q2-taxa

LOW

maintainer Smoolak 0 votes scanned 2026-11-02 00:26:00.633185

View on AUR

Why flagged

The non-standard host (data.qiime2.org) is the official QIIME 2 data repository used for usage examples; the downloaded .qza and .tsv files are data artifacts (not executed code), all sources have pinned SHA256 checksums, and the build follows standard Python wheel packaging with npm for frontend assets from the project's own GitHub source.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 75%): The non-standard host (data.qiime2.org) is the official QIIME 2 data repository used for usage examples; the downloaded .qza and .tsv files are data artifacts (not executed code), all sources have pinned SHA256 checksums, and the build follows standard Python wheel packaging with npm for frontend assets from the project's own GitHub source.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:18 "usage-gut-table.qza::https://data.qiime2.org/usage-examples/moving-pictures/gut-table.qza"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Smoolak <smoolak@gmail.com>
    
      2
    
      3pkgname=q2-taxa
    
      4pkgver=2026.10.0
    
      5pkgrel=1
    
      6pkgdesc='QIIME 2 taxonomic analysis and interactive visualizations'
    
      7arch=(any)
    
      8url=https://github.com/qiime2/q2-taxa
    
      9license=(BSD-3-Clause Apache-2.0 MIT ISC)
    
      10depends=('python' 'python-qiime2>=2026.10.0' 'python-q2-types>=2026.10.0' 'python-q2templates>=2026.10.0' 'python-biom-format' 'python-numpy' 'python-pandas')
    
      11makedepends=('python-build' 'python-installer' 'python-setuptools' 'python-versioningit' 'python-wheel' 'nodejs' 'npm')
    
      12checkdepends=('python-pytest' 'python-selenium' 'chromium')
    
      13_commit=8e3727c59f15056d004a2c9926f6deef5ce19d29
    
      14source=("$pkgname-$pkgver.tar.gz::$url/archive/$_commit.tar.gz"
    
      15        barplot-package-lock.json package-lock.json copy-frontend-licenses.py
    
      16        runtime-modules.js vite.config.ts
    
      17        offline_usage_tests.py preserve-first-sample.patch
    
      18        "usage-gut-table.qza::https://data.qiime2.org/usage-examples/moving-pictures/gut-table.qza"
    
      19        "usage-taxonomy.qza::https://raw.githubusercontent.com/qiime2/q2-feature-table/92201e4db69880e2741a233509e24161dfacfa8b/q2_feature_table/tests/data/moving-pics-taxonomy-gg-13-8.qza"
    
      20        "usage-sample-metadata.tsv::https://data.qiime2.org/usage-examples/moving-pictures/sample-metadata.tsv")
    
      21sha256sums=('39bf81b89ad8ea37974da8fd418037f03c45115cdd4749a0598c0430d37aca90'
    
      22            '62c681f086f200fea392621658696ea42f04a97e6ad053e6bb895c5e5535f264'
    
      23            '67afa721dc00820651e228b957bb148300549e29a83ca209611c4b6a2b6f055a'
    
      24            'fb6964131d2aa15ce2728971b31005677cc1ebb8902d785cf92af312641eb39a'
    
      25            'bd88877adbf2eb48829dbb9e5b134e63a0e26257c3cc46f21d8e0d4e7f2a26dc'
    
      26            '78e9ac294806e09d605b2f3da07e59b141b2ef65da5a272cf9da42722bbaccf4'
    
      27            '35719bbede7f621b09095c8447dd47381be3719c9224725c7cc1495bb12f5d19'
    
      28            '567e58fde2647c4eca85242502495ab7dd899b04a28a68e644e6700b18fe9ffe'
    
      29            '60a0a9455dc68cefb37025df94e027c8cef47be111ea15d2b9492fab6d68c729'
    
      30            'f70c443f09f6e5803225615950507910dc866a3e3102c13afd4317bb5ffca317'
    
      31            '9dbfbedd90776d77c431faa914d81b0d6299fff10c364216dbcd5c6df5382cc9')
    
