python-viztracer

LOW

maintainer kino_t 1 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The flagged 'pip install' occurs in the check() function within a temporary virtual environment to install a test dependency (loky) for running unit tests, which is a common and safe practice in Python packaging; the package otherwise builds and installs from verified source using standard tools.

Triggered rules

Low pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums. Severity reduced: python-* packages routinely use pip.

PKGBUILD:51 $PWD/venv/bin/python -m pip install loky

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-07-25) reviewed this and agrees it is LOW (confidence 95%): The flagged 'pip install' occurs in the check() function within a temporary virtual environment to install a test dependency (loky) for running unit tests, which is a common and safe practice in Python packaging; the package otherwise builds and installs from verified source using standard tools.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Kino <cybao292261@163.com>
    
      2# Contributor: PumpkinCheshire <me at pumpkincheshire dot com>
    
      3
    
      4pkgname=python-viztracer
    
      5_pkgname=viztracer
    
      6pkgver=1.1.1
    
      7pkgrel=2
    
      8pkgdesc='VizTracer is a low-overhead logging/debugging/profiling tool that can trace and visualize your python code execution.'
    
      9arch=('x86_64')
    
      10url="https://github.com/gaogaotiantian/viztracer"
    
      11license=('Apache-2.0')
    
      12depends=('python' 'python-objprint')
    
      13makedepends=(
    
      14  'python-wheel'
    
      15  'python-build'
    
      16  'python-installer'
    
      17)
    
      18optdepends=(
    
      19  'python-rich: Full function support'
    
      20  'python-orjson: Full function support'
    
      21  'chromium: browser to open html results'
    
      22)
    
      23source=("$_pkgname-$pkgver.tar.gz::https://github.com/gaogaotiantian/viztracer/archive/$pkgver.tar.gz")
    
      24sha512sums=('6ddaab573172f53f940bf2b66f8d384d63378baf4a0b2439e6a816e6aeae69ab44c423dcb1bac3ddd14092667ccfb5323abbc4562e239acbc7c50124726d6476')
    
      25b2sums=('a0fc3aca12a93443f1449000c39348f4dae7be80cfeaf6a4829875cc48df515c25dccd102df96f9cfc82c9faf184dedf7d46fa7c76f4eb94a44edcac507dc420')
    
      26
    
      27prepare() {
    
      28  cd "$srcdir/$_pkgname-$pkgver" || exit
    
      29
    
      30  # Disable it because the external processor is something that the script should download from google.
    
      31  sed -i "s|use_external_processor=True|use_external_processor=False|g" tests/test_viewer.py
    
      32
    
      33  # Attach is not working, this is some black magic and is OS-dependent.
    
      34  rm tests/test_remote.py
    
      35}
    
      36
    
      37build() {
    
      38  cd "$srcdir/$_pkgname-$pkgver" || exit
    
      39
    
      40  CFLAGS=$(sed "s/-Wp,-D_FORTIFY_SOURCE=[2-3]\s//g" <(echo $CFLAGS))
    
      41  CXXFLAGS=$(sed "s/-Wp,-D_FORTIFY_SOURCE=[2-3]\s//g" <(echo $CXXFLAGS))
    
      42
    
      43  python -m build --wheel --no-isolation
    
      44}
    
      45
    
      46check() {
    
      47  cd "$srcdir/$_pkgname-$pkgver" || exit
    
      48  # From upstream, virtual environment is highly recommended.
    
      49  python -m venv venv --system-site-packages
    
      50  source venv/bin/activate
    
      51  $PWD/venv/bin/python -m pip install loky
    
      52  $PWD/venv/bin/python -m installer dist/*.whl
    
      53  $PWD/venv/bin/python -m unittest
    
      54  deactivate # existing in virtual environment
    
      55}
    
      56
    
      57package() {
    
      58  cd "$srcdir/$_pkgname-$pkgver" || exit
    
      59  python -m installer --destdir="$pkgdir" dist/*.whl
    
      60  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      61}
    
      62

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2