cosmic-ext-applet-gh-notifications-git

LOW

maintainer olwig 0 votes scanned 2026-10-27 00:23:28.674093

View on AUR

Why flagged

The package builds from the project's own source via git, uses a wrapper script and includes a logo from GitHub's official brand site; the only concerns are SKIP'd checksum for the git source and low votes, but no remote code execution or malicious behavior is present.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from the project's own source via git, uses a wrapper script and includes a logo from GitHub's official brand site; the only concerns are SKIP'd checksum for the git source and low votes, but no remote code execution or malicious behavior is present.

PKGBUILD

      1# Maintainer: Olaf Wriggers <olaf@olwig.xyz>
    
      2
    
      3_pkgname=cosmic-ext-applet-gh-notifications
    
      4pkgname="${_pkgname}-git"
    
      5pkgver=r7.04eee50
    
      6pkgrel=1
    
      7pkgdesc="A GitHub notifications applet for the COSMIC desktop"
    
      8arch=('x86_64')
    
      9url="https://github.com/cosmic-utils/cosmic-ext-gh-notifications"
    
      10license=('GPL-3.0-only')
    
      11
    
      12depends=(
    
      13    'github-cli'
    
      14    'libxkbcommon'
    
      15)
    
      16
    
      17makedepends=(
    
      18  'cargo'
    
      19  'just'
    
      20  'clang'
    
      21)
    
      22
    
      23# upstream repo is named without "-applet", I add it for consistency
    
      24# and still provide the original name
    
      25_originalname=$(basename "${url}")
    
      26
    
      27provides=(
    
      28  "${_pkgname}"
    
      29  "${_originalname}"
    
      30)
    
      31conflicts=(
    
      32  "${_pkgname}"
    
      33  "${_originalname}"
    
      34)
    
      35
    
      36source=(
    
      37  "${_pkgname}::git+${url}.git"
    
      38  "wrapper.sh"
    
      39  "https://brand.github.com/GitHub_Logos.zip"
    
      40)
    
      41
    
      42sha256sums=(
    
      43  'SKIP'
    
      44  'a55a1d603b7f5f728ba0c3cb6458fb28c9d085ae2c03d38b7f838e3096c29089'
    
      45  'e2a67d6cc51d990a52c46c1cf6bcab688db4830982174bca50e0be7a5c2f3194'
    
      46)
    
      47
    
      48pkgver() {
    
      49  cd "$_pkgname"
    
      50  printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
    
      51}
    
      52
    
      53prepare() {
    
      54  cd "$_pkgname"
    
      55
    
      56  # fix app.desktop for cosmic applet detection
    
      57  desktop_file="resources/app.desktop"
    
      58  echo "NoDisplay=true" >> ${desktop_file}
    
      59  echo "X-CosmicApplet=true" >> ${desktop_file}
    
      60  echo "X-CosmicHoverPopup=Auto" >> ${desktop_file}
    
      61
    
      62  # replace the binary with the wrapper script
    
      63  sed -i "s|Exec=git-work|Exec=git-work-with-token|g" resources/app.desktop
    
      64
    
      65  # replace empty svg with github logo
    
      66  icon_file="resources/icons/hicolor/scalable/apps/icon.svg"
    
      67  cp "${srcdir}/GitHub Logos/SVG/GitHub_Invertocat_White.svg" "${icon_file}"
    
      68
    
      69  export RUSTUP_TOOLCHAIN=stable
    
      70  cargo fetch --locked --target host-tuple
    
      71}
    
      72
    
      73build() {
    
      74  cd "$_pkgname"
    
      75  
    
      76  export RUSTUP_TOOLCHAIN=stable
    
      77  export CARGO_TARGET_DIR=target
    
      78
    
      79  # disable LTO regarding ring problems
    
      80  export CFLAGS="${CFLAGS//-flto[=a-zA-Z0-9]*/}"
    
      81
    
      82  just build-release --frozen
    
      83}
    
      84
    
      85package() {
    
      86  cd "$_pkgname"
    
      87
    
      88  just rootdir="$pkgdir" install
    
      89
    
      90  install -Dm755 "${srcdir}/wrapper.sh" "$pkgdir/usr/bin/git-work-with-token"
    
      91}
    
      92

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-27 00:23:28	Low	2
2026-10-26 23:46:04	Low	2