cross-cleaner

LOW
maintainer nekiplay 1 votes scanned 2026-10-17 07:17:15.137327
View on AUR
Why flagged
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Triggered rules

Low Few votes, recently uploaded zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
PKGBUILD

      1# Maintainer: Roman <roman at users.noreply.github.com>
    
      2# Based on upstream packaging by the Cross-Cleaner authors.
    
      3#
    
      4# NOTE: the license in this repository (the packaging files) is 0BSD, per the
    
      5# AUR submission guidelines. The packaged software itself is GPL-3.0-or-later,
    
      6# which is what the license= field below refers to.
    
      7
    
      8# Built from source with the distribution package's own flags, mirroring the
    
      9# reasoning in packaging/linux/nfpm.yaml: the package manager owns the installed
    
      10# version, so every binary is compiled with --no-default-features and the
    
      11# self-update path is not part of the build at all. `crates/desktop`,
    
      12# `crates/tui` and `crates/cli` each document this in their own Cargo.toml.
    
      13
    
      14pkgname=cross-cleaner
    
      15# The tag archive, not a `git+` source: a VCS source always tracks the default
    
      16# branch, so every user would build whatever main happened to contain at that
    
      17# moment instead of the release that was actually published. With an archive,
    
      18# the version below names exactly one commit.
    
      19#
    
      20# The four lines between the markers are the whole of what
    
      21# .github/workflows/aur.yml rewrites, and the block deliberately contains
    
      22# nothing else -- regenerating it must not delete the explanation around it.
    
      23# ---AUR-VERSION-BEGIN---
    
      24pkgver=2.0.4.4
    
      25pkgrel=1.1
    
      26source=("cross-cleaner-v${pkgver}.tar.gz::https://github.com/Cross-Cleaner/Cross-Cleaner/archive/refs/tags/v${pkgver}.tar.gz")
    
      27sha256sums=('86e98f694c97f518e573c267add2873fc91a751b7905a4a374d326b35b745af5')
    
      28# ---AUR-VERSION-END---
    
      29pkgdesc='Addon-style system cleanup tool that removes temporary files, cache and other system junk'
    
      30arch=('x86_64' 'aarch64')
    
      31url='https://github.com/Cross-Cleaner/Cross-Cleaner'
    
      32license=('GPL-3.0-or-later')
    
      33# ~636 crates in the lock file, all of them needed by the window app. Without a
    
      34# lower bound the resolver picks a version the sources have never been built
    
      35# against; with one, an Arch update that breaks the build is a visible bisect
    
      36# rather than a silent surprise.
    
      37depends=('gcc-libs'
    
       'alsa-lib'
    
       'mesa'
    
       'libdrm'
    
       'wayland'
    
       'wayland-protocols'
    
       'libx11'
    
       'libxcursor'
    
       'libxrandr'
    
       'libxi'
    
       'libxinerama'
    
       'libxrender'
    
       'libxext'
    
       'libxkbcommon'
    
       'libxkbcommon-x11'
    
       'fontconfig')
    
      53# rust, cargo, git, pkgconf and make are base-devel members and so are not
    
      54# listed here; they are named above only to record why the build needs them.
    
      55makedepends=('icoutils'
    
           'desktop-file-utils'
    
           'appstream'
    
           # alsa-sys, khronos-egl and wayland-sys all resolve their native
    
           # libraries through pkg-config at compile time, so the -dev side of
    
           # each has to be present while building, not only afterwards.
    
           'alsa-lib'
    
           'mesa'
    
           'wayland')
    
      64optdepends=('gtk-update-icon-cache: update the icon cache without restarting the session')
    
      65
    
      66# No pkgver() function. The version is pinned to one git tag by the source line
    
      67# above, so there is nothing left to compute at build time -- and a pkgver()
    
      68# function is exactly what made this package unusable as an AUR package before:
    
      69# it resolved against whatever the clone happened to contain, which drifted
    
      70# from the pkgver= line the AUR web interface displays.
    
