stackless2

maintainer vitaliikuzhdin · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds Stackless Python from source hosted on GitHub, a plausible project-owned repository, and applies patches from a Gentoo developer's domain; the non-whitelisted host is for supplemental patches, not executable code, and the worst case is limited to patch tampering, not remote code execution.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds Stackless Python from source hosted on GitHub, a plausible project-owned repository, and applies patches from a Gentoo developer's domain; the non-whitelisted host is for supplemental patches, not executable code, and the worst case is limited to patch tampering, not remote code execution.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:54 "https://dev.gentoo.org/~mgorny/dist/python/python-gentoo-patches-${_pkgver%%slp*}_${pkgver##*+}.tar.xz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer:  Vitalii Kuzhdin <vitaliikuzhdin@gmail.com>
    
      2
    
      3_basename="stackless"
    
      4pkgver=2.7.18slp+p16
    
      5_pkgver="${pkgver%%+*}"
    
      6_api="${_pkgver%.*}"
    
      7pkgrel=1
    
      8pkgname="${_basename}${pkgver%%.*}"
    
      9pkgdesc="The Stackless Python programming language"
    
      10arch=('x86_64')
    
      11_url="https://github.com/stackless-dev/${_basename}"
    
      12url="${_url}/wiki"
    
      13license=('PSF-2.0')
    
      14depends=(
    
'bzip2'
    
'expat'
    
'gdbm'
    
'glibc'
    
'libffi'
    
'libnsl'
    
'libxcrypt'
    
'ncurses'
    
'openssl-1.1'
    
'readline'
    
'sqlite'
    
'zlib'
    
      27)
    
      28makedepends=(
    
'tk'
    
'bluez-libs'
    
      31)
    
      32checkdepends=(
    
'gdb'
    
'file'
    
'xorg-server-xvfb'
    
'xterm'
    
      37)
    
      38optdepends=(
    
'tk: for IDLE'
    
      40)
    
      41provides=(
    
"python${_api}"
    
"python${_api%.*}"
    
      44)
    
      45conflicts=(
    
"${provides[@]}"
    
'python<3'
    
      48)
    
      49options=(
    
# '!lto'
    
      51)
    
      52_pkgsrc="${_url##*/}-${_pkgver//slp/-slp}"
    
      53source=("${_pkgsrc}.tar.gz::${_url}/archive/refs/tags/v${_pkgver//slp/-slp}.tar.gz"
    
      "https://dev.gentoo.org/~mgorny/dist/python/python-gentoo-patches-${_pkgver%%slp*}_${pkgver##*+}.tar.xz"
    
      "python2_mtime_workaround.patch"
    
      "${pkgname}_no_common.patch")
    
      57md5sums=('c818ced6fab6c5a04fb080268bc4989d'
    
       'b3016e44847e7106f5979d40fbccf8d7'
    
       'bc8dedb8d9eb85e40053822fbcaf4f55'
    
       'ad214569b2e7fe25a39c316e0cd60e90')
    
      61b2sums=('2209ca0a81dae6ca03ea89dddcefe48a8dd8e1e521b695f6011378e8889287031a1c11753e794a13f85b505b10f73455f26ece620bb422b812c8ac5c1fb27e6c'
    
      '0139c0944f62f9cdd236f6a8557e0ed19704c7d72869af1cb7d8bd3e646a746cd4a0201e1b44232a5e78ef49f254db20b0d0271bf744fbfd4fe0f1e99b8f3e6c'
    
      '55849d8960f0e5dc7b60a604f3264e12a80707db5bfb7d5c2fd6ceada894dc846a77a9fe2294bbdb6f87213a9b2051c7c6614ac6e0faf71bc947d3d96da5b2e4'
    
      '02096b756d284fcb9ee60c46796e630b0988a1a950e51b93f771335649fed11781c7d5cd8cf522b5f4ec4e5da1171806333c177b4c8a41a12e9743287d5a6bbe')
    
