Review Results

Comment

The change only bumps pkgrel from 4 to 5 in .SRCINFO. No source URLs, build steps, dependencies, install scripts, or packaged artifacts are altered, so there is no new security-relevant behavior introduced by this diff. This is a routine metadata-only rebuild/release bump.

@@ -1,7 +1,7 @@
 pkgbase = python-gevent-eventemitter
 	pkgdesc = EventEmitter using gevent
 	pkgver = 2.1
-	pkgrel = 4
+	pkgrel = 5
 	url = https://github.com/rossengeorgiev/gevent-eventemitter
 	arch = any
 	license = MIT

Comment

This change only bumps pkgrel from 4 to 5 in PKGBUILD without altering sources, build steps, dependencies, install scripts, or package contents. No security-relevant behavior changes are present in the provided diff hunk.

@@ -2,7 +2,7 @@
 pkgname=python-gevent-eventemitter
 _name=${pkgname#python-}
 pkgver=2.1
-pkgrel=4
+pkgrel=5
 pkgdesc="EventEmitter using gevent"
 arch=('any')
 url="https://github.com/rossengeorgiev/gevent-eventemitter"

Comment

The change is low risk. It only alters the test phase to create an isolated virtual environment, install the built wheel into that venv, and run pytest with Python's -P flag. This does not add network access, privilege escalation, persistence, or packaging-time writes outside the build/test directory. The wheel being installed is produced locally in build(), and the package() step is unchanged. The only minor concern is that --system-site-packages makes the test venv inherit host packages, which can reduce test isolation, but it is not a security issue in this context.

@@ -28,7 +28,9 @@ build() {
 
 check() {
   cd "$_name-$pkgver"
-  PYTHONPATH=. pytest
+  python -m venv --clear --without-pip --system-site-packages test-env
+  test-env/bin/python -m installer dist/*.whl
+  test-env/bin/python -P -m pytest
 }
 
 package() {