bun-git

maintainer NoelJacob · 1 votes · scanned 2026-08-18 00:03:42.021799

LOW

Why flagged The package builds from the official project Git repository, which is a normal AUR practice; the recent maintainer change does not imply malicious intent or code execution risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from the official project Git repository, which is a normal AUR practice; the recent maintainer change does not imply malicious intent or code execution risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

      1# Maintainer: yobson <aur at yobson dot xyz>
    
      2# Maintainer: Noel Jacob <noeljacob 91 at gmail dot com>
    
      3# Contributor: Daniele Basso <d dot bass 05 at proton dot me>
    
      4pkgname=bun-git
    
      5pkgver=1.3.14.r1369.gf68e504
    
      6pkgrel=1
    
      7pkgdesc="Incredibly fast JavaScript runtime, bundler, test runner, and package manager – all in one"
    
      8arch=(x86_64 aarch64)
    
      9url="https://github.com/oven-sh/bun"
    
      10license=('MIT')
    
      11depends=(libatomic libstdc++)
    
      12makedepends=(bun clang21 cmake git lld21 llvm21 ninja rustup)
    
      13conflicts=(bun bun-bin)
    
      14provides=(bun)
    
      15source=("$pkgname::git+https://github.com/oven-sh/bun.git")
    
      16cksums=(SKIP)
    
      17
    
      18pkgver() {
    
      19    cd "$pkgname"
    
      20    git describe --tags --long --abbrev=7 --match 'bun-v[0-9]*' |
    
      21        sed 's/^bun-v//;s/\([^-]*-g\)/r\1/;s/-/./g'
    
      22}
    
      23
    
      24check() {
    
      25    cd $pkgname
    
      26    ./build/release/bun --version
    
      27    echo 'console.log("ok")' | ./build/release/bun run -
    
      28}
    
      29
    
      30build() {
    
      31    cd "$pkgname"
    
      32    bun scripts/build.ts \
    
      33        --profile=release \
    
      34        --static-libatomic=off
    
      35}
    
      36
    
      37package() {
    
      38    cd $pkgname
    
      39    install -vDm755 build/release/bun "$pkgdir/usr/bin/bun"
    
      40    ln -vs /usr/bin/bun "$pkgdir/usr/bin/bunx"
    
      41    install -vDm644 -t "$pkgdir/usr/share/licenses/$pkgname" LICENSE.md
    
      42
    
      43    install -vDm644 completions/bun.bash "$pkgdir/usr/share/bash-completion/completions/bun"
    
      44    install -vDm644 completions/bun.fish "$pkgdir/usr/share/fish/vendor_completions.d/bun.fish"
    
      45    install -vDm644 completions/bun.zsh "$pkgdir/usr/share/zsh/site-functions/_bun"
    
      46}
    
      47

Changes since previous scan

--- PKGBUILD @ 2026-08-14 00:03
+++ PKGBUILD @ 2026-08-18 00:03
@@ -1,41 +1,47 @@
-# Maintainer: Noel Jacob <noeljacob at gmail dot com>
+# Maintainer: yobson <aur at yobson dot xyz>
+# Maintainer: Noel Jacob <noeljacob 91 at gmail dot com>
 # Contributor: Daniele Basso <d dot bass 05 at proton dot me>
 pkgname=bun-git
-pkgver=1.0.36.r9080.02ad501
+pkgver=1.3.14.r1369.gf68e504
 pkgrel=1
-pkgdesc="Bun is a fast JavaScript all-in-one toolkit. This PKGBUILD builds from source, resulting into a minor binary depending on your CPU."
-arch=("x86_64")
+pkgdesc="Incredibly fast JavaScript runtime, bundler, test runner, and package manager – all in one"
+arch=(x86_64 aarch64)
 url="https://github.com/oven-sh/bun"
 license=('MIT')
-makedepends=("bun" "llvm" "clang" "lld" "ccache" "cmake" "git" "go" "libiconv" "libtool" "make" "ninja" "pkg-config" "python" "rust" "sed" "unzip" "ruby")
-conflicts=("bun" "bun-bin")
-provides=("bun")
+depends=(libatomic libstdc++)
+makedepends=(bun clang21 cmake git lld21 llvm21 ninja rustup)
+conflicts=(bun bun-bin)
+provides=(bun)
 source=("$pkgname::git+https://github.com/oven-sh/bun.git")
-sha512sums=("SKIP")
+cksums=(SKIP)
 
 pkgver() {
-  cd "$pkgname"
-  release=$(git describe --tags `git rev-list --tags --max-count=1` | sed 's/^bun-v//')
-  version="r$(git rev-list --count HEAD).$(git rev-parse --short=7 HEAD)"
-  printf "$release.$version"
+    cd "$pkgname"
+    git describe --tags --long --abbrev=7 --match 'bun-v[0-9]*' |
+        sed 's/^bun-v//;s/\([^-]*-g\)/r\1/;s/-/./g'
+}
+
+check() {
+    cd $pkgname
+    ./build/release/bun --version
+    echo 'console.log("ok")' | ./build/release/bun run -
 }
 
 build() {
-  cd "$pkgname"
-  bun setup
-  bun run build:release
+    cd "$pkgname"
+    bun scripts/build.ts \
+        --profile=release \
+        --static-libatomic=off
 }
 
 package() {
-  install -Dm755 $srcdir/$pkgname/build/bun $pkgdir/usr/bin/bun
-  ln -s /usr/bin/bun $pkgdir/usr/bin/bunx
+    cd $pkgname
+    install -vDm755 build/release/bun "$pkgdir/usr/bin/bun"
+    ln -vs /usr/bin/bun "$pkgdir/usr/bin/bunx"
+    install -vDm644 -t "$pkgdir/usr/share/licenses/$pkgname" LICENSE.md
 
-  SHELL=zsh $pkgdir/usr/bin/bun completions > bun.zsh
-  SHELL=bash $pkgdir/usr/bin/bun completions > bun.bash
-  SHELL=fish $pkgdir/usr/bin/bun completions > bun.fish
-
-  install -Dm644 bun.zsh $pkgdir/usr/share/zsh/site-functions/_bun
-  install -Dm644 bun.bash $pkgdir/usr/share/bash-completion/completions/bun
-  install -Dm644 bun.fish $pkgdir/usr/share/fish/vendor_completions.d/bun.fish
+    install -vDm644 completions/bun.bash "$pkgdir/usr/share/bash-completion/completions/bun"
+    install -vDm644 completions/bun.fish "$pkgdir/usr/share/fish/vendor_completions.d/bun.fish"
+    install -vDm644 completions/bun.zsh "$pkgdir/usr/share/zsh/site-functions/_bun"
 }
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	LOW	2
2026-08-17 00:18:29	LOW	2
2026-08-16 00:03:42	LOW	2
2026-08-15 00:26:13	LOW	2
2026-08-14 09:28:24	MEDIUM	1
2026-08-14 00:03:41	LOW	2
2026-08-13 21:26:43	MEDIUM	1
2026-06-18 16:11:54	CLEAN	0