sophus

maintainer orphaned · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The pip install is part of the project's own test suite, installing a fixed version of sympy for testing purposes, not executing untrusted or remote code in the package build or install process.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The pip install is part of the project's own test suite, installing a fixed version of sympy for testing purposes, not executing untrusted or remote code in the package build or install process.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:38 python -m pip install sympy==1.8 --ignore-installed

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Kino <cybao292261 at 163 dot com>
    
      2
    
      3pkgname=sophus
    
      4_pkgname=Sophus
    
      5pkgver=1.24.6
    
      6pkgrel=4
    
      7pkgdesc="C++ implementation of Lie Groups using Eigen"
    
      8arch=('x86_64')
    
      9url="https://github.com/strasdat/Sophus"
    
      10license=('MIT')
    
      11depends=('eigen' 'fmt')
    
      12makedepends=('cmake' 'python-build' 'python-installer' 'python-wheel')
    
      13checkdepends=('ceres-solver' 'python-pytest')
    
      14source=("$_pkgname-$pkgver.tar.gz::https://github.com/strasdat/Sophus/archive/${pkgver}.tar.gz")
    
      15sha256sums=('3f3098bdac2c74d42a921dbfb0e5e4b23601739e35a1c1236c2807c399da960c')
    
      16
    
      17prepare() {
    
      18  cd $_pkgname-$pkgver
    
      19  sed -i "s|-Werror|-Wno-error|g" CMakeLists.txt
    
      20}
    
      21
    
      22build() {
    
      23  cd $_pkgname-$pkgver
    
      24  cmake -B build -S . \
    
      25        -DCMAKE_INSTALL_PREFIX=/usr \
    
      26        -DCMAKE_BUILD_TYPE=Release \
    
      27        -DBUILD_SOPHUS_TESTS=ON \
    
      28        -Wno-dev
    
      29  cmake --build build
    
      30  python -m build --wheel --no-isolation
    
      31}
    
      32
    
      33check() {
    
      34  cd $_pkgname-$pkgver
    
      35  ctest --test-dir build --output-on-failure
    
      36  python -m venv venv --system-site-packages
    
      37  source venv/bin/activate
    
      38  python -m pip install sympy==1.8 --ignore-installed
    
      39  python -m installer dist/*.whl
    
      40  pushd sympy
    
      41  sh run_tests.sh
    
      42  popd
    
      43  python -m pytest sophus_pybind/tests/sophusPybindTests.py
    
      44  deactivate
    
      45}
    
      46
    
      47package() {
    
      48  cd $_pkgname-$pkgver
    
      49  DESTDIR="$pkgdir" cmake --install build
    
      50  python -m installer --destdir="$pkgdir" dist/*.whl
    
      51  install -Dm644 ${srcdir}/${_pkgname}-${pkgver}/LICENSE.txt "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.txt"
    
      52}
    
      53

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2