anime-manager-git
LOW
maintainer illuser
0 votes
scanned 2026-10-19 19:26:12.253336
Why flagged
The package builds from a legitimate git repository owned by the maintainer, uses standard build tools, and installs only the project's own compiled binary and data files; the low severity is due to few votes and recent upload, not malicious content.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Low
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from a legitimate git repository owned by the maintainer, uses standard build tools, and installs only the project's own compiled binary and data files; the low severity is due to few votes and recent upload, not malicious content.
PKGBUILD
1
# Maintainer: Joseph R. Quinn <quinn.josephr@gmail.com>
2
3
pkgname=anime-manager-git
4
_pkgname=anime-manager
5
pkgver=0.12.4.r1.g6ccc544
6
pkgrel=1
7
pkgdesc='Scan an anime collection, play episodes in mpv and track what you have watched (git)'
8
arch=('x86_64')
9
url='https://github.com/quinnjr/anime-manager'
10
license=('MIT' 'CC-BY-3.0')
11
# Runtime libraries the binary actually links (readelf -d), plus mpv, which the player shells out to.
12
# SQLite is statically linked (rusqlite "bundled") and TLS is rustls, so neither is a dependency.
13
depends=('webkit2gtk-4.1' 'gtk3' 'glib2' 'cairo' 'gdk-pixbuf2' 'libsoup3' 'dbus' 'gcc-libs' 'glibc' 'mpv')
14
makedepends=('git' 'rust' 'nodejs' 'pnpm' 'pkgconf')
15
provides=('anime-manager')
16
conflicts=('anime-manager')
17
options=('!lto')
18
19
# git-flow: `main` only receives release merges, so the integration branch is what a -git
20
# package is actually for. The branch is pinned rather than left implicit so the source does
21
# not silently follow a future change to the repository's default branch.
22
_repo=https://github.com/quinnjr/anime-manager.git
23
_branch=develop
24
25
source=("$_pkgname::git+$_repo#branch=$_branch")
26
sha256sums=('SKIP')
27
28
pkgver() {
29
cd "$srcdir/$_pkgname"
30
# v0.12.4-1-g6ccc544 -> 0.12.4.r1.g6ccc544
31
git describe --long --tags --abbrev=7 | sed 's/^v//;s/\([^-]*-g\)/r\1/;s/-/./g'
32
}
33
34
build() {
35
cd "$srcdir/$_pkgname"
36
export RUSTUP_TOOLCHAIN=stable
37
pnpm install --frozen-lockfile
38
# --no-bundle: this PKGBUILD installs the files itself, and the AppImage target needs
39
# linuxdeploy, which is not a dependency worth carrying for an Arch package.
40
pnpm tauri build --no-bundle
41
}
42
43
check() {
44
cd "$srcdir/$_pkgname"
45
export RUSTUP_TOOLCHAIN=stable
46
# The player tests drive a fake mpv through process-global environment variables.
47
cargo test --manifest-path src-tauri/Cargo.toml --release -- --test-threads=1
48
pnpm test
49
}
50
51
package() {
52
cd "$srcdir/$_pkgname"
53
install -Dm755 src-tauri/target/release/anime-manager "$pkgdir/usr/bin/anime-manager"
54
# Taken from the checkout rather than shipped as a second source, so it cannot drift from
55
# the upstream file the release package uses.
56
install -Dm644 packaging/arch/anime-manager.desktop "$pkgdir/usr/share/applications/anime-manager.desktop"
57
install -Dm644 src-tauri/icons/32x32.png "$pkgdir/usr/share/icons/hicolor/32x32/apps/anime-manager.png"
58
install -Dm644 src-tauri/icons/128x128.png "$pkgdir/usr/share/icons/hicolor/128x128/apps/anime-manager.png"
59
install -Dm644 'src-tauri/icons/128x128@2x.png' "$pkgdir/usr/share/icons/hicolor/256x256/apps/anime-manager.png"
60
install -Dm644 README.md "$pkgdir/usr/share/doc/$pkgname/README.md"
61
# MIT has no shared copy under /usr/share/licenses/common, so ship the text.
62
install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
63
# The icon is CC BY 3.0, which requires the attribution to travel with it.
64
install -Dm644 NOTICE "$pkgdir/usr/share/licenses/$pkgname/NOTICE"
65
}
66
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-19 19:26:12 | Low | 2 |