      32noextract=('usage-gut-table.qza' 'usage-taxonomy.qza')
    
      33
    
      34prepare() {
    
      35  cd "q2-taxa-$_commit"
    
      36  patch -Np1 -i "$srcdir/preserve-first-sample.patch"
    
      37  cp "$srcdir/barplot-package-lock.json" q2_taxa/assets/barplot/package-lock.json
    
      38  cp "$srcdir/package-lock.json" q2_taxa/_barplot_visualizer/package-lock.json
    
      39  cp "$srcdir/runtime-modules.js" "$srcdir/vite.config.ts" q2_taxa/_barplot_visualizer/
    
      40  npm ci --prefix q2_taxa/assets/barplot --legacy-peer-deps --no-audit --no-fund
    
      41  npm ci --prefix q2_taxa/_barplot_visualizer --legacy-peer-deps --no-audit --no-fund
    
      42}
    
      43
    
      44build() {
    
      45  cd "q2-taxa-$_commit"
    
      46  npm run build --prefix q2_taxa/assets/barplot
    
      47  cp q2_taxa/assets/barplot/licenses/* q2_taxa/assets/barplot/dist/
    
      48  npm run build --prefix q2_taxa/_barplot_visualizer
    
      49  python "$srcdir/copy-frontend-licenses.py"
    
      50  python -m build --wheel --no-isolation
    
      51}
    
      52
    
      53check() {
    
      54  # Upstream make test builds both frontends and runs pytest. Its separate
    
      55  # developer TypeScript checker is not part of that test target.
    
      56  python -m venv --system-site-packages --without-pip "$srcdir/check-env"
    
      57  "$srcdir/check-env/bin/python" -m installer "q2-taxa-$_commit"/dist/*.whl
    
      58  local site_packages
    
      59  site_packages=$("$srcdir/check-env/bin/python" -I -c 'import sysconfig; print(sysconfig.get_path("purelib"))')
    
      60  install -m644 "$srcdir/offline_usage_tests.py" "$site_packages/aur_q2_usage_fixtures.py"
    
      61  Q2_TEST_FIXTURES="$srcdir" MPLBACKEND=Agg "$srcdir/check-env/bin/python" -I - --import-mode=importlib -v \
    
      62    -p aur_q2_usage_fixtures --pyargs q2_taxa --junitxml="$srcdir/pytest-results.xml" <<'PYTEST'
    
      63from pathlib import Path
    
      64import sys
    
      65import pytest
    
      66import q2_taxa
    
      67
    
      68installed = Path(q2_taxa.__file__).resolve().parent
    
      69assert installed.is_relative_to(Path(sys.prefix).resolve()), installed
    
      70status = pytest.main(sys.argv[1:])
    
      71for name, module in tuple(sys.modules.items()):
    
      72    if name != 'q2_taxa' and not name.startswith('q2_taxa.'):
    
      73        continue
    
      74    origin = getattr(module, '__file__', None)
    
      75    if origin is None or 'tests' in name.split('.')[1:]:
    
      76        continue
    
      77    path = Path(origin).resolve()
    
      78    assert path.is_relative_to(installed), (name, path)
    
      79print('Installed runtime origin check passed:', installed)
    
      80raise SystemExit(status)
    
      81PYTEST
    
      82}
    
      83
    
      84package() {
    
      85  cd "q2-taxa-$_commit"
    
      86  python -m installer --destdir="$pkgdir" dist/*.whl
    
      87  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      88  cp -r q2_taxa/assets/barplot/dist/third-party-licenses "$pkgdir/usr/share/licenses/$pkgname/legacy"
    
      89  cp -r q2_taxa/_barplot_visualizer/dist/third-party-licenses "$pkgdir/usr/share/licenses/$pkgname/modern"
    
      90}
    
      91

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-02 00:26:00	Low	3
2026-11-01 22:05:28	Low	3
2026-11-01 22:01:45	Medium	2