verona
LOW
maintainer Yuhanun
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The pip install fetches a testing utility (OutputCheck) from PyPI, not a core dependency or executable code, and is run during prepare; the main build uses verified source from Microsoft's official repository.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The pip install fetches a testing utility (OutputCheck) from PyPI, not a core dependency or executable code, and is run during prepare; the main build uses verified source from Microsoft's official repository.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
pip install of an external package
pip_install_external
`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.
-
PKGBUILD:21
python3 -m pip install OutputCheck --user
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Yuhanun Citgez <y dot citgez at student dot utwente dot nl>
2
# Co-maintainer: Hans Goor <me at eyedevelop dot org>
3
4
pkgname=verona
5
pkgver=8
6
pkgrel=2
7
commit_hash=9cab6b27490fdae34cf67454549abe8c06be345a
8
pkgdesc="Microsoft's Verona programming language interpreter and compiler"
9
arch=('x86_64')
10
url='https://github.com/microsoft/verona'
11
licence=('MIT')
12
depends=('python')
13
makedepends=('python-pip' 'cmake' 'ninja' 'clang' 'llvm')
14
provides=('veronac' 'verona-interpreter')
15
source=("git+https://github.com/microsoft/verona#commit=$commit_hash")
16
md5sums=('SKIP')
17
18
prepare() {
19
cd verona
20
git submodule update --init --recursive
21
python3 -m pip install OutputCheck --user
22
}
23
24
build() {
25
cd verona
26
mkdir build_ninja
27
cd build_ninja
28
cmake .. -GNinja -DCMAKE_BUILD_TYPE=Release -DCMAKE_CXX_COMPILER=/usr/bin/clang++
29
ninja install
30
}
31
32
check() {
33
cd verona/build_ninja
34
ctest -j $(nproc)
35
}
36
37
package() {
38
cd verona/build_ninja
39
mkdir -p "${pkgdir}"/opt/verona
40
install -Dm755 dist/veronac "${pkgdir}"/opt/verona/veronac
41
install -Dm755 dist/interpreter "${pkgdir}"/opt/verona/verona-interpreter
42
43
mkdir -p "${pkgdir}"/usr/bin
44
ln -s /opt/verona/veronac "${pkgdir}"/usr/bin/veronac
45
ln -s /opt/verona/verona-interpreter "${pkgdir}"/usr/bin/verona-interpreter
46
47
cp -r ../src/stdlib "${pkgdir}"/opt/verona/stdlib
48
}
49
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |