codu-git

LOW

maintainer hilgardt 0 votes scanned 2026-09-17 13:25:46.713858

View on AUR

Why flagged

The package builds from a public Git repository with a SKIP'd checksum, but it is the project's own source code, not a prebuilt binary, and no malicious or obfuscated behavior is present; the low severity is due to lack of verifiable source integrity, not active risk.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from a public Git repository with a SKIP'd checksum, but it is the project's own source code, not a prebuilt binary, and no malicious or obfuscated behavior is present; the low severity is due to lack of verifiable source integrity, not active risk.

PKGBUILD

      1# Maintainer: hilgardt <hilgardt@gmail.com>
    
      2pkgname=codu-git
    
      3_pkgname=codu
    
      4pkgver=0.1.0.r9.ga5a9634
    
      5pkgrel=1
    
      6pkgdesc='Colourful, themeable, navigable disk usage TUI (like ncdu, with cd-on-exit)'
    
      7arch=('x86_64' 'aarch64')
    
      8url='https://github.com/hilgardt-collab/codu'
    
      9license=('MIT')
    
      10depends=('gcc-libs' 'glibc')
    
      11makedepends=('git' 'cargo')
    
      12provides=('codu')
    
      13# Renamed from cdu-git, whose name collided with other tools called cdu.
    
      14conflicts=('codu' 'cdu-git')
    
      15replaces=('cdu-git')
    
      16install="$pkgname.install"
    
      17source=("$_pkgname::git+$url.git")
    
      18sha256sums=('SKIP')
    
      19
    
      20pkgver() {
    
      21    cd "$_pkgname"
    
      22    printf '%s.r%s.g%s' \
    
      23        "$(sed -n 's/^version = "\(.*\)"/\1/p' Cargo.toml | head -n1)" \
    
      24        "$(git rev-list --count HEAD)" \
    
      25        "$(git rev-parse --short=7 HEAD)"
    
      26}
    
      27
    
      28prepare() {
    
      29    cd "$_pkgname"
    
      30    export RUSTUP_TOOLCHAIN=stable
    
      31    cargo fetch --locked --target "$(rustc -vV | sed -n 's/host: //p')"
    
      32}
    
      33
    
      34build() {
    
      35    cd "$_pkgname"
    
      36    export RUSTUP_TOOLCHAIN=stable
    
      37    export CARGO_TARGET_DIR=target
    
      38    # Upstream's release profile strips the binary; let makepkg do that instead
    
      39    # so the debug split package gets real symbols.
    
      40    export CARGO_PROFILE_RELEASE_STRIP=false
    
      41    cargo build --frozen --release
    
      42
    
      43    # Shell integration for cd-on-exit, generated by the binary just built so
    
      44    # it always matches this version.
    
      45    local bin=target/release/codu
    
      46    "$bin" --shell fish > codu.fish
    
      47    {
    
      48        echo '# codu: leave the shell in the directory shown when codu exits.'
    
      49        echo '# Sourced by bash and zsh login shells. Terminals that start a'
    
      50        echo '# non-login shell need `eval "$(codu --shell bash)"` (or zsh) in the'
    
      51        echo '# rc file instead. Disable with cd-on-exit = false or --no-cd.'
    
      52        echo 'if [ -n "$BASH_VERSION" ] || [ -n "$ZSH_VERSION" ]; then'
    
      53        "$bin" --shell bash | sed '/^#/d; s/^/    /'
    
      54        echo 'fi'
    
      55    } > codu.profile.sh
    
      56}
    
      57
    
      58check() {
    
      59    cd "$_pkgname"
    
      60    export RUSTUP_TOOLCHAIN=stable
    
      61    cargo test --frozen --release
    
      62}
    
      63
    
      64package() {
    
      65    cd "$_pkgname"
    
      66    install -Dm755 target/release/codu -t "$pkgdir/usr/bin/"
    
      67    install -Dm644 codu.profile.sh "$pkgdir/etc/profile.d/codu.sh"
    
      68    install -Dm644 codu.fish "$pkgdir/usr/share/fish/vendor_functions.d/codu.fish"
    
      69    install -Dm644 themes/*.toml -t "$pkgdir/usr/share/codu/themes/"
    
      70    install -Dm644 README.md config.default.toml -t "$pkgdir/usr/share/doc/$pkgname/"
    
      71    install -Dm644 LICENSE -t "$pkgdir/usr/share/licenses/$pkgname/"
    
      72}
    
      73

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 13:25:46	Low	2