better-nsticky

LOW

maintainer Fram446742 0 votes scanned 2026-10-06 08:02:16.298752

View on AUR

Why flagged

The package builds from a pinned GitHub release source, which is normal for AUR packages; the low severity is due to few votes and recent upload, not malicious content.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from a pinned GitHub release source, which is normal for AUR packages; the low severity is due to few votes and recent upload, not malicious content.

PKGBUILD

      1# Maintainer: Francisco Martín Vélez Manrique <francisco446742@gmail.com>
    
      2#
    
      3# Builds a pinned GitHub release archive for the AUR.
    
      4#
    
      5# The installed binary remains `nsticky`, so this package replaces upstream
    
      6# nsticky without changing its command, configuration, socket or systemd unit.
    
      7
    
      8pkgname=better-nsticky
    
      9pkgver=0.5.0
    
      10pkgrel=1
    
      11pkgdesc="Sticky and staged window management for the niri Wayland compositor (drop-in nsticky)"
    
      12arch=('x86_64')
    
      13url="https://github.com/fram446742/better-nsticky"
    
      14license=('BSD-3-Clause')
    
      15depends=('glibc')
    
      16optdepends=('vicinae: recommended selector for `nsticky stage restore`')
    
      17makedepends=('cargo')
    
      18provides=('nsticky')
    
      19conflicts=('nsticky')
    
      20options=('!lto') # the release profile already enables LTO
    
      21source=("$pkgname-$pkgver.tar.gz::https://github.com/fram446742/better-nsticky/archive/refs/tags/v$pkgver.tar.gz")
    
      22sha256sums=('0eec1defd9ba2d4c82ea6195e7fddcf9bb8b7f70a3038e878cd2c7f6959b3693')
    
      23
    
      24build() {
    
      25  cd "$pkgname-$pkgver"
    
      26  # `--locked` keeps the dependency versions from Cargo.lock.
    
      27  cargo build --release --locked
    
      28}
    
      29
    
      30check() {
    
      31  cd "$pkgname-$pkgver"
    
      32  cargo test --locked
    
      33}
    
      34
    
      35package() {
    
      36  cd "$pkgname-$pkgver"
    
      37  install -Dm755 target/release/nsticky "$pkgdir/usr/bin/nsticky"
    
      38  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      39  install -Dm644 README.md "$pkgdir/usr/share/doc/$pkgname/README.md"
    
      40  # The README links to it, so the installed copy is readable too.
    
      41  install -Dm644 assets/vicinae.png "$pkgdir/usr/share/doc/$pkgname/assets/vicinae.png"
    
      42}
    
      43

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-06 08:02:16	Low	2