python-ruamel-yaml-hg
LOW
maintainer petronny
2 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The source uses Mercurial to clone from a SourceForge URL, which is a non-standard host but plausibly the project's official repository; building from source is normal for AUR packages and poses low risk.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The source uses Mercurial to clone from a SourceForge URL, which is a non-standard host but plausibly the project's official repository; building from source is normal for AUR packages and poses low risk.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:16
source=("${_hgname}::hg+http://hg.code.sf.net/p/ruamel-yaml/code")
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Jingbei Li <i@jingbei.li>
2
3
pkgname=python-ruamel-yaml-hg
4
_hgname=yaml
5
pkgver=0.18.6.r2.0bef9fa8b3c4
6
pkgrel=1
7
pkgdesc="YAML parser/emitter that supports roundtrip preservation of comments, seq/map flow style, and map key order"
8
arch=('any')
9
url="https://sourceforge.net/projects/ruamel-yaml/"
10
license=('MIT')
11
groups=('devel')
12
depends=('python')
13
makedepends=('mercurial' 'python-setuptools' 'wget')
14
provides=('python-ruamel-yaml')
15
conflicts=('python-ruamel-yaml')
16
source=("${_hgname}::hg+http://hg.code.sf.net/p/ruamel-yaml/code")
17
md5sums=('SKIP')
18
19
pkgver() {
20
cd "${_hgname}"
21
hg log -r . --template '{latesttag}.r{latesttagdistance}.{node|short}\n'
22
}
23
24
#prepare() {
25
# _pkgver=${pkgver/.r*/}
26
# cd $srcdir
27
# [ ! -f ruamel.yaml-$_pkgver.tar.gz ] && wget -O ruamel.yaml-$_pkgver.tar.gz "https://pypi.io/packages/source/r/ruamel.yaml/ruamel.yaml-$_pkgver.tar.gz"
28
# tar zxvf ruamel.yaml-$_pkgver.tar.gz
29
# cp ruamel.yaml-$_pkgver/setup.py $_hgname
30
#}
31
32
build() {
33
cd "$srcdir/$_hgname"
34
python setup.py build
35
}
36
37
package() {
38
cd "$srcdir/$_hgname"
39
RUAMEL_NO_PIP_INSTALL_CHECK=1 \
40
python setup.py install --root="$pkgdir"/ --optimize=1
41
#pip install --root="$pkgdir" --ignore-installed --no-dependencies
42
install -D -m644 LICENSE "$pkgdir"/usr/share/licenses/$pkgname/LICENSE
43
}
44
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 00:13:55 | Low | 2 |
| 2026-10-28 00:06:54 | Low | 2 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |
| 2026-10-14 00:06:47 | Low | 2 |
| 2026-10-13 00:23:45 | Low | 2 |