rachis-cli

CLEAN

maintainer Smoolak 0 votes scanned 2026-11-02 00:26:00.633185

View on AUR

Triggered rules

Clean AI review downgraded a static finding llm_review

The static rules flagged this LOW, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it CLEAN (confidence 95%): The package builds from verifiable project-owned sources (GitHub), includes license files, applies a minor patch, and uses standard build tools; no untrusted remote code execution or malicious behavior is present.

1 higher static finding superseded - not the current verdict (shown for transparency)

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

PKGBUILD

      1# Maintainer: Smoolak <smoolak@gmail.com>
    
      2
    
      3pkgname=rachis-cli
    
      4pkgver=2026.10.0
    
      5pkgrel=1
    
      6pkgdesc='Command line interface and artifact viewer for the Rachis framework'
    
      7arch=(any)
    
      8url=https://github.com/rachis-org/rachis-cli
    
      9license=(BSD-3-Clause MIT Zlib AGPL-3.0-or-later CC-BY-SA-3.0)
    
      10depends=('python' 'python-rachis>=2026.10.0' 'python-q2templates>=2026.10.0' 'python-click>=8.5' 'python-tomlkit' 'python-setuptools')
    
      11makedepends=('python-build' 'python-installer' 'python-setuptools' 'python-versioningit' 'python-wheel' 'nodejs' 'npm')
    
      12checkdepends=('python-pytest' 'python-selenium' 'chromium')
    
      13optdepends=('python-pytest: run the shipped CLI test suite'
    
      14            'xdg-utils: open artifact views in the default desktop browser')
    
      15_commit=2602df0bed35d79c418b2fa8e4a2561337097f18
    
      16_view_commit=5ee9aee6564e94c2d84ed41e10429fe2ed344b1a
    
      17source=("$pkgname-$pkgver.tar.gz::$url/archive/$_commit.tar.gz"
    
      18        "q2view-$_view_commit.tar.gz::https://github.com/qiime2/q2view/archive/$_view_commit.tar.gz"
    
      19        "resolve-ef9e9dae6ccced153292eead6dfbc040ae680a95.tar.gz::https://codeload.github.com/tapjs/resolve/tar.gz/ef9e9dae6ccced153292eead6dfbc040ae680a95"
    
      20        package-lock.json click-8.5.patch
    
      21        q2view-runtime-modules.js q2view-vite.config.ts copy-viewer-licenses.py
    
      22        "citeproc-73bc1b44bc7d54d0bfec4e070fd27f5efe024ff9.tar.gz::https://codeload.github.com/Juris-M/citeproc-js/tar.gz/73bc1b44bc7d54d0bfec4e070fd27f5efe024ff9"
    
      23        "MIT.txt::https://raw.githubusercontent.com/spdx/license-list-data/d46e94e2c78ceede1cfc63cfa0396472d2798d4c/text/MIT.txt"
    
      24        "AGPL-3.0-or-later.txt::https://raw.githubusercontent.com/spdx/license-list-data/d46e94e2c78ceede1cfc63cfa0396472d2798d4c/text/AGPL-3.0-or-later.txt"
    
      25        "CC-BY-SA-3.0.txt::https://raw.githubusercontent.com/spdx/license-list-data/d46e94e2c78ceede1cfc63cfa0396472d2798d4c/text/CC-BY-SA-3.0.txt")
    
      26sha256sums=('f09eba1a708d9235a33d65d5e6ab7cb06d5e555606a44e687f9564f00971c406'
    
      27            '12eaa8b859da996f3783eb2ec03ba1e1a55a9449cc521daf9aeec65819c36423'
    
      28            'a83cdd3bb9b3abd07365e4320e237d589292b2690c070624126828dd3a062528'
    
      29            'aeac463eec3598be0895558572f50b05e38e8fac150d4dd5e95484dcc5d81c95'
    
      30            '069de1c054d7e0000883ef8f0b8e369d7fd8da62db6e957f473bd5bf65463870'
    
      31            'bd88877adbf2eb48829dbb9e5b134e63a0e26257c3cc46f21d8e0d4e7f2a26dc'
    
      32            'fd702e735ab7bdbff8792b8c51ae489f511ffd5aafa4f7bffdd3f6be6fcf8186'
    
      33            '01c6ddbbb726925eae200fb978612f3d4c1b4ce4ab5af7b32e62ad7c0326408a'
    
