aurcache-worker-docker

LOW

maintainer gyscos 0 votes scanned 2026-09-07 19:15:19.836787

View on AUR

Why flagged

The package builds from source hosted on the project's own GitHub repository, which is normal for AUR packages; the 'few votes, recently uploaded' flag is a popularity/timing heuristic and does not indicate malicious behavior.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from source hosted on the project's own GitHub repository, which is normal for AUR packages; the 'few votes, recently uploaded' flag is a popularity/timing heuristic and does not indicate malicious behavior.

PKGBUILD

      1# Maintainer: Lukas Heiligenbrunner <lukas.heiligenbrunner@gmail.com>
    
      2#
    
      3# The legacy Docker build executor, packaged separately from aurcache-worker
    
      4# because it needs none of what that package needs: it delegates each build to
    
      5# a container over the Docker socket, so there is no devtools, no chroot, no
    
      6# patched makechrootpkg and no sudo. Kept in its own package for the same
    
      7# reason it is kept in its own crate -- retiring this build strategy should be
    
      8# a deletion, not a refactor.
    
      9#
    
      10# **Deprecated.** New deployments should use aurcache-worker, which builds in a
    
      11# devtools chroot. This exists so the hybrid image can install what it runs
    
      12# rather than copying a loose binary in.
    
      13
    
      14pkgname=aurcache-worker-docker
    
      15pkgver=0.5.0
    
      16pkgrel=1
    
      17pkgdesc="Legacy Docker build executor for AURCache (deprecated)"
    
      18arch=(x86_64 aarch64 armv7h)
    
      19url="https://github.com/Lukas-Heiligenbrunner/AURCache"
    
      20license=(GPL-3.0-or-later)
    
      21# It speaks to the Docker socket directly through bollard, so it needs neither
    
      22# the docker CLI nor a local daemon -- the socket may well be the host's.
    
      23depends=(gcc-libs)
    
      24optdepends=('docker: to run builds against a local daemon'
    
      25            'podman: likewise, via its Docker-compatible socket')
    
      26makedepends=(cargo git)
    
      27# See the aurcache-worker PKGBUILD: !lto is load-bearing for the vendored C in
    
      28# aws-lc-sys and ring, and !strip because cargo does the stripping.
    
      29options=(!strip !lto !debug)
    
      30source=("$pkgname-$pkgver.tar.gz::$url/archive/refs/tags/v$pkgver.tar.gz")
    
      31sha256sums=('SKIP')
    
      32
    
      33_srcdir="AURCache-$pkgver"
    
      34
    
      35prepare() {
    
      36    cd "$_srcdir/backend"
    
      37    export RUSTUP_TOOLCHAIN=stable
    
      38    cargo fetch --locked
    
      39}
    
      40
    
      41build() {
    
      42    source "$srcdir/$_srcdir/packaging/common.sh"
    
      43    cd "$_srcdir/backend"
    
      44    _aurcache_cargo_build -p aurcache-worker-docker
    
      45}
    
      46
    
      47check() {
    
      48    source "$srcdir/$_srcdir/packaging/common.sh"
    
      49    cd "$_srcdir/backend"
    
      50    _aurcache_cargo_check
    
      51}
    
      52
    
      53package() {
    
      54    source "$srcdir/$_srcdir/packaging/common.sh"
    
      55    cd "$_srcdir"
    
      56    packaging/install-files.sh worker-docker "$pkgdir" "$PWD" "backend/$(_aurcache_release_dir)"
    
      57}
    
      58

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-07 19:15:19	Low	2