      71
    
      72# GitHub's tag archives extract into a directory named after the tag without
    
      73# its leading `v`. Set once here so prepare(), build() and package() all agree.
    
      74_srcdir_tag="Cross-Cleaner-${pkgver}"
    
      75
    
      76prepare() {
    
  cd "$srcdir/$_srcdir_tag"
    
      78
    
  # crates/winicon/assets/icon.ico holds a single 96px frame, so this is a
    
  # straight extraction rather than a resize. Unlike the AppImage build, which
    
  # upscales to 128 and 256 with ImageMagick, nothing is invented here: the
    
  # one real size is installed as-is. Dropping a >=512px master PNG into
    
  # crates/winicon/assets is what makes the larger hicolor slots worth filling.
    
  #
    
  # Extraction goes to a throwaway directory rather than straight to
    
  # $srcdir/icons: prepare() has to be idempotent, because makepkg reuses an
    
  # existing $srcdir whenever only the PKGBUILD changed. Writing the frame
    
  # next to its destination and then `mv`-ing it onto itself fails the second
    
  # time round, with "mv: ... and ... are the same file".
    
  local extract
    
  extract=$(mktemp -d)
    
  icotool -x -o "$extract" crates/winicon/assets/icon.ico
    
  # icotool names its output after the source and the frame's geometry, so
    
  # glob rather than hardcode the name.
    
  local frame
    
  frame=$(find "$extract" -name '*.png' -print -quit)
    
  if [[ -z "$frame" ]]; then
    
      rm -rf "$extract"
    
      printf 'icotool extracted no frame from icon.ico\n' >&2
    
      return 1
    
  fi
    
  install -Dm644 "$frame" "$srcdir/icons/cross-cleaner.png"
    
  rm -rf "$extract"
    
      104
    
  # Make the binaries report this package's version.
    
  #
    
  # `--version` comes from CARGO_PKG_VERSION, and cargo takes that from the
    
  # `version` field of each crate's [package] table. It is not overridable
    
  # from the environment -- exporting CARGO_PKG_VERSION before the build
    
  # changes nothing, verified on cargo 1.98.
    
  #
    
  # The values in the tree are whatever the release happened to leave there,
    
  # and they disagree with the tag: crates/*/Cargo.toml says 2.0.1 while the
    
  # tag this package is built from is 2.0.4.2.5. The cause is upstream --
    
  # dev_build.yml rewrote every Cargo.toml back to a hardcoded 2.0.1 on each
    
  # push while release.yml wrote the real version, so the two ping-ponged and
    
  # each tag inherited whichever it landed on (v2.0.4.2.4 reports 2.0.1,
    
  # v2.0.4.2.5 reports 2.0.4).
    
  #
    
  # Rewriting only the [package] table, not every `version = ` line: a
    
  # dependency declared as
    
  #     [dependencies.foo]
    
  #     version = "1"
    
  # is legal TOML and a plain /^version = / would rewrite that too, silently
    
  # changing which version of a dependency is required.
    
  # The release version has four components (2.0.4.2.5) but a cargo package
    
  # version is semver: exactly three numeric components, optionally followed
    
  # by -pre or +build. Passing four in is a hard parse error, which is why
    
  # release.yml does the same `cut -d. -f1-3`. So the application reports
    
  # 2.0.4 for a 2.0.4.2.5 package: the fourth component has no representation
    
  # inside the binary and cannot be recovered from one.
    
  local crate_version
    
  crate_version=$(printf '%s' "$pkgver" | cut -d. -f1-3)
    
  if ! printf '%s' "$crate_version" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+$'; then
    
      printf 'pkgver %s does not reduce to a semver version (%s)\n' "$pkgver" "$crate_version" >&2
    
      return 1
    
  fi
    
      138
    
  find "$srcdir/$_srcdir_tag" -name Cargo.toml -print0 |
    
      while IFS= read -r -d '' manifest; do
    
          awk -v v="$crate_version" '
    
