python-ruamel-yaml-hg
LOW
maintainer petronny
2 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The source uses Mercurial to clone from a SourceForge URL, which is a non-standard host but plausibly the project's official repository; building from source is normal for AUR packages and poses low risk.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The source uses Mercurial to clone from a SourceForge URL, which is a non-standard host but plausibly the project's official repository; building from source is normal for AUR packages and poses low risk.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:16
source=("${_hgname}::hg+http://hg.code.sf.net/p/ruamel-yaml/code")
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Jingbei Li <i@jingbei.li>
2
3
pkgname=python-ruamel-yaml-hg
4
_hgname=yaml
5
pkgver=0.18.6.r2.0bef9fa8b3c4
6
pkgrel=1
7
pkgdesc="YAML parser/emitter that supports roundtrip preservation of comments, seq/map flow style, and map key order"
8
arch=('any')
9
url="https://sourceforge.net/projects/ruamel-yaml/"
10
license=('MIT')
11
groups=('devel')
12
depends=('python')
13
makedepends=('mercurial' 'python-setuptools' 'wget')
14
provides=('python-ruamel-yaml')
15
conflicts=('python-ruamel-yaml')
16
source=("${_hgname}::hg+http://hg.code.sf.net/p/ruamel-yaml/code")
17
md5sums=('SKIP')
18
19
pkgver() {
20
cd "${_hgname}"
21
hg log -r . --template '{latesttag}.r{latesttagdistance}.{node|short}\n'
22
}
23
24
#prepare() {
25
# _pkgver=${pkgver/.r*/}
26
# cd $srcdir
27
# [ ! -f ruamel.yaml-$_pkgver.tar.gz ] && wget -O ruamel.yaml-$_pkgver.tar.gz "https://pypi.io/packages/source/r/ruamel.yaml/ruamel.yaml-$_pkgver.tar.gz"
28
# tar zxvf ruamel.yaml-$_pkgver.tar.gz
29
# cp ruamel.yaml-$_pkgver/setup.py $_hgname
30
#}
31
32
build() {
33
cd "$srcdir/$_hgname"
34
python setup.py build
35
}
36
37
package() {
38
cd "$srcdir/$_hgname"
39
RUAMEL_NO_PIP_INSTALL_CHECK=1 \
40
python setup.py install --root="$pkgdir"/ --optimize=1
41
#pip install --root="$pkgdir" --ignore-installed --no-dependencies
42
install -D -m644 LICENSE "$pkgdir"/usr/share/licenses/$pkgname/LICENSE
43
}
44
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |