python-rachis

LOW

maintainer Smoolak 0 votes scanned 2026-11-01 20:05:43.262389

View on AUR

Why flagged

The non-standard host (data.qiime2.org) downloads a plain TSV metadata file used only as test fixture data, never executed; the main source is a GitHub archive from the declared project URL with a verified checksum, and the build follows standard Python wheel packaging with no obfuscation or remote code execution.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): The non-standard host (data.qiime2.org) downloads a plain TSV metadata file used only as test fixture data, never executed; the main source is a GitHub archive from the declared project URL with a verified checksum, and the build follows standard Python wheel packaging with no obfuscation or remote code execution.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 'moving-pictures-metadata.tsv::https://data.qiime2.org/2022.11/tutorials/moving-pictures/sample_metadata.tsv'

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Smoolak <smoolak@gmail.com>
    
      2
    
      3pkgname=python-rachis
    
      4pkgver=2026.10.0
    
      5pkgrel=2
    
      6pkgdesc='Extensible scientific analysis framework formerly known as QIIME 2'
    
      7arch=(any)
    
      8url=https://github.com/rachis-org/rachis
    
      9license=(BSD-3-Clause)
    
      10depends=('python' 'python-bibtexparser1' 'python-dill' 'python-flufl-lock' 'python-networkx' 'python-numpy' 'python-pandas' 'python-parsl>=2026.0' 'python-platformdirs' 'python-psutil' 'python-dateutil' 'python-yaml' 'python-setuptools' 'python-tomlkit' 'python-tzlocal' 'python-lxml')
    
      11makedepends=('python-build' 'python-installer' 'python-setuptools' 'python-versioningit' 'python-wheel')
    
      12checkdepends=('python-pytest' 'python-tornado' 'jupyter-notebook')
    
      13_commit=4c768c7aba1db4aa69ac2734a6dcfbb3b5ebf1ca
    
      14source=("$pkgname-$pkgver.tar.gz::$url/archive/$_commit.tar.gz"
    
      15        'moving-pictures-metadata.tsv::https://data.qiime2.org/2022.11/tutorials/moving-pictures/sample_metadata.tsv'
    
      16        offline_usage_tests.py)
    
      17sha256sums=('600400937f074aa36ff75bef34318424d5e6afa06352d13c18cf5b35f8740f98'
    
      18            '9dbfbedd90776d77c431faa914d81b0d6299fff10c364216dbcd5c6df5382cc9'
    
      19            '8f2ecf9217aaac2342ae9823e138bd49c7798f9c6dc49443e7fb3b86f16e35e5')
    
      20optdepends=('python-matplotlib: graph visualization' 'python-pytest: run the shipped framework test suite')
    
      21build() {
    
      22  cd "rachis-$_commit"
    
      23  python -m build --wheel --no-isolation
    
      24}
    
      25
    
      26check() {
    
      27  # Use HTML from the pinned source for the invalid-metadata URL case.
    
      28  install -m644 "rachis-$_commit/src/rachis/plugin/tests/data/no_nan.html" \
    
      29    "$srcdir/invalid-metadata.html"
    
      30  python -m venv --system-site-packages --without-pip "$srcdir/check-env"
    
      31  "$srcdir/check-env/bin/python" -m installer "rachis-$_commit"/dist/*.whl
    
      32  # Keep the installed wheel isolated from the source tree and test-only plugin.
    
      33  local test_site
    
      34  test_site=$("$srcdir/check-env/bin/python" -I -c 'import site; print(site.getsitepackages()[0])')
    
      35  install -m644 "$srcdir/offline_usage_tests.py" "$test_site/aur_rachis_usage_fixtures.py"
    
      36  RACHIS_TEST_FIXTURES="$srcdir" QIIMETEST=1 MPLBACKEND=Agg "$srcdir/check-env/bin/python" -I -m pytest --import-mode=importlib -p aur_rachis_usage_fixtures -v \
    
      37    "$test_site/rachis" --doctest-modules --junitxml="$srcdir/pytest-results.xml"
    
      38}
    
      39
    
      40package() {
    
      41  cd "rachis-$_commit"
    
      42  python -m installer --destdir="$pkgdir" dist/*.whl
    
      43  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      44}
    
      45

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 20:05:43	Low	3
2026-11-01 20:01:18	Medium	2