colibri-social-beta

LOW

maintainer fereira 0 votes scanned 2026-11-02 00:26:00.633185

View on AUR

Why flagged

The package builds from source hosted on GitHub (plausibly the project's own), uses a SKIP'd checksum only for the LICENSE file (non-executable data), and performs standard build steps without executing untrusted remote code or installing prebuilt binaries.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from source hosted on GitHub (plausibly the project's own), uses a SKIP'd checksum only for the LICENSE file (non-executable data), and performs standard build steps without executing untrusted remote code or installing prebuilt binaries.

PKGBUILD

      1# Maintainer: Eli Fereira <eli@fereira.net>
    
      2
    
      3pkgname=colibri-social-beta
    
      4pkgver=0.6.0_spaces.19
    
      5pkgrel=1
    
      6pkgdesc="Call, chat, and hang out on a platform built for you! (spaces version)"
    
      7url="https://github.com/colibri-social/colibri.social"
    
      8_rawurl="${url/github.com/raw.githubusercontent.com}/refs/tags/v${pkgver//_/-}"
    
      9arch=('x86_64')
    
      10license=('MIT')
    
      11options=('!lto')
    
      12conflicts=(
    
      13  'colibri-social'
    
      14  'colibri-social-beta-bin'
    
      15)
    
      16depends=(
    
      17  'webkit2gtk-4.1'
    
      18  'gtk3'
    
      19  'libsoup3'
    
      20  'cairo'
    
      21  'glib2'
    
      22  'gdk-pixbuf2'
    
      23  'hicolor-icon-theme'
    
      24  'nspr'
    
      25  'nss'
    
      26  'alsa-lib'
    
      27)
    
      28makedepends=(
    
      29  'nodejs'
    
      30  'pnpm'
    
      31  'rust'
    
      32  'cargo'
    
      33)
    
      34source=(
    
      35  "${pkgname}-${pkgver//_/-}.tar.gz::${url}/archive/refs/tags/v${pkgver//_/-}.tar.gz"
    
      36  "LICENSE_$pkgver::$_rawurl/LICENSE"
    
      37)
    
      38sha256sums=(
    
      39  'e3879efc2e683c59f9e0733e77abf841bd7ca309f44d52172b91dc0586ebb895'
    
      40  'SKIP'
    
      41)
    
      42
    
      43prepare() {
    
      44  cd "${srcdir}/colibri.social-${pkgver//_/-}"
    
      45
    
      46  # Make sure version in tauri.conf.json matches the git tag version so artifact
    
      47  # outputs into a predictable place
    
      48  sed -i -E "s/^([[:space:]]*\"version\"[[:space:]]*:[[:space:]]*)\"[^\"]*\"/\1\"${pkgver//_/-}\"/" \
    
      49    packages/wrapper/src-tauri/tauri.conf.json
    
      50}
    
      51
    
      52build() {
    
      53  cd "${srcdir}/colibri.social-${pkgver//_/-}"
    
      54
    
      55  pnpm install --frozen-lockfile
    
      56  pnpm --filter @colibri-social/wrapper tauri build --bundles deb --no-sign
    
      57}
    
      58
    
      59package() {
    
      60  cp -a -- "${srcdir}/colibri.social-${pkgver//_/-}/packages/wrapper/src-tauri/target/release/bundle/deb/Colibri Social_${pkgver//_/-}_amd64/data/." "${pkgdir}/"
    
      61
    
      62  install -Dm644 "LICENSE_$pkgver" "${pkgdir}/usr/share/licenses/$pkgname/LICENSE"
    
      63
    
      64  # Disable autoupdates
    
      65  sed -i 's/Exec=colibri-social/Exec=colibri-social --no-update-check/' "${pkgdir}/usr/share/applications/Colibri Social.desktop"
    
      66}
    
      67

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-02 00:26:00	Low	2
2026-11-02 00:02:06	Low	2