python-scikit-sparse

maintainer thrasibule · 2 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The non-standard host (math.nist.gov) hosts test data files (matrix market format) that are not executable; the worst case of a malicious swap is test corruption, not code execution, and the primary source is from PyPI.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The non-standard host (math.nist.gov) hosts test data files (matrix market format) that are not executable; the worst case of a malicious swap is test corruption, not code execution, and the primary source is from PyPI.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 "https://math.nist.gov/pub/MatrixMarket2/Harwell-Boeing/lsq/well1033.mtx.gz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Guillaume Horel <guillaume dot horel at gmail dot com>
    
      2# Contributor: Antony Lee <anntzer dot lee at gmail dot com>
    
      3_pyname=scikit_sparse
    
      4pkgname=python-scikit-sparse
    
      5pkgver=0.4.15
    
      6pkgrel=1
    
      7pkgdesc='Scikit sparse matrix package'
    
      8url="https://pypi.python.org/pypi/$_pyname/"
    
      9checkdepends=(python-pytest)
    
      10depends=(python-scipy suitesparse)
    
      11makedepends=(cython python-build python-installer python-setuptools python-wheel)
    
      12license=('BSD-2-Clause')
    
      13arch=('x86_64')
    
      14source=("https://pypi.python.org/packages/source/${_pyname:0:1}/$_pyname/$_pyname-$pkgver.tar.gz"
    
      15        "https://math.nist.gov/pub/MatrixMarket2/Harwell-Boeing/lsq/well1033.mtx.gz"
    
      16        "https://math.nist.gov/pub/MatrixMarket2/Harwell-Boeing/lsq/well1033_rhs1.mtx.gz"
    
      17        "https://math.nist.gov/pub/MatrixMarket2/Harwell-Boeing/lsq/illc1033.mtx.gz"
    
      18        "https://math.nist.gov/pub/MatrixMarket2/Harwell-Boeing/lsq/illc1033_rhs1.mtx.gz"
    
      19        "https://math.nist.gov/pub/MatrixMarket2/Harwell-Boeing/lsq/well1850.mtx.gz"
    
      20        "https://math.nist.gov/pub/MatrixMarket2/Harwell-Boeing/lsq/well1850_rhs1.mtx.gz"
    
      21        "https://math.nist.gov/pub/MatrixMarket2/Harwell-Boeing/lsq/illc1850.mtx.gz"
    
      22        "https://math.nist.gov/pub/MatrixMarket2/Harwell-Boeing/lsq/illc1850_rhs1.mtx.gz"
    
      23)
    
      24sha256sums=('a0b1ef1bbe9e28e5c6d2838c63c62e094a8098d11a736771edac55ccc5f9eabe'
    
      25            '5489ac8433eb94f98e9f452c0501eb62df545070749e45636cdaf701df5f3444'
    
      26            '53ef7635b9223be738d1aeddfc7791a5e4732fba14972ca93a4f74a7c8e73f2f'
    
      27            '198613a53f044d83c996b5d81d12ad8aa7625e6e6e58d96c42d25a533bf48e61'
    
      28            '2dc10862b43fece1e6b05e57a3f69765f4a11d281da262e72db11f4789f29669'
    
      29            '8eb8f4a19e82c60f03b487411f566aeeb2772a57bdc7d45c53ce5ba62b3f1221'
    
      30            '96ca30fdabd5e40d348f580962d0ede6f2758e8088cf03819cb64f4efc774624'
    
      31            'c05ad6c2fbbc5e4307d2ae4cdd94131a7e4f4689389117cf3c70571228b91ea3'
    
      32            '4807ab0f4f5f0f254feaf227f63c80574b7713f2f68cde092338b6114911054d')
    
      33
    
      34build() {
    
      35  cd $_pyname-$pkgver
    
      36  python -m build -wn
    
      37}
    
      38
    
      39package() {
    
      40  cd $_pyname-$pkgver
    
      41  python -m installer --destdir="$pkgdir" dist/*.whl
    
      42  install -D -m644 LICENSE.txt "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.txt"
    
      43}
    
      44
    
      45check() {
    
      46  cd "$_pyname-$pkgver"
    
      47  local python_version=$(python -c 'import sys; print("".join(map(str, sys.version_info[:2])))')
    
      48  mkdir tests/test_data
    
      49  for f in well1033 illc1033 well1850 illc1850
    
      50  do
    
      51    cp "$srcdir/$f"{,_rhs1}.mtx.gz tests/test_data
    
      52  done
    
      53  PYTHONPATH="$PWD/build/lib.linux-$CARCH-cpython-$python_version" pytest tests
    
      54}
    
      55

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2