python-prance
maintainer Smoolak
· 0 votes
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The package builds from source hosted on GitHub, a plausible project-owned repository, and includes a vendored test dependency from the same upstream; the orphaned/re-adopted status is administrative and does not imply malicious content.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from source hosted on GitHub, a plausible project-owned repository, and includes a vendored test dependency from the same upstream; the orphaned/re-adopted status is administrative and does not imply malicious content.
1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM
Recently orphaned & re-adopted
orphaned_readopted
This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.
PKGBUILD
1
# Maintainer: Felix Yan <felixonmars@archlinux.org>
2
3
pkgname=python-prance
4
pkgver=0.22.11.04.0
5
_openapi_commit=0f9d3ec7c033fef184ec54e1ffc201b2d61ce023
6
pkgrel=5
7
pkgdesc="Resolving Swagger/OpenAPI 2.0 and 3.0 Parser"
8
url="https://github.com/jfinkhaeuser/prance"
9
license=('MITNFA')
10
arch=('any')
11
depends=('python-chardet' 'python-ruamel-yaml' 'python-requests' 'python-six' 'python-semver'
12
'python-packaging')
13
optdepends=('python-flex' 'python-click' 'python-pyicu' 'python-openapi-spec-validator')
14
makedepends=('python-setuptools')
15
# 'python-flex' is broken, removed for now: https://github.com/RonnyPfannschmidt/prance/issues/116
16
checkdepends=('python-pytest' 'python-click' 'python-pyicu' 'python-openapi-spec-validator')
17
source=("https://github.com/jfinkhaeuser/prance/archive/v$pkgver/$pkgname-$pkgver.tar.gz"
18
"https://github.com/OAI/OpenAPI-Specification/archive/$_openapi_commit/OpenAPI-Specification-$_openapi_commit.tar.gz")
19
sha512sums=('ad2d65ec732ffe5275dd6a0e8d9bd04a6ee7c7d6d46f4cbf680be344c6593334ea98436b0a99bc773b6705d948f331930a921d1704cdab59cf07ee5da2cfe48c'
20
'c75ff7410c75ce23fd736ccb4294175438b66a954687d380124c0e37237112b043fa0c289269a8d792e8385264c923b0be09d6bf63112a106e4579d9d7a9808f')
21
22
prepare() {
23
rmdir prance-$pkgver/tests/OpenAPI-Specification
24
ln -s "$srcdir"/OpenAPI-Specification-$_openapi_commit prance-$pkgver/tests/OpenAPI-Specification
25
}
26
27
build() {
28
cd prance-$pkgver
29
python setup.py build
30
}
31
32
check() {
33
cd prance-$pkgver
34
# Code depends on a service which is broken with a Bad gateway https://mermade.org.uk/api/v1/convert
35
pytest --override-ini="addopts=" \
36
--deselect=tests/test_backends.py::test_openapi_spec_validator_validate_failure \
37
--deselect=tests/test_cli.py::test_convert_defaults \
38
--deselect=tests/test_cli.py::test_convert_output \
39
--deselect=tests/test_convert.py::test_convert_parser_validated \
40
--deselect=tests/test_convert.py::test_convert_petstore_json \
41
--deselect=tests/test_convert.py::test_convert_petstore_yaml \
42
--deselect=tests/test_convert.py::test_convert_petstore_yaml_explicit_name \
43
--deselect=tests/test_convert.py::test_convert_url \
44
--deselect=tests/test_util_url.py::test_fetch_url_http
45
}
46
47
package() {
48
cd prance-$pkgver
49
python setup.py install --root="$pkgdir" --optimize=1
50
install -Dm644 LICENSE.txt -t "$pkgdir"/usr/share/licenses/$pkgname/
51
}
52
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 2 |
| 2026-08-02 00:16:08 | LOW | 2 |
| 2026-08-01 00:11:18 | LOW | 2 |
| 2026-07-31 00:14:10 | LOW | 2 |
| 2026-07-30 00:17:23 | LOW | 2 |
| 2026-07-29 00:25:53 | LOW | 2 |
| 2026-07-28 00:07:28 | LOW | 2 |
| 2026-07-27 00:24:32 | LOW | 2 |
| 2026-07-26 00:07:32 | LOW | 2 |
| 2026-07-25 00:13:44 | LOW | 2 |
| 2026-07-24 00:02:28 | LOW | 2 |
| 2026-07-23 01:22:21 | MEDIUM | 1 |
| 2026-06-18 16:11:54 | CLEAN | 0 |