aurcache-server
LOW
maintainer gyscos
0 votes
scanned 2026-09-07 19:15:19.836787
Why flagged
The package builds from source hosted on the maintainer's GitHub, which is normal for AUR packages; the only concerns are low-risk: skipped checksum and recent upload with few votes, but no evidence of malicious behavior or unverifiable prebuilt binaries.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Low
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from source hosted on the maintainer's GitHub, which is normal for AUR packages; the only concerns are low-risk: skipped checksum and recent upload with few votes, but no evidence of malicious behavior or unverifiable prebuilt binaries.
PKGBUILD
1
# Maintainer: Lukas Heiligenbrunner <lukas.heiligenbrunner@gmail.com>
2
#
3
# Separate from aurcache-worker: the server needs no devtools, base-devel or
4
# sudo, and most build machines do not want a server. Both are installable
5
# together and share the `aurcache` user.
6
7
pkgname=aurcache-server
8
pkgver=0.5.0
9
pkgrel=1
10
pkgdesc="Build server and pacman repository for Arch Linux packages from the AUR"
11
arch=(x86_64 aarch64 armv7h)
12
url="https://github.com/Lukas-Heiligenbrunner/AURCache"
13
license=(GPL-3.0-or-later)
14
# alpm-pkgbuild-bridge is what `alpm-srcinfo` shells out to in order to parse a
15
# PKGBUILD; without it every package add fails. It is reached through a
16
# confining wrapper this package installs ahead of it on PATH -- see
17
# packaging/alpm-pkgbuild-bridge-wrapper.
18
# libgit2 and xz are what the binary actually links (`ldd` on the built
19
# artifact, not guesswork): libgit2-sys uses the system library when it finds
20
# one, which on Arch it does. openssl is deliberately absent -- the TLS stack
21
# here is rustls over aws-lc-rs/ring, and nothing links libssl.
22
depends=(gcc-libs libgit2 xz alpm-pkgbuild-bridge aurcache-sandbox)
23
# rust-wasm supplies the wasm32-unknown-unknown std the frontend compiles
24
# against, and wasm-bindgen-cli emits its JS glue. The latter is an AUR package
25
# and its version must match the `wasm-bindgen` crate in frontend-rs/Cargo.lock
26
# (0.2.127 today) -- wasm-bindgen refuses a mismatched pair outright, which is
27
# the one thing about this build that breaks on a version bump elsewhere.
28
makedepends=(cargo git libgit2 rust-wasm wasm-bindgen-cli)
29
backup=(etc/aurcache/server.env)
30
# !lto because makepkg's LTO puts `-flto=auto` into CFLAGS, which the `cc` crate
31
# passes to the C in `aws-lc-sys` and `ring`. That yields GCC LTO bytecode in
32
# their static archives, and rustc links with `ld.lld`, which cannot read it --
33
# the build then fails at link with undefined `aws_lc_*` symbols and no error
34
# from the build script. Rust's own LTO is cargo's business regardless.
35
# !strip because stripping is done by cargo (see common.sh); makepkg would use
36
# the host's binutils, which cannot strip a foreign binary.
37
# !debug because debug packaging works by splitting out what `strip` removes;
38
# with !strip it produces nothing but an empty /usr/src/debug the package would
39
# then own for no reason.
40
options=(!strip !lto !debug)
41
source=("$pkgname-$pkgver.tar.gz::$url/archive/refs/tags/v$pkgver.tar.gz")
42
sha256sums=('SKIP')
43
44
_srcdir="AURCache-$pkgver"
45
46
prepare() {
47
cd "$_srcdir/backend"
48
export RUSTUP_TOOLCHAIN=stable
49
cargo fetch --locked
50
}
51
52
build() {
53
source "$srcdir/$_srcdir/packaging/common.sh"
54
cd "$_srcdir/backend"
55
# `static` embeds the web UI in the binary, which is what makes the native
56
# install one unit with nothing to serve separately.
57
_aurcache_cargo_build --features aurcache-api/static -p aurcache
58
}
59
60
check() {
61
source "$srcdir/$_srcdir/packaging/common.sh"
62
cd "$_srcdir/backend"
63
_aurcache_cargo_check
64
}
65
66
package() {
67
source "$srcdir/$_srcdir/packaging/common.sh"
68
cd "$_srcdir"
69
packaging/install-files.sh server "$pkgdir" "$PWD" "backend/$(_aurcache_release_dir)"
70
}
71
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-07 19:15:19 | Low | 2 |