blaze-bin

LOW

maintainer lapsus 0 votes scanned 2026-11-05 04:08:19.306895

View on AUR

Why flagged

The package downloads prebuilt binaries from GitHub Releases, which is a standard practice; the binaries are verified with hardcoded checksums, and the source is from the official project repository, making the risk low despite the recent upload and few votes.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package downloads prebuilt binaries from GitHub Releases, which is a standard practice; the binaries are verified with hardcoded checksums, and the source is from the official project repository, making the risk low despite the recent upload and few votes.

PKGBUILD

      1# Maintainer: Yakov Till <yakov.till@gmail.com>
    
      2
    
      3# blaze here is the Rust build engine. Official extra/blaze and AUR blaze-git are the unrelated
    
      4# C++ math library (blaze-lib); extra/blaze is header-only and installs no executables, so
    
      5# /usr/bin/blaze is free and this package neither provides nor conflicts with `blaze`.
    
      6pkgname=blaze-bin
    
      7pkgver=0.20261027.0
    
      8pkgrel=1
    
      9pkgdesc="Incremental Rust build engine that rebuilds only what an edit changed"
    
      10arch=('x86_64' 'aarch64')
    
      11url="https://github.com/indexable-inc/blaze"
    
      12# upstream licenses every release under either
    
      13license=('Apache-2.0' 'MIT')
    
      14# blaze links every program by running `cc`, and without one the link fails after the
    
      15# objects are built; gcc is what provides /usr/bin/cc
    
      16depends=('gcc')
    
      17provides=('blaze-engine')
    
      18conflicts=('blaze-engine')
    
      19# prebuilt binaries: a debug split would only carry someone else's debug info
    
      20options=('!debug')
    
      21
    
      22# spelled out per architecture rather than with $CARCH: .SRCINFO records what the current build
    
      23# host expanded, so $CARCH would put the x86_64 file into source_aarch64. The aarch64 sum is from
    
      24# the release's published SHA256SUMS, the only way to have it on an x86_64 build host
    
      25source_x86_64=("blaze-${pkgver}-x86_64-unknown-linux-gnu.tar.gz::https://github.com/indexable-inc/blaze/releases/download/v${pkgver}/blaze-v${pkgver}-x86_64-unknown-linux-gnu.tar.gz")
    
      26source_aarch64=("blaze-${pkgver}-aarch64-unknown-linux-gnu.tar.gz::https://github.com/indexable-inc/blaze/releases/download/v${pkgver}/blaze-v${pkgver}-aarch64-unknown-linux-gnu.tar.gz")
    
      27sha256sums_x86_64=('df61ce6d8216087a40e986d4f84cf2a230638bde014e38519e08b50282e90e5d')
    
      28sha256sums_aarch64=('5fcc6c37e375be244d4d64a293d1f1574834fbfd3036d113fd886ca632f964ff')
    
      29
    
      30# Releases are dated, 0.YYYYMMDD.N, and land on the canary channel first as GitHub
    
      31# prereleases: /releases/latest is the newest one that passed the heavy tests
    
      32latestver() {
    
      33  gh api repos/indexable-inc/blaze/releases/latest --jq .tag_name |
    
      34    sed -nE 's/^v?([0-9]+(\.[0-9]+)*)$/\1/p'
    
      35}
    
      36
    
      37package() {
    
      38  local _dir="blaze-v${pkgver}-${CARCH}-unknown-linux-gnu"
    
      39
    
      40  # blaze runs ra-jit and blaze-proc-macro-srv from out of the directory of its own
    
      41  # executable, so the programs stay together here and /usr/bin points at them
    
      42  install -d "${pkgdir}/usr/lib/blaze" "${pkgdir}/usr/bin"
    
      43  install -m755 "${_dir}"/{blaze,cargo-blaze,cargo-ra-jit,ra-jit,ra-jit-rustc,ra-jit-rustc-first,blaze-proc-macro-srv} \
    
      44    "${pkgdir}/usr/lib/blaze/"
    
      45  ln -s ../lib/blaze/blaze "${pkgdir}/usr/bin/blaze"
    
      46  ln -s ../lib/blaze/cargo-blaze "${pkgdir}/usr/bin/cargo-blaze"
    
      47  ln -s ../lib/blaze/cargo-ra-jit "${pkgdir}/usr/bin/cargo-ra-jit"
    
      48
    
      49  install -Dm644 "${_dir}/LICENSE-MIT" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE-MIT"
    
      50  install -Dm644 "${_dir}/README.md" "${pkgdir}/usr/share/doc/${pkgname}/README.md"
    
      51  install -Dm644 "${_dir}/CHANGELOG.md" "${pkgdir}/usr/share/doc/${pkgname}/CHANGELOG.md"
    
      52}
    
      53
    
      54check() {
    
      55  local _dir="blaze-v${pkgver}-${CARCH}-unknown-linux-gnu"
    
      56  local _got
    
      57  _got=$("${srcdir}/${_dir}/blaze" --version | awk '{print $2}')
    
      58  [[ $_got == "$pkgver" ]] || { error "blaze reports $_got, expected $pkgver"; return 1; }
    
      59}
    
      60

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-05 04:08:19	Low	2