aurcache-cli
LOW
maintainer gyscos
0 votes
scanned 2026-09-27 13:18:29.354985
Why flagged
The package builds a CLI tool from the project's own source on GitHub, which is normal AUR packaging; the low severity is due to few votes and recent upload, not inherent risk.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Low
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds a CLI tool from the project's own source on GitHub, which is normal AUR packaging; the low severity is due to few votes and recent upload, not inherent risk.
PKGBUILD
1
# Maintainer: Alexandre Bury <alexandre.bury@gmail.com>
2
#
3
# The client alone: a typed CLI for the HTTP API with no server, worker or
4
# build machinery. Separate from the other packages rather than a split
5
# package for the same reason they are separate from each other -- makepkg
6
# cannot build one half of a split, which the container images need -- and
7
# because its install closure is one binary plus gcc-libs.
8
9
pkgname=aurcache-cli
10
pkgver=0.6.0
11
pkgrel=1
12
pkgdesc="Typed CLI for the AURCache API"
13
arch=(x86_64 aarch64 armv7h)
14
url="https://github.com/gyscos/AURCache"
15
license=(GPL-3.0-or-later)
16
# The TLS stack is rustls over aws-lc-rs/ring (see aurcache-server), so
17
# nothing links libssl; gcc-libs is what the binary actually links (`ldd` on
18
# the built artifact, not guesswork).
19
depends=(gcc-libs)
20
makedepends=(cargo git)
21
# !lto because makepkg's LTO puts `-flto=auto` into CFLAGS, which the `cc` crate
22
# passes to the C in `aws-lc-sys` and `ring`. That yields GCC LTO bytecode in
23
# their static archives, and rustc links with `ld.lld`, which cannot read it --
24
# the build then fails at link with undefined `aws_lc_*` symbols and no error
25
# from the build script. Rust's own LTO is cargo's business regardless.
26
# !strip because stripping is done by cargo (see common.sh); makepkg would use
27
# the host's binutils, which cannot strip a foreign binary.
28
# !debug because debug packaging works by splitting out what `strip` removes;
29
# with !strip it produces nothing but an empty /usr/src/debug the package would
30
# then own for no reason.
31
options=(!strip !lto !debug)
32
source=("$pkgname-$pkgver.tar.gz::$url/archive/refs/tags/v$pkgver.tar.gz")
33
sha256sums=('SKIP')
34
35
_srcdir="AURCache-$pkgver"
36
37
prepare() {
38
cd "$_srcdir/backend"
39
export RUSTUP_TOOLCHAIN=stable
40
cargo fetch --locked
41
}
42
43
build() {
44
source "$srcdir/$_srcdir/packaging/common.sh"
45
cd "$_srcdir/backend"
46
_aurcache_cargo_build -p aurcache-cli
47
}
48
49
check() {
50
source "$srcdir/$_srcdir/packaging/common.sh"
51
cd "$_srcdir/backend"
52
_aurcache_cargo_check
53
}
54
55
package() {
56
source "$srcdir/$_srcdir/packaging/common.sh"
57
cd "$_srcdir"
58
packaging/install-files.sh cli "$pkgdir" "$PWD" "backend/$(_aurcache_release_dir)"
59
}
60
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-27 13:18:29 | Low | 2 |