      65
    
      66prepare() {
    
local gentoo_patches=(
    
  # CVE-2019-20907
    
  0001-bpo-39017-Avoid-infinite-loop-in-the-tarfile-module-.patch
    
  # CVE-2020-8492
    
  0002-bpo-39503-CVE-2020-8492-Fix-AbstractBasicAuthHandler.patch
    
  # CVE-2020-26116
    
  0003-bpo-39603-Prevent-header-injection-in-http-methods-G.patch
    
  0004-bpo-42051-Reject-XML-entity-declarations-in-plist-fi.patch
    
  # CVE-2020-27619
    
  0005-bpo-41944-No-longer-call-eval-on-content-received-vi.patch
    
  0006-bpo-40791-Make-compare_digest-more-constant-time.-GH.patch
    
  # CVE-2021-3177
    
  0007-3.6-closes-bpo-42938-Replace-snprintf-with-Python-un.patch
    
  # CVE-2021-23336
    
  0008-3.6-bpo-42967-only-use-as-a-query-string-separator-G.patch
    
  0009-py2-ize-the-CJK-codec-test.patch
    
  0010-3.6-bpo-43285-Make-ftplib-not-trust-the-PASV-respons.patch
    
  0011-bpo-43075-Fix-ReDoS-in-urllib-AbstractBasicAuthHandl.patch
    
  0012-3.9-bpo-43882-urllib.parse-should-sanitize-urls-cont.patch
    
  0013-Backport-bpo-44022-Fix-http-client-infinite-line-rea.patch
    
  0014-bpo-43124-Fix-smtplib-multiple-CRLF-injection-GH-259.patch
    
  0015-bpo-42278-Use-tempfile.TemporaryDirectory-rather-tha.patch
    
  0016-Fix-accidentally-leaving-one-sub-test-commented-out.patch
    
  0017-bpo-46811-Make-test-suite-support-Expat-2.4.5-GH-314.patch
    
  0018-bpo-46756-Fix-authorization-check-in-urllib.request-.patch
    
  0019-Install-libpythonX.Y.a-in-usr-lib-instead-of-usr-lib.patch
    
  0020-Disable-modules-and-SSL.patch
    
  # Gentoo specific patch
    
  # 0021-Gentoo-libdir.patch
    
  # Don't need this
    
  # 0022-Non-zero-exit-status-on-failure.patch
    
  # causes error: IndentationError: expected an indented block
    
  # 0023-sqlite-loadable-extensions.patch
    
  0024-Regenerate-platform-specific-modules.patch
    
  # Causes failure on test_distutils
    
  # 0025-distutils-C.patch
    
  0026-Turkish-locale.patch
    
  0027-ARM-OABI.patch
    
  0028-use_pyxml.patch
    
  0029-Disable-nis.patch
    
  # Does not apply cleanly
    
  # 0030-Make-module-byte-compilation-non-fatal.patch
    
  0031-Use-ncurses-to-find-pkg-config.patch
    
  0032-Use-specific-Werror-for-cross-compile-tests.patch
    
  0033-Force-using-system-libffi.patch
    
  0034-test.support.unlink-ignore-EACCES.patch
    
  0035-ssl-Hard-disable-SSLv3-to-avoid-automagic-deps.patch
    
  0036-Fix-Wimplicit-int-Wimplicit-function-declaration.patch
    
)
    
      116
    
cd "${srcdir}/${_pkgsrc}"
    
# makepkg will touch all files to $SOURCE_DATE_EPOCH which will break pyc file's mtime check.
    
# workaround this by touching them to $SOURCE_DATE_EPOCH before running compileall.
    
patch -Np0 -i "${srcdir}/python2_mtime_workaround.patch"
    
      121
    
patch -Np1 -i "${srcdir}/${pkgname}_no_common.patch"
    
      123
    
for gentoo_patch in "${gentoo_patches[@]}"; do
    
  patch -Np1 -i "${srcdir}/python-gentoo-patches-${_pkgver%%slp*}_${pkgver##*+}/${gentoo_patch}" || true
    
done
    
      127
    
# Temporary workaround for FS#22322
    
# See http://bugs.python.org/issue10835 for upstream report
    
sed -i "/progname =/s/python/python${_api}/" Python/pythonrun.c
    
      131
    
# Enable built-in SQLite module to load extensions (fix FS#22122)
    
sed -i "/SQLITE_OMIT_LOAD_EXTENSION/d" setup.py
    
      134
    
# FS#23997
    
sed -i -e "s|^#.* /usr/local/bin/python|#!/usr/bin/python2|" Lib/cgi.py
    
      137
    
sed -i "s/python2.3/python2/g" Lib/distutils/tests/test_build_scripts.py \
    
  Lib/distutils/tests/test_install_scripts.py
    
      140
    
# clean up #!s
    
find . -name '*.py' | \
    
  xargs sed -i "s|#[ ]*![ ]*/usr/bin/env python$|#!/usr/bin/env python2|"
    
