cephalote
LOW
maintainer a2eed1f1e4b9255b
0 votes
scanned 2026-08-30 17:43:42.301716
Why flagged
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
PKGBUILD
1
pkgname=cephalote
2
# GitHub archives extract to the repository's canonical casing, which is
3
# "Cephalote" - keep this in sync if the repo is ever renamed to lowercase.
4
_repo=Cephalote
5
pkgver=0.0.1
6
pkgrel=1
7
pkgdesc="Scan source code for weak cryptographic schemes"
8
arch=('x86_64' 'aarch64')
9
url="https://github.com/Smiduweorc/Cephalote"
10
license=('MIT')
11
depends=('glibc')
12
makedepends=('go')
13
# -trimpath rewrites source paths, so the debug package ends up with no
14
# sources and a dangling build-id symlink. Go debug packages aren't useful
15
# here; skip them rather than ship a broken one.
16
options=('!debug')
17
source=("$pkgname-$pkgver.tar.gz::$url/archive/refs/tags/v$pkgver.tar.gz")
18
sha256sums=('e5472d7a2fffd31b821d6f9b5cdd1e3700825ad080e73b6c9d027e6f362f4ce9')
19
20
prepare() {
21
cd "$_repo-$pkgver"
22
# Populate the module cache here so build() needs no network.
23
go mod download
24
}
25
26
build() {
27
cd "$_repo-$pkgver"
28
29
export CGO_CPPFLAGS="${CPPFLAGS}"
30
export CGO_CFLAGS="${CFLAGS}"
31
export CGO_CXXFLAGS="${CXXFLAGS}"
32
export CGO_LDFLAGS="${LDFLAGS}"
33
export GOFLAGS="-buildmode=pie -trimpath -mod=readonly -modcacherw"
34
35
# Upstream ships two profiles: a zero-cgo static default (built to be
36
# scp'd onto a server) and a cgo "treesitter" build that adds real
37
# Python AST analysis at high confidence. A distro package is compiled
38
# on the user's machine against a toolchain that is already there, so
39
# the static profile buys nothing - take the tier that detects more.
40
#
41
# main.version is what lands in SARIF output as the tool version, so it
42
# uses the bare pkgver to match the official GoReleaser binaries, whose
43
# {{ .Version }} is the tag with the "v" stripped.
44
#
45
# No -s -w: leave symbol handling to makepkg's own strip option rather
46
# than hardcoding it here.
47
go build -tags treesitter \
48
-ldflags "-linkmode=external -X main.version=$pkgver" \
49
-o build/cephalote ./cmd/cephalote
50
51
local sh
52
for sh in bash zsh fish; do
53
build/cephalote completion "$sh" >"build/completion.$sh"
54
done
55
}
56
57
check() {
58
cd "$_repo-$pkgver"
59
# Same tag as build(), so the tier that ships is the tier that is tested.
60
go test -tags treesitter ./...
61
}
62
63
package() {
64
cd "$_repo-$pkgver"
65
66
install -Dm755 build/cephalote "$pkgdir/usr/bin/cephalote"
67
68
install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
69
install -Dm644 README.md "$pkgdir/usr/share/doc/$pkgname/README.md"
70
install -Dm644 docs/SCHEDULING.md \
71
"$pkgdir/usr/share/doc/$pkgname/SCHEDULING.md"
72
install -Dm644 cephalote.example.yaml \
73
"$pkgdir/usr/share/doc/$pkgname/cephalote.example.yaml"
74
75
install -Dm644 build/completion.bash \
76
"$pkgdir/usr/share/bash-completion/completions/cephalote"
77
install -Dm644 build/completion.zsh \
78
"$pkgdir/usr/share/zsh/site-functions/_cephalote"
79
install -Dm644 build/completion.fish \
80
"$pkgdir/usr/share/fish/vendor_completions.d/cephalote.fish"
81
}
82
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-30 17:43:42 | Low | 1 |