commit-sage-bin

LOW

maintainer ahmad_othman 1 votes scanned 2026-10-06 00:13:36.889724

View on AUR

Why flagged

The package installs a prebuilt binary from the project's official GitHub release, which is a normal distribution method; the binary is verified via checksum, and the source is the project's own repository, making it a standard AUR package with low risk despite the few votes and recent upload.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package installs a prebuilt binary from the project's official GitHub release, which is a normal distribution method; the binary is verified via checksum, and the source is the project's own repository, making it a standard AUR package with low risk despite the few votes and recent upload.

PKGBUILD

      1# Maintainer: Ahmad Othman <ahmad.ali.othman@outlook.com>
    
      2pkgname=commit-sage-bin
    
      3pkgver=2.2.0
    
      4pkgrel=1
    
      5pkgdesc="AI-powered git commit message generator (prebuilt binary)"
    
      6arch=('x86_64' 'aarch64')
    
      7url="https://github.com/AhmedOsman101/commit-sage-cli"
    
      8license=('GPL-3.0-only')
    
      9depends=('glibc' 'gcc-libs') # ldd: libc/libm/libpthread/libdl/librt + libgcc_s
    
      10provides=("commit-sage=$pkgver")
    
      11conflicts=('commit-sage')
    
      12options=('!strip') # prebuilt binary: upstream already stripped it; re-stripping risks damage for no gain
    
      13source=("https://raw.githubusercontent.com/AhmedOsman101/commit-sage-cli/v$pkgver/LICENSE")
    
      14source_x86_64=("https://github.com/AhmedOsman101/commit-sage-cli/releases/download/v$pkgver/commit-sage-linux-x64")
    
      15source_aarch64=("https://github.com/AhmedOsman101/commit-sage-cli/releases/download/v$pkgver/commit-sage-linux-arm64")
    
      16sha256sums=('bbd34c3771c7de3e8369e916892fb70af83a3c6926b9c0a3499716c7c7626bd9')
    
      17sha256sums_x86_64=('caed85293a518180786581b4e89cba242fccf05c250f61ce6eee6426cb30fad9')
    
      18sha256sums_aarch64=('957fbb430c8bdd425f77dc9c79f538ac5e4829c89f071afaddf0959058a7af10')
    
      19
    
      20prepare() {
    
      21  # Smoke test, as upstream's installer does: a mislabeled asset (right
    
      22  # checksum, wrong architecture) fails here instead of on users' machines.
    
      23  local _binary="commit-sage-linux-x64"
    
      24  if [ "$CARCH" = "aarch64" ]; then
    
      25    _binary="commit-sage-linux-arm64"
    
      26  fi
    
      27  chmod +x "$_binary"
    
      28  ./"$_binary" --version
    
      29}
    
      30
    
      31package() {
    
      32  local _binary="commit-sage-linux-x64"
    
      33  if [ "$CARCH" = "aarch64" ]; then
    
      34    _binary="commit-sage-linux-arm64"
    
      35  fi
    
      36  install -Dm755 "$srcdir/$_binary" "$pkgdir/usr/bin/commit-sage"
    
      37  install -Dm644 "$srcdir/LICENSE" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      38}
    
      39

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-06 00:13:36	Low	2
2026-10-05 23:40:58	Low	2