      144
    
# Workaround asdl_c.py/makeopcodetargets.py errors after we touched the shebangs
    
touch Include/Python-ast.h Python/Python-ast.c Python/opcode_targets.h
    
      147
    
cd "Modules"
    
rm -rf "_ctypes"/{darwin,libffi}* "expat" "zlib"
    
      150}
    
      151
    
      152build() {
    
export CFLAGS+=" -std=gnu17 -Wno-error=incompatible-pointer-types" # -fcommon
    
export CPPFLAGS+=" -I/usr/include/openssl-1.1"
    
export LDFLAGS+=" -L/usr/lib/openssl-1.1"
    
export OPT="${CFLAGS}"
    
local configure_options=(
    
  --prefix='/usr'
    
  --enable-shared
    
  --with-threads
    
  --enable-optimizations
    
  --with-lto
    
  --enable-ipv6
    
  --enable-unicode=ucs4
    
  --with-system-expat
    
  --with-system-ffi
    
  --with-dbmliborder=gdbm:ndbm
    
  --without-ensurepip
    
)
    
      170
    
cd "${srcdir}/${_pkgsrc}"
    
autoreconf -vfi
    
./configure "${configure_options[@]}"
    
make
    
      175}
    
      176
    
      177check() {
    
export TERM=xterm
    
export LD_LIBRARY_PATH="${srcdir}/${_pkgsrc}:${LD_LIBRARY_PATH}"
    
local -x TZ=UTC
    
local excluded_tests=(
    
  # Since 2.7.14 with latest xvfb
    
  test_idle # segfaults
    
  test_tk # segfaults
    
  test_ttk_guionly # segfaults
    
  # Since 2.7.15
    
  test_ctypes # test_ctypes
    
  test_ssl
    
      189
    
  test_ftplib # krb5 errors
    
  test_imaplib # krb5 errors
    
  test_urllib2_localnet # krb5 errors
    
  test_codecmaps_jp # TODO
    
  test_ossaudiodev
    
      195
    
  test_curses
    
  test_doctest_main_issue4197
    
  test_ssl # requires internet
    
)
    
      200
    
cd "${srcdir}/${_pkgsrc}"
    
xvfb-run ./python -m test.regrtest -v -uall -x "${excluded_tests[@]}"
    
      203}
    
      204
    
      205package() {
    
cd "${srcdir}/${_pkgsrc}"
    
# Hack to avoid building again
    
sed -i 's/^all:.*$/all: build_all/' Makefile
    
      209
    
make DESTDIR="${pkgdir}" altinstall maninstall
    
      211
    
install -vDm644 "README"  "${pkgdir}/usr/share/doc/${pkgname}/README"
    
install -vDm644 "LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      214
    
# some useful "stuff"
    
cd "Tools"
    
install -dm755 "${pkgdir}/usr/lib/python${_api}/Tools/"{i18n,scripts}
    
install -vm755 "i18n/"{msgfmt,pygettext}.py "${pkgdir}/usr/lib/python${_api}/Tools/i18n/"
    
install -vm755 "scripts/"{README,*py} "${pkgdir}/usr/lib/python${_api}/Tools/scripts/"
    
      220
    
cd "${pkgdir}/usr"
    
rm -f "share/man/man1/python.1"
    
      223
    
ln -vsf "python${_api}"        "bin/python2"
    
ln -vsf "python${_api}-config" "bin/python2-config"
    
ln -vsf "python${_api}.1"      "share/man/man1/python2.1"
    
      227
    
# FS#33954
    
ln -sf "python-${_api}.pc"     "lib/pkgconfig/python2.pc"
    
      230
    
ln -sf "../../libpython${_api}.so" "lib/python${_api}/config/libpython${_api}.so"
    
      232
    
mv "bin/smtpd.py" "lib/python${_api}/"
    
      234
    
# fix conflicts with python
    
mv "bin/idle"{,2}
    
mv "bin/pydoc"{,2}
    
mv "bin/2to3"{,-"${_api}"}
    
      239
    
# clean-up reference to build directory
    
sed -i "s#${srcdir}/${_pkgsrc}:##" "lib/python${_api}/config/Makefile"
    
      242}
    
      243

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2