python-stpyv8

LOW

maintainer etbusch 0 votes scanned 2026-09-01 17:48:51.913915

View on AUR

Why flagged

The package vendors a prebuilt Python wheel from PyPI (pythonhosted.org), which is a trusted source; while the wheel is platform-specific and unverifiable at the source level, it is not obfuscated or executed remotely, and PyPI's integrity is well-maintained, making the risk low despite the lack of upstream source build.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package vendors a prebuilt Python wheel from PyPI (pythonhosted.org), which is a trusted source; while the wheel is platform-specific and unverifiable at the source level, it is not obfuscated or executed remotely, and PyPI's integrity is well-maintained, making the risk low despite the lack of upstream source build.

PKGBUILD

      1# Maintainer: Eric Busch <me@etbus.ch>
    
      2pkgname=python-stpyv8
    
      3pkgver=13.1.201.22
    
      4pkgrel=1
    
      5pkgdesc="Python 3 / V8 JavaScript engine interoperability (successor to PyV8), used by pypkjs for Pebble phone-simulator JS execution"
    
      6arch=('x86_64')
    
      7url="https://github.com/cloudflare/stpyv8"
    
      8license=('Apache-2.0')
    
      9depends=('python')
    
      10makedepends=('python-installer')
    
      11
    
      12# stpyv8 has no real sdist: it embeds a prebuilt V8 checkout and only
    
      13# ships platform/CPython-ABI-specific wheels (see cloudflare/stpyv8).
    
      14# This vendors the manylinux wheel matching Arch's current python
    
      15# (cp314 as of this writing). It WILL need pkgver/source/sha256 bumped
    
      16# to a matching wheel whenever Arch's system python moves to a new
    
      17# minor version and upstream has published one for it.
    
      18_whl="stpyv8-$pkgver-cp314-cp314-manylinux_2_35_x86_64.whl"
    
      19source=("https://files.pythonhosted.org/packages/ad/4e/d002dd7a724d64571c161b1f1b3f3258066becd666b0f5233a7b519a6432/$_whl")
    
      20sha256sums=('c0b258c7c5a79c5f19e636b93eece90d3cf9109af9a11c5394bdb807ed68e04a')
    
      21
    
      22package() {
    
      23  python -m installer --destdir="$pkgdir" "$_whl"
    
      24  install -Dm644 "$pkgdir"/usr/lib/python*/site-packages/stpyv8-*.dist-info/licenses/LICENSE.txt \
    
      25    "$pkgdir/usr/share/licenses/$pkgname/LICENSE.txt"
    
      26}
    
      27

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-01 17:48:51	Low	2