python-pytest-pyodide
LOW
maintainer orphaned
1 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package installs Python dependencies via pip in a test venv for testing purposes only; the installed packages (pyodide-py, tblib) are pinned versions from PyPI, and the final package consists solely of the built wheel installed via python-installer, posing minimal supply-chain risk.
Triggered rules
Low
pip install of an external package
pip_install_external
`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums. Severity reduced: python-* packages routinely use pip.
-
PKGBUILD:46
test-env/bin/pip install "tblib==3.0.0"
Low
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-07-25) reviewed this and agrees it is LOW (confidence 95%): The package installs Python dependencies via pip in a test venv for testing purposes only; the installed packages (pyodide-py, tblib) are pinned versions from PyPI, and the final package consists solely of the built wheel installed via python-installer, posing minimal supply-chain risk.
-
PKGBUILD:45
test-env/bin/pip install "pyodide-py==${_pyodide_pkgver}"
PKGBUILD
2 offending line(s) highlighted
1
# Maintainer: Mohamed Amine Zghal (medaminezghal) <medaminezghal at outlook dot com>
2
3
_name="pytest-pyodide"
4
pkgname="python-${_name}"
5
pkgver=0.58.4
6
_pyodide_pkgver=0.26.1
7
pkgrel=1
8
pkgdesc="Pytest plugin for testing applications that use Pyodide."
9
arch=('any')
10
url="https://github.com/pyodide/pytest-pyodide"
11
license=('MPL-2.0')
12
depends=('python>=3.10' 'python-pexpect' 'python-pytest' 'python-pytest-asyncio' 'python-hypothesis' 'python-selenium' 'selenium-manager' 'python-playwright' 'python-tblib')
13
makedepends=('python-hatchling' 'python-build' 'python-installer' 'python-wheel')
14
checkdepends=('python-pytest-cov' 'python-build' 'python-requests')
15
source=("https://files.pythonhosted.org/packages/source/${_name::1}/${_name}/${_name//-/_}-${pkgver}.tar.gz"
16
"https://github.com/pyodide/pyodide/releases/download/${_pyodide_pkgver}/pyodide-${_pyodide_pkgver}.tar.bz2")
17
sha256sums=('653f460e514cae6038cee821c592b05a0a2a4a22dab77929603126921f7d70f1'
18
'1bd2487795c4628272e3295a47f2da749682cd59a3680c5acfcd69baf3bb19b0')
19
20
prepare(){
21
cp -r "${srcdir}"/pyodide "${srcdir}"/${_name//-/_}-${pkgver}/pyodide
22
cd "${srcdir}"/${_name//-/_}-${pkgver}
23
sed -i 's/requires = \["hatchling", "hatch-vcs"\]/requires = ["hatchling"]/' pyproject.toml
24
# Disable pretty pluging in pytest
25
sed -i 's/\(runpytest([^)]*\)/\1, "-p no:pretty"/' tests/test_options.py
26
sed -i 's/runpytest(, "-p no:pretty"/runpytest("-p no:pretty", /' tests/test_options.py
27
}
28
29
build() {
30
cd "${srcdir}"/${_name//-/_}-${pkgver}
31
python -m build --wheel --no-isolation
32
}
33
34
check() {
35
local pytest_options=(
36
-vv
37
--override-ini="addopts="
38
-p no:flaky
39
--deselect tests/test_decorator.py::test_hypothesis # Need pytest 7
40
--deselect tests/test_doctest.py # Need pytest 7
41
-k "not test_jspi" # the suspender attribute doesn't exist anymore
42
)
43
cd "${srcdir}"/${_name//-/_}-${pkgver}
44
python -m venv --system-site-packages test-env
45
test-env/bin/pip install "pyodide-py==${_pyodide_pkgver}"
46
test-env/bin/pip install "tblib==3.0.0" # Need for test because the version provided by Arch maintainers is not compatible
47
test-env/bin/python -m installer dist/*.whl
48
#test-env/bin/python -m playwright install chrome --with-deps # Playwright isn't compatible with Arch Linux
49
#test-env/bin/python -m playwright install chrome --with-deps # Playwright isn't compatible with Arch Linux
50
for runtime in node chrome firefox; do
51
test-env/bin/python -m pytest "${pytest_options[@]}" tests --runtime=${runtime}
52
done
53
# test-env/bin/python -m pytest "${pytest_options[@]}" tests --runner=playwright --runtime=chrome # Playwright isn't compatible with Arch Linux
54
# test-env/bin/python -m pytest "${pytest_options[@]}" tests --runner=playwright --runtime=firefox # Playwright isn't compatible with Arch Linux
55
}
56
57
package() {
58
cd "${srcdir}"/${_name//-/_}-${pkgver}
59
python -m installer --destdir="$pkgdir" dist/*.whl
60
}
61
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |