python-web3

LOW

maintainer Xeonacid 2 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

The package downloads a Geth binary from Microsoft's official Azure blob storage, which is used solely for testing against a pinned version; the binary is not installed, and the source is verifiable via checksum.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a Geth binary from Microsoft's official Azure blob storage, which is used solely for testing against a pinned version; the binary is not installed, and the source is verifiable via checksum.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:18 https://gethstore.blob.core.windows.net/builds/geth-linux-amd64-$_geth_ver-$_geth_commit.tar.gz)

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Xeonacid <h.dwwwwww@gmail.com>
    
      2
    
      3_name=web3.py
    
      4pkgname=python-web3
    
      5pkgver=8.0.0
    
      6pkgrel=2
    
      7pkgdesc="A python interface for interacting with the Ethereum blockchain and ecosystem."
    
      8arch=(any)
    
      9url="https://github.com/ethereum/${_name}"
    
      10license=(MIT)
    
      11depends=(python python-eth-abi python-eth-account python-eth-hash python-eth-keys python-eth-typing python-eth-utils python-hexbytes python-aiohttp python-pydantic python-requests python-typing_extensions python-websockets python-pyunormalize python-toolz python-rlp python-idna)
    
      12makedepends=(git python-build python-installer python-setuptools python-setuptools-scm python-wheel python-sphinx python-sphinx_rtd_theme)
    
      13checkdepends=(python-pytest python-pytest-asyncio python-pytest-mock python-flaky python-eth-tester python-hypothesis python-py-geth python-cached-property)
    
      14# Pin the geth binary to the version of tests/integration/geth-*-fixture.zip (CI GETH_VERSION).
    
      15_geth_ver=1.16.7
    
      16_geth_commit=b9f3a3d9
    
      17source=(git+$url.git#tag=v$pkgver
    
      18        https://gethstore.blob.core.windows.net/builds/geth-linux-amd64-$_geth_ver-$_geth_commit.tar.gz)
    
      19sha512sums=('8a875884a7c63655b7509d526680103a0b61a0bcdc55e210b78c56a34f57faf0c5b26c855f491dad7a06826aa23f10e12f556c56830777cb7a2621e606ba7d75'
    
      20            'e8e016044ce8cf73ba9a91377cb11703a5ba9c6cb89f67bdc31c1c063e1552d4bc0f80dcc84f8fbc6780be8d79287f0c22e3db01f4ee02faff399339257e050c')
    
      21
    
      22build() {
    
      23  cd $_name
    
      24  python -m build --wheel --no-isolation
    
      25  python -m installer --destdir=tmp_install dist/*.whl
    
      26  local site_packages=$(python -c "import site; print(site.getsitepackages()[0])")
    
      27  PYTHONPATH="$PWD/tmp_install$site_packages" make -C docs man
    
      28}
    
      29
    
      30# Very slow
    
      31check() {
    
      32  cd $_name
    
      33  python -m venv --system-site-packages test-env
    
      34  test-env/bin/python -m installer dist/*.whl
    
      35  # Beacon tests need a live consensus client; upstream CI does not run them.
    
      36  local pytest_args=(tests/core tests/ens tests/integration/test_ethereum_tester.py)
    
      37  # go-ethereum tests pin a geth fixture zip; use the matching official binary.
    
      38  local geth_bin="$srcdir/geth-linux-amd64-$_geth_ver-$_geth_commit/geth"
    
      39  if [[ -x $geth_bin ]]; then
    
      40    export GETH_BINARY=$geth_bin
    
      41    pytest_args+=(tests/integration/go_ethereum)
    
      42  fi
    
      43  test-env/bin/python -m pytest -vv --showlocals "${pytest_args[@]}"
    
      44}
    
      45
    
      46package() {
    
      47  cd $_name
    
      48  python -m installer --destdir="$pkgdir" dist/*.whl
    
      49  local site_packages=$(python -c "import site; print(site.getsitepackages()[0])")
    
      50  rm -rf "$pkgdir$site_packages"/docs
    
      51  install -Dm644 docs/_build/man/web3.1 -t "$pkgdir/usr/share/man/man1"
    
      52  install -Dm644 LICENSE -t "$pkgdir/usr/share/licenses/$pkgname"
    
      53  install -Dm644 README.md -t "$pkgdir/usr/share/doc/$pkgname"
    
      54}
    
      55

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2
2026-10-13 00:23:45	Low	2
2026-10-12 00:18:51	Low	2
2026-10-11 00:26:05	Low	2
2026-10-10 00:11:52	Low	2
2026-10-09 00:05:33	Low	2
2026-10-08 00:28:03	Low	2
2026-10-07 00:21:34	Low	2
2026-10-06 00:13:36	Low	2
2026-10-05 00:08:03	Low	2
2026-10-04 00:18:08	Low	2
2026-10-03 00:23:04	Low	2
2026-10-02 00:00:32	Low	2
2026-10-01 00:02:06	Low	2
2026-09-30 00:20:07	Low	2
2026-09-29 00:07:46	Low	2
2026-09-28 00:28:32	Low	2