cfetch-agent

MEDIUM

maintainer richc 0 votes scanned 2026-11-06 06:11:22.019786

View on AUR

Why flagged

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source=("$pkgname::git+https://git.corbet.ch/corbet-libs/cfetch.git#tag=v$pkgver")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Julian Y. Richard Corbet (julian-corbet on GitHub)
    
      2pkgname=cfetch-agent
    
      3pkgver=0.10.3
    
      4pkgrel=2
    
      5pkgdesc="Cited, trust-tiered memory for AI coding agents over plain Markdown"
    
      6arch=('x86_64' 'aarch64')
    
      7url="https://git.corbet.ch/corbet-libs/cfetch"
    
      8license=('LicenseRef-FSL-1.1-ALv2')
    
      9provides=('cfetch')
    
      10conflicts=('cfetch')
    
      11# !lto: the cc-crate builds sqlite3.c with the ambient CFLAGS; under makepkg's global
    
      12# lto option that produces GCC-LTO bitcode objects, which rust-lld cannot consume —
    
      13# the archive links "successfully empty" and every sqlite3_* symbol goes missing.
    
      14options=('!lto')
    
      15makedepends=('cargo' 'git')
    
      16source=("$pkgname::git+https://git.corbet.ch/corbet-libs/cfetch.git#tag=v$pkgver")
    
      17sha256sums=('SKIP')
    
      18
    
      19prepare() {
    
      20  cd "$pkgname"
    
      21  cargo fetch --locked
    
      22}
    
      23
    
      24_cfetch_variant() {
    
      25  case "$CARCH" in
    
      26    x86_64) printf '%s\n' linux-cfetch-cpu-x86_64 ;;
    
      27    aarch64) printf '%s\n' linux-cfetch-cpu-arm64 ;;
    
      28    *) printf 'unsupported cfetch architecture: %s\n' "$CARCH" >&2; return 1 ;;
    
      29  esac
    
      30}
    
      31
    
      32_cfetch_filter_native_cflags() {
    
      33  local flag
    
      34  local -a filtered=()
    
      35  for flag in $1; do
    
      36    case "$flag" in
    
      37      -march=*|-mcpu=*|-mtune=*) ;;
    
      38      *) filtered+=("$flag") ;;
    
      39    esac
    
      40  done
    
      41  printf '%s ' "${filtered[@]}"
    
      42}
    
      43
    
      44_cfetch_filter_native_rustflags() {
    
      45  local -a flags=()
    
      46  local -a filtered=()
    
      47  local index
    
      48  read -r -a flags <<<"$1"
    
      49  for ((index = 0; index < ${#flags[@]}; index++)); do
    
      50    case "${flags[index]}" in
    
      51      -Ctarget-cpu=*) ;;
    
      52      -C)
    
      53        if ((index + 1 < ${#flags[@]})) && [[ ${flags[index + 1]} == target-cpu=* ]]; then
    
      54          ((index += 1))
    
      55        else
    
      56          filtered+=("${flags[index]}")
    
      57        fi
    
      58        ;;
    
      59      *) filtered+=("${flags[index]}") ;;
    
      60    esac
    
      61  done
    
      62  printf '%s ' "${filtered[@]}"
    
      63}
    
      64
    
      65_cfetch_portable_build_env() {
    
      66  local c_target rust_target
    
      67  case "$CARCH" in
    
      68    x86_64)
    
      69      c_target='-march=x86-64 -mtune=generic'
    
      70      rust_target='x86-64'
    
      71      ;;
    
      72    aarch64)
    
      73      c_target='-march=armv8-a -mtune=generic'
    
      74      rust_target='generic'
    
      75      ;;
    
      76    *) printf 'unsupported cfetch architecture: %s\n' "$CARCH" >&2; return 1 ;;
    
      77  esac
    
      78
    
      79  # AUR packages normally inherit the builder's makepkg flags. That is unsafe for
    
      80  # cfetch because libsqlite3-sys compiles bundled C: a package built on a newer
    
      81  # machine with -march=native can SIGILL on another machine of the same Arch
    
      82  # architecture. Keep hardening/optimization flags, but replace CPU selection
    
      83  # with the portable baseline promised by arch=(). Do the same for Rust flags so
    
      84  # a builder-local target-cpu override cannot leak into the distributed binary.
    
      85  export CFLAGS="$(_cfetch_filter_native_cflags "${CFLAGS:-}")$c_target"
    
      86  export CXXFLAGS="$(_cfetch_filter_native_cflags "${CXXFLAGS:-}")$c_target"
    
      87  export RUSTFLAGS="$(_cfetch_filter_native_rustflags "${RUSTFLAGS:-}")-C target-cpu=$rust_target"
    
      88}
    
      89
    
      90build() {
    
      91  cd "$pkgname"
    
      92  _cfetch_portable_build_env
    
      93  CFETCH_VARIANT="$(_cfetch_variant)" cargo build --release --locked --features embedded-embeddings
    
      94}
    
      95
    
      96check() {
    
      97  cd "$pkgname"
    
      98  # `option_env!("CFETCH_VARIANT")` is tracked by Cargo. Running tests without
    
      99  # the same value recompiles target/release/cfetch as an unidentified developer
    
      100  # build, and package() would then install that overwritten binary.
    
