python-viztracer

maintainer kino_t · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The flagged 'pip install' occurs in the check() function within a temporary virtual environment to install a test dependency (loky) for running unit tests, which is a common and safe practice in Python packaging; the package otherwise builds and installs from verified source using standard tools.

Triggered rules

LOW pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums. Severity reduced: python-* packages routinely use pip.

PKGBUILD:51 $PWD/venv/bin/python -m pip install loky

LOW AI review llm_review

An AI model (qwen/qwen3-235b-a22b-07-25) reviewed this and agrees it is LOW (confidence 95%): The flagged 'pip install' occurs in the check() function within a temporary virtual environment to install a test dependency (loky) for running unit tests, which is a common and safe practice in Python packaging; the package otherwise builds and installs from verified source using standard tools.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Kino <cybao292261@163.com>
    
      2# Contributor: PumpkinCheshire <me at pumpkincheshire dot com>
    
      3
    
      4pkgname=python-viztracer
    
      5_pkgname=viztracer
    
      6pkgver=1.1.1
    
      7pkgrel=2
    
      8pkgdesc='VizTracer is a low-overhead logging/debugging/profiling tool that can trace and visualize your python code execution.'
    
      9arch=('x86_64')
    
      10url="https://github.com/gaogaotiantian/viztracer"
    
      11license=('Apache-2.0')
    
      12depends=('python' 'python-objprint')
    
      13makedepends=(
    
      14  'python-wheel'
    
      15  'python-build'
    
      16  'python-installer'
    
      17)
    
      18optdepends=(
    
      19  'python-rich: Full function support'
    
      20  'python-orjson: Full function support'
    
      21  'chromium: browser to open html results'
    
      22)
    
      23source=("$_pkgname-$pkgver.tar.gz::https://github.com/gaogaotiantian/viztracer/archive/$pkgver.tar.gz")
    
      24sha512sums=('6ddaab573172f53f940bf2b66f8d384d63378baf4a0b2439e6a816e6aeae69ab44c423dcb1bac3ddd14092667ccfb5323abbc4562e239acbc7c50124726d6476')
    
      25b2sums=('a0fc3aca12a93443f1449000c39348f4dae7be80cfeaf6a4829875cc48df515c25dccd102df96f9cfc82c9faf184dedf7d46fa7c76f4eb94a44edcac507dc420')
    
      26
    
      27prepare() {
    
      28  cd "$srcdir/$_pkgname-$pkgver" || exit
    
      29
    
      30  # Disable it because the external processor is something that the script should download from google.
    
      31  sed -i "s|use_external_processor=True|use_external_processor=False|g" tests/test_viewer.py
    
      32
    
      33  # Attach is not working, this is some black magic and is OS-dependent.
    
      34  rm tests/test_remote.py
    
      35}
    
      36
    
      37build() {
    
      38  cd "$srcdir/$_pkgname-$pkgver" || exit
    
      39
    
      40  CFLAGS=$(sed "s/-Wp,-D_FORTIFY_SOURCE=[2-3]\s//g" <(echo $CFLAGS))
    
      41  CXXFLAGS=$(sed "s/-Wp,-D_FORTIFY_SOURCE=[2-3]\s//g" <(echo $CXXFLAGS))
    
      42
    
      43  python -m build --wheel --no-isolation
    
      44}
    
      45
    
      46check() {
    
      47  cd "$srcdir/$_pkgname-$pkgver" || exit
    
      48  # From upstream, virtual environment is highly recommended.
    
      49  python -m venv venv --system-site-packages
    
      50  source venv/bin/activate
    
      51  $PWD/venv/bin/python -m pip install loky
    
      52  $PWD/venv/bin/python -m installer dist/*.whl
    
      53  $PWD/venv/bin/python -m unittest
    
      54  deactivate # existing in virtual environment
    
      55}
    
      56
    
      57package() {
    
      58  cd "$srcdir/$_pkgname-$pkgver" || exit
    
      59  python -m installer --destdir="$pkgdir" dist/*.whl
    
      60  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      61}
    
      62

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2