      34            'da00c73384be59e634dbbab912345f0199fae2913f501aa9d08eef7ee1d8abd4'
    
      35            'b05785f9f18e6716bab63424b11454513b9943a222595b70411009202fc592b5'
    
      36            'd8a6cc31abc16b6748c7a21f21611f5a1ec33f67d22ca23d7da1c19b95496bee'
    
      37            '3f941b3b89cf7b8370ceb83cc76d2120d471b58735d8ca60238a751a48d7f72f')
    
      38
    
      39prepare() {
    
      40  patch -d "rachis-cli-$_commit" -Np1 -i "$srcdir/click-8.5.patch"
    
      41  cp -r "q2view-$_view_commit"/. "rachis-cli-$_commit/q2view/"
    
      42  cp q2view-runtime-modules.js "rachis-cli-$_commit/q2view/"
    
      43  cp q2view-vite.config.ts "rachis-cli-$_commit/q2view/vite.config.ts"
    
      44  # Retain upstream's resolve fork while fetching its pinned source over HTTPS.
    
      45  cp package-lock.json "rachis-cli-$_commit/q2view/package-lock.json"
    
      46  # npm 12 requires opt-in for the pinned transitive source tarball.
    
      47  npm ci --prefix "rachis-cli-$_commit/q2view" --allow-remote=all --no-audit --no-fund
    
      48}
    
      49
    
      50build() {
    
      51  cd "rachis-cli-$_commit"
    
      52  npm_config_vendor_dir=../rachis_cli/assets/view npm run vendor --prefix q2view
    
      53  python "$srcdir/copy-viewer-licenses.py" "$srcdir"
    
      54  python -m build --wheel --no-isolation
    
      55}
    
      56
    
      57check() {
    
      58  local check_status=0
    
      59  npm test --prefix "rachis-cli-$_commit/q2view" -- --run || check_status=1
    
      60  python -m venv --system-site-packages --without-pip "$srcdir/check-env"
    
      61  "$srcdir/check-env/bin/python" -m installer "rachis-cli-$_commit"/dist/*.whl
    
      62  PATH="$srcdir/check-env/bin:$PATH" Q2CLIDEV=1 QIIMETEST=1 MPLBACKEND=Agg "$srcdir/check-env/bin/python" -I - --import-mode=importlib -v \
    
      63    "rachis-cli-$_commit/rachis_cli" --junitxml="$srcdir/pytest-results.xml" <<'PYTEST' || check_status=1
    
      64from pathlib import Path
    
      65import sys
    
      66import pytest
    
      67import rachis_cli
    
      68
    
      69installed = Path(rachis_cli.__file__).resolve().parent
    
      70assert installed.is_relative_to(Path(sys.prefix).resolve()), installed
    
      71status = pytest.main(sys.argv[1:])
    
      72for name, module in tuple(sys.modules.items()):
    
      73    if name != 'rachis_cli' and not name.startswith('rachis_cli.'):
    
      74        continue
    
      75    origin = getattr(module, '__file__', None)
    
      76    if origin is None or 'tests' in name.split('.')[1:]:
    
      77        continue
    
      78    path = Path(origin).resolve()
    
      79    assert path.is_relative_to(installed), (name, path)
    
      80print('Installed runtime origin check passed:', installed)
    
      81raise SystemExit(status)
    
      82PYTEST
    
      83  return "$check_status"
    
      84}
    
      85
    
      86package() {
    
      87  cd "rachis-cli-$_commit"
    
      88  python -m installer --destdir="$pkgdir" dist/*.whl
    
      89  install -dm755 "$pkgdir/usr/share/licenses/$pkgname"
    
      90  cp -r rachis_cli/assets/view/third-party-licenses "$pkgdir/usr/share/licenses/$pkgname/viewer"
    
      91  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      92  install -Dm644 q2view/LICENSE "$pkgdir/usr/share/licenses/$pkgname/q2view-LICENSE"
    
      93  install -Dm644 "$srcdir/resolve-ef9e9dae6ccced153292eead6dfbc040ae680a95/LICENSE" \
    
      94    "$pkgdir/usr/share/licenses/$pkgname/resolve-LICENSE"
    
      95}
    
      96

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-02 00:26:00	Clean	2
2026-11-01 22:01:45	Low	1