python-statsmodels>=0.14.5'
   'python-urllib3'
+)
+# Alternative SciPy packages may expose an unversioned capability.
+# Keep the upstream/API minimum on the concrete providers.
+conflicts=(
+  'python-scipy<1.13.0'
+  'python-scipy-git<1.13.0'
+  'python-scipy-mkl<1.13.0'
+  'python-scipy-mkl-bin<1.13.0'
+  'python-scipy-mkl-tbb<1.13.0'
 )
 optdepends=(
   'python-matplotlib: plotting and visualization utilities'

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-04 06:06:05	Medium	1
2026-11-04 04:05:54	Medium	1
2026-11-04 00:25:23	Low	2
2026-11-03 00:01:00	Low	2
2026-11-02 00:26:00	Low	2
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 00:13:55	Low	2
2026-10-28 00:06:54	Low	2
2026-10-27 00:23:28	Low	2
2026-10-26 00:12:40	Low	2
2026-10-25 00:20:48	Low	2
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 00:13:10	Low	2
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2