semgrep-bin

maintainer ejedev · 9 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package installs a prebuilt Python wheel from PyPI, which is a standard and trusted source for Python packages; the wheel is for the same project being packaged and matches the declared version, making this a normal AUR packaging practice with low risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package installs a prebuilt Python wheel from PyPI, which is a standard and trusted source for Python packages; the wheel is for the same project being packaged and matches the declared version, making this a normal AUR packaging practice with low risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:64 PIP_CONFIG_FILE=/dev/null pip install --isolated --root="${pkgdir}" --ignore-installed --no-warn-script-location --root-user-action ignore --no-deps "${_whl}"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Rafael Dominiquini <rafaeldominiquini at gmail dot com>
    
      2# Contributor: ejedev <evan@ejedev.com>
    
      3# Contributor: Aloxaf <aloxafx@gmail.com>
    
      4# Contributor: username227
    
      5
    
      6_name=semgrep
    
      7pkgname=${_name}-bin
    
      8pkgver=1.172.0
    
      9pkgrel=1
    
      10pkgdesc="Lightweight static analysis for many languages. Find bug variants with patterns that look like source code."
    
      11arch=('x86_64')
    
      12url="https://github.com/returntocorp/${_name}"
    
      13# _urlraw="https://raw.githubusercontent.com/returntocorp/${_name}/v${pkgver}"
    
      14_urlraw="https://raw.githubusercontent.com/returntocorp/${_name}/develop"
    
      15license=('LGPL-2.1-only')
    
      16
    
      17makedepends=('python-pip' 'python-setuptools' 'python-wheel')
    
      18depends=(
    
      19  'python>=3.14'
    
      20  'python-attrs'
    
      21  'python-boltons'
    
      22  'python-click'
    
      23  'python-click-option-group'
    
      24  'python-colorama'
    
      25  'python-glom'
    
      26  'python-jsonschema'
    
      27  'python-packaging'
    
      28  'python-peewee'
    
      29  'python-requests'
    
      30  'python-rich'
    
      31  'python-ruamel-yaml'
    
      32  'python-toml'
    
      33  'python-tomli'
    
      34  'python-typing_extensions'
    
      35  'python-urllib3'
    
      36  'python-wcmatch'
    
      37  'python-pydantic'
    
      38  'python-starlette'
    
      39  'python-mcp'
    
      40  'python-semantic-version'
    
      41  'python-opentelemetry-api'
    
      42  'python-opentelemetry-sdk'
    
      43  'python-opentelemetry-instrumentation-requests'
    
      44  'python-opentelemetry-instrumentation-threading'
    
      45)
    
      46optdepends=('jsonnet: experimental jsonnet support')
    
      47provides=("${_name}")
    
      48
    
      49_b2sum="84a521624510b65271a673961a894af7511b5123d662e84c74c765560ea28b27"
    
      50_whl="${_name}-${pkgver}-cp310.cp311.cp312.cp313.cp314.py310.py311.py312.py313.py314-none-manylinux_2_34_${CARCH}.whl"
    
      51
    
      52options=('!strip')
    
      53noextract=("${_whl}")
    
      54
    
      55source=("https://files.pythonhosted.org/packages/${_b2sum:0:2}/${_b2sum:2:2}/${_b2sum:4}/${_whl}"
    
      56        "README-${pkgver}.md::${_urlraw}/README.md"
    
      57        "LICENSE-${pkgver}::${_urlraw}/LICENSE")
    
      58sha512sums=('a1019086fb4f79069695f404d4cae9be875843e61f1c8bb10eedba4638b93a43c79967a87c49a37c46cdf5cc10387a424461606067797744c2304e480b03a512'
    
      59            '0add923c611511754f6c0baaa435e805cb3677fcb059af0bd867e2dda7c25525b9ff67da53975298ebf87f1265c8a2cf846adcf775d447e527874fc430b64551'
    
      60            'dec798f85edac11b3a3f4bb1f309397719dd4de04f66357a5520b23e758cba757c9c7bee87bdbae2a5f936368cab0670bbd3395030393c029d68d0e72fcfba1e')
    
      61
    
      62
    
      63package() {
    
      64  PIP_CONFIG_FILE=/dev/null pip install --isolated --root="${pkgdir}" --ignore-installed --no-warn-script-location --root-user-action ignore --no-deps "${_whl}"
    
      65
    
      66  python -O -m compileall "${pkgdir}"
    
      67
    
      68  install -Dm644 "README-${pkgver}.md" "${pkgdir}/usr/share/doc/${pkgname}/README.md"
    
      69
    
      70  install -Dm644 "LICENSE-${pkgver}" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      71}
    
      72

Changes since previous scan

--- PKGBUILD @ 2026-07-29 00:25
+++ PKGBUILD @ 2026-08-03 00:08
@@ -5,7 +5,7 @@
 
 _name=semgrep
 pkgname=${_name}-bin
-pkgver=1.171.0
+pkgver=1.172.0
 pkgrel=1
 pkgdesc="Lightweight static analysis for many languages. Find bug variants with patterns that look like source code."
 arch=('x86_64')
@@ -46,7 +46,7 @@
 optdepends=('jsonnet: experimental jsonnet support')
 provides=("${_name}")
 
-_b2sum="79b9269d27f2c7d03efaa28ec928d900ee650e581b8b05e7308dbe5d68ba78a7"
+_b2sum="84a521624510b65271a673961a894af7511b5123d662e84c74c765560ea28b27"
 _whl="${_name}-${pkgver}-cp310.cp311.cp312.cp313.cp314.py310.py311.py312.py313.py314-none-manylinux_2_34_${CARCH}.whl"
 
 options=('!strip')
@@ -55,7 +55,7 @@
 source=("https://files.pythonhosted.org/packages/${_b2sum:0:2}/${_b2sum:2:2}/${_b2sum:4}/${_whl}"
         "README-${pkgver}.md::${_urlraw}/README.md"
         "LICENSE-${pkgver}::${_urlraw}/LICENSE")
-sha512sums=('19c929ea5726de5b481e83892252852d9a4f1a9cd8237a5678354542a055d23f380ce8e4f10093674d9397c85b3e2949b1d39643eefa52e438820c19baf1cb11'
+sha512sums=('a1019086fb4f79069695f404d4cae9be875843e61f1c8bb10eedba4638b93a43c79967a87c49a37c46cdf5cc10387a424461606067797744c2304e480b03a512'
             '0add923c611511754f6c0baaa435e805cb3677fcb059af0bd867e2dda7c25525b9ff67da53975298ebf87f1265c8a2cf846adcf775d447e527874fc430b64551'
             'dec798f85edac11b3a3f4bb1f309397719dd4de04f66357a5520b23e758cba757c9c7bee87bdbae2a5f936368cab0670bbd3395030393c029d68d0e72fcfba1e')
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 03:10:20	MEDIUM	1
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 01:22:21	MEDIUM	1
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2