      101  _cfetch_portable_build_env
    
      102  CFETCH_VARIANT="$(_cfetch_variant)" cargo test --release --locked --features embedded-embeddings
    
      103}
    
      104
    
      105package() {
    
      106  cd "$pkgname"
    
      107  # The cargo bin target is `cfetch` (the package base differs only because the AUR
    
      108  # name was taken); the file must be /usr/bin/cfetch — units and hooks exec that path,
    
      109  # and provides=('cfetch') is a virtual name, not a file.
    
      110  install -Dm755 target/release/cfetch "$pkgdir/usr/bin/cfetch"
    
      111  install -Dm644 LICENSE.md "$pkgdir/usr/share/licenses/$pkgname/LICENSE.md"
    
      112  install -Dm644 THIRD-PARTY-LICENSES.txt \
    
      113    "$pkgdir/usr/share/licenses/$pkgname/THIRD-PARTY-LICENSES.txt"
    
      114  install -Dm644 release/onnxruntime-LICENSE.txt "$pkgdir/usr/share/licenses/$pkgname/onnxruntime-LICENSE.txt"
    
      115  install -Dm644 release/onnxruntime-NOTICES.txt "$pkgdir/usr/share/licenses/$pkgname/onnxruntime-NOTICES.txt"
    
      116}
    
      117

Changes since previous scan

--- PKGBUILD @ 2026-08-24 00:17
+++ PKGBUILD @ 2026-11-06 06:11
@@ -1,10 +1,10 @@
 # Maintainer: Julian Y. Richard Corbet (julian-corbet on GitHub)
 pkgname=cfetch-agent
-pkgver=0.9.8
-pkgrel=1
+pkgver=0.10.3
+pkgrel=2
 pkgdesc="Cited, trust-tiered memory for AI coding agents over plain Markdown"
 arch=('x86_64' 'aarch64')
-url="https://github.com/corbet-labs/cfetch"
+url="https://git.corbet.ch/corbet-libs/cfetch"
 license=('LicenseRef-FSL-1.1-ALv2')
 provides=('cfetch')
 conflicts=('cfetch')
@@ -13,7 +13,7 @@
 # the archive links "successfully empty" and every sqlite3_* symbol goes missing.
 options=('!lto')
 makedepends=('cargo' 'git')
-source=("$pkgname::git+https://github.com/corbet-labs/cfetch.git#tag=v$pkgver")
+source=("$pkgname::git+https://git.corbet.ch/corbet-libs/cfetch.git#tag=v$pkgver")
 sha256sums=('SKIP')
 
 prepare() {
@@ -23,8 +23,8 @@
 
 _cfetch_variant() {
   case "$CARCH" in
-    x86_64) printf '%s\n' linux-cfetch-remote-x86_64 ;;
-    aarch64) printf '%s\n' linux-cfetch-remote-arm64 ;;
+    x86_64) printf '%s\n' linux-cfetch-cpu-x86_64 ;;
+    aarch64) printf '%s\n' linux-cfetch-cpu-arm64 ;;
     *) printf 'unsupported cfetch architecture: %s\n' "$CARCH" >&2; return 1 ;;
   esac
 }
@@ -90,7 +90,7 @@
 build() {
   cd "$pkgname"
   _cfetch_portable_build_env
-  CFETCH_VARIANT="$(_cfetch_variant)" cargo build --release --locked
+  CFETCH_VARIANT="$(_cfetch_variant)" cargo build --release --locked --features embedded-embeddings
 }
 
 check() {
@@ -99,7 +99,7 @@
   # the same value recompiles target/release/cfetch as an unidentified developer
   # build, and package() would then install that overwritten binary.
   _cfetch_portable_build_env
-  CFETCH_VARIANT="$(_cfetch_variant)" cargo test --release --locked
+  CFETCH_VARIANT="$(_cfetch_variant)" cargo test --release --locked --features embedded-embeddings
 }
 
 package() {
@@ -111,5 +111,7 @@
   install -Dm644 LICENSE.md "$pkgdir/usr/share/licenses/$pkgname/LICENSE.md"
   install -Dm644 THIRD-PARTY-LICENSES.txt \
     "$pkgdir/usr/share/licenses/$pkgname/THIRD-PARTY-LICENSES.txt"
+  install -Dm644 release/onnxruntime-LICENSE.txt "$pkgdir/usr/share/licenses/$pkgname/onnxruntime-LICENSE.txt"
+  install -Dm644 release/onnxruntime-NOTICES.txt "$pkgdir/usr/share/licenses/$pkgname/onnxruntime-NOTICES.txt"
 }
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-06 06:11:22	Medium	1
2026-08-24 00:17:16	Clean	2
2026-08-23 09:20:24	Low	1
2026-08-23 07:20:18	Low	2
2026-08-23 00:10:13	Low	2
2026-08-22 23:18:41	Low	2
2026-08-22 21:18:21	Low	2
2026-08-22 19:18:20	Low	1
2026-08-22 17:18:20	Low	1
2026-08-22 11:17:02	Low	2
2026-08-22 00:02:17	Low	2
2026-08-21 21:15:20	Low	2
2026-08-21 17:15:19	Low	2
2026-08-21 13:15:20	Low	1
2026-08-21 11:15:01	Low	1