python-slowapi

maintainer lmartinez-mirror · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from the project's own Git repository, which is a normal AUR practice; the recent maintainer change does not imply malicious intent or supply-chain risk in this case.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from the project's own Git repository, which is a normal AUR practice; the recent maintainer change does not imply malicious intent or supply-chain risk in this case.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

      1# Maintainer: Luis Martinez <luis dot martinez at disroot dot org>
    
      2# Contributor: LightDot <lightdot -a-t- server.si>
    
      3
    
      4pkgname=python-slowapi
    
      5pkgver=0.1.10
    
      6pkgrel=1
    
      7pkgdesc="A rate limiting extension for Starlette and Fastapi"
    
      8url="https://github.com/laurents/slowapi"
    
      9depends=(python python-limits)
    
      10makedepends=(git python-build python-installer python-wheel python-poetry-core)
    
      11license=(MIT)
    
      12arch=(any)
    
      13source=("$pkgname::git+$url#tag=v$pkgver?signed")
    
      14sha256sums=('da8062c2d16f653e1c9ed422333bfe2a1603a52f8923ec4083b6722b07776a49')
    
      15validpgpkeys=(3F2FEB2945E72B8A60EA15D81E7737FF61F9B5AC)
    
      16
    
      17build() {
    
      18    cd "$pkgname"
    
      19    python -m build --wheel --no-isolation
    
      20}
    
      21
    
      22package() {
    
      23    cd "$pkgname"
    
      24    python -m installer --destdir="$pkgdir" dist/*.whl
    
      25    local _site=$(python -c "import site; print(site.getsitepackages()[0])")
    
      26    install -d "$pkgdir/usr/share/licenses/$pkgname/"
    
      27    ln -s "$_site/slowapi-$pkgver.dist-info/licenses/LICENSE" \
    
      28        "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      29}
    
      30

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,27 +1,30 @@
-# Maintainer: LightDot <lightdot -a-t- server.si>
+# Maintainer: Luis Martinez <luis dot martinez at disroot dot org>
+# Contributor: LightDot <lightdot -a-t- server.si>
 
-pkgname='python-slowapi'
-_module='slowapi'
-_src_folder='slowapi-0.1.9'
-pkgver='0.1.9'
-pkgrel=2
+pkgname=python-slowapi
+pkgver=0.1.10
+pkgrel=1
 pkgdesc="A rate limiting extension for Starlette and Fastapi"
 url="https://github.com/laurents/slowapi"
-depends=('python')
-makedepends=('python-build' 'python-installer' 'python-wheel' 'python-poetry-core')
-license=('MIT')
-arch=('any')
-source=("https://files.pythonhosted.org/packages/a0/99/adfc7f94ca024736f061257d39118e1542bade7a52e86415a4c4ae92d8ff/slowapi-0.1.9.tar.gz")
-sha256sums=('639192d0f1ca01b1c6d95bf6c71d794c3a9ee189855337b4821f7f457dddad77')
+depends=(python python-limits)
+makedepends=(git python-build python-installer python-wheel python-poetry-core)
+license=(MIT)
+arch=(any)
+source=("$pkgname::git+$url#tag=v$pkgver?signed")
+sha256sums=('da8062c2d16f653e1c9ed422333bfe2a1603a52f8923ec4083b6722b07776a49')
+validpgpkeys=(3F2FEB2945E72B8A60EA15D81E7737FF61F9B5AC)
 
 build() {
-    cd "${srcdir}/${_src_folder}"
+    cd "$pkgname"
     python -m build --wheel --no-isolation
 }
 
 package() {
-    cd "${srcdir}/${_src_folder}"
-    python -m installer --destdir="${pkgdir}" dist/*.whl
-    install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
+    cd "$pkgname"
+    python -m installer --destdir="$pkgdir" dist/*.whl
+    local _site=$(python -c "import site; print(site.getsitepackages()[0])")
+    install -d "$pkgdir/usr/share/licenses/$pkgname/"
+    ln -s "$_site/slowapi-$pkgver.dist-info/licenses/LICENSE" \
+        "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
 }
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 21:18:19	MEDIUM	1
2026-06-18 16:11:54	CLEAN	0