aurcache-worker
LOW
maintainer gyscos
0 votes
scanned 2026-09-07 19:15:19.836787
Why flagged
The package builds from source hosted on the maintainer's GitHub, which is normal for AUR packages; the low severity is due to few votes and recent upload, not malicious content.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Low
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from source hosted on the maintainer's GitHub, which is normal for AUR packages; the low severity is due to few votes and recent upload, not malicious content.
PKGBUILD
1
# Maintainer: Lukas Heiligenbrunner <lukas.heiligenbrunner@gmail.com>
2
#
3
# Separate from aurcache-server rather than a split package: the two share
4
# almost no dependencies -- a build machine wants devtools and none of the
5
# server -- and makepkg cannot build one half of a split, which the container
6
# images need.
7
8
pkgname=aurcache-worker
9
pkgver=0.5.0
10
pkgrel=1
11
pkgdesc="Remote build worker for AURCache"
12
# armv7h is deliberately absent: its cross toolchain is not in Arch's official
13
# repositories, only aarch64's is. Adding it means the AUR toolchain or an
14
# emulated build.
15
arch=(x86_64 aarch64 armv7h)
16
url="https://github.com/Lukas-Heiligenbrunner/AURCache"
17
license=(GPL-3.0-or-later)
18
19
# devtools is what the worker shells out to, and it already brings fakeroot,
20
# sudo, git, openssh, binutils and the VCS tools. python runs the patch that
21
# confines the two places a PKGBUILD executes outside the chroot.
22
#
23
# Deliberately not base-devel: the compiler toolchain is installed inside each
24
# build's chroot by `mkarchroot ... base-devel`, never on the host. The host
25
# only downloads and verifies sources, which devtools covers.
26
depends=(gcc-libs devtools python aurcache-sandbox)
27
makedepends=(cargo git)
28
# Cross-compiling to aarch64 additionally needs aarch64-linux-gnu-gcc; build()
29
# says so if it is missing. It is not in makedepends because it is only needed
30
# for a build this PKGBUILD does not do by default.
31
optdepends=('openssh: git+ssh sources')
32
backup=(etc/aurcache/worker.env etc/aurcache/sandbox-protected)
33
install=aurcache-worker.install
34
# !lto because makepkg's LTO puts `-flto=auto` into CFLAGS, which the `cc` crate
35
# passes to the C in `aws-lc-sys` and `ring`. That yields GCC LTO bytecode in
36
# their static archives, and rustc links with `ld.lld`, which cannot read it --
37
# the build then fails at link with undefined `aws_lc_*` symbols and no error
38
# from the build script. Rust's own LTO is cargo's business regardless.
39
# !strip because stripping is done by cargo (see common.sh); makepkg would use
40
# the host's binutils, which cannot strip a foreign binary.
41
# !debug because debug packaging works by splitting out what `strip` removes;
42
# with !strip it produces nothing but an empty /usr/src/debug the package would
43
# then own for no reason.
44
options=(!strip !lto !debug)
45
source=("$pkgname-$pkgver.tar.gz::$url/archive/refs/tags/v$pkgver.tar.gz")
46
sha256sums=('SKIP')
47
48
_srcdir="AURCache-$pkgver"
49
50
prepare() {
51
cd "$_srcdir/backend"
52
export RUSTUP_TOOLCHAIN=stable
53
cargo fetch --locked
54
}
55
56
build() {
57
source "$srcdir/$_srcdir/packaging/common.sh"
58
cd "$_srcdir/backend"
59
_aurcache_cargo_build -p aurcache-worker
60
}
61
62
check() {
63
source "$srcdir/$_srcdir/packaging/common.sh"
64
cd "$_srcdir/backend"
65
_aurcache_cargo_check
66
}
67
68
package() {
69
source "$srcdir/$_srcdir/packaging/common.sh"
70
cd "$_srcdir"
71
packaging/install-files.sh worker "$pkgdir" "$PWD" "backend/$(_aurcache_release_dir)"
72
}
73
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-07 19:15:19 | Low | 2 |