              /^\[package\]/          { inpkg = 1 }
    
              /^\[/ && !/^\[package\]/ { inpkg = 0 }
    
              inpkg && /^version[[:space:]]*=/ && !seen {
    
                  print "version = \"" v "\""
    
                  seen = 1
    
                  next
    
              }
    
              { print }
    
          ' "$manifest" > "$manifest.tmp" && mv "$manifest.tmp" "$manifest"
    
      done
    
      152
    
  # The three components alone are not the release version, so the string the
    
  # binaries print is set outright. clap takes it from CARGO_PKG_VERSION when
    
  # the attribute says a bare `version,`, and that can only ever hold three
    
  # semver numbers. Replacing the bare form with an explicit literal is what
    
  # makes `cross-cleaner-cli --version` read 2.0.4.2.5 for a 2.0.4.2.5
    
  # package.
    
  #
    
  # The patch is verified rather than assumed: if upstream moves the clap
    
  # attribute, sed would quietly match nothing and the binaries would fall
    
  # back to reporting 2.0.4 with no error anywhere. Each file is checked
    
  # after the substitution, so that regression fails the build loudly.
    
  #
    
  # Two shapes have to be covered, and both appear upstream today: a bare
    
  # `version,` line inside a multi-line #[command(...)] (cli/src/args.rs) and
    
  # `#[command(version, about, ...)]` on one line (tui and desktop).
    
  local manifest
    
  for manifest in \
    
      crates/cli/src/args.rs \
    
      crates/tui/src/main.rs \
    
      crates/desktop/src/main.rs
    
  do
    
      [[ -f "$srcdir/$_srcdir_tag/$manifest" ]] || {
    
          printf 'expected %s to exist; upstream moved it\n' "$manifest" >&2
    
          return 1
    
      }
    
      sed -i \
    
          -e "s/^\([[:space:]]*\)version,$/\1version = \"$pkgver\",/" \
    
          -e "s/#\[command(version, /#[command(version = \"$pkgver\", /" \
    
          "$srcdir/$_srcdir_tag/$manifest"
    
      grep -q "version = \"$pkgver\"," "$srcdir/$_srcdir_tag/$manifest" || {
    
          printf 'could not set the version string in %s\n' "$manifest" >&2
    
          return 1
    
      }
    
  done
    
      187
    
  # packaging/linux/cross-cleaner.appdata.xml carries %%VERSION%% and %%DATE%%
    
  # for the release workflow to fill in. The date cannot come from the
    
  # commit here: the source is a tag archive, not a git checkout, so there is
    
  # no .git to ask. The build date is used instead, which is the only moment
    
  # this package knows about.
    
  local release_date
    
  release_date=$(date -u +%Y-%m-%d)
    
  sed -e "s/%%VERSION%%/$pkgver/g" \
    
      -e "s/%%DATE%%/$release_date/g" \
    
      packaging/linux/cross-cleaner.appdata.xml > "$srcdir/cross-cleaner.appdata.xml"
    
  if grep -q '%%' "$srcdir/cross-cleaner.appdata.xml"; then
    
      printf 'unsubstituted placeholder left in the AppStream metadata\n' >&2
    
      return 1
    
  fi
    
      202
    
  desktop-file-validate packaging/linux/cross-cleaner.desktop
    
  desktop-file-validate packaging/linux/cross-cleaner-tui.desktop
    
  # Non-fatal, matching the release workflow: a metadata lint should be
    
  # visible without being able to block an install.
    
  appstreamcli validate --pedantic "$srcdir/cross-cleaner.appdata.xml" || :
    
      208}
    
      209
    
      210# One cargo invocation per binary, as .github/workflows/release.yml does it.
    
      211build() {
    
  cd "$srcdir/$_srcdir_tag"
    
      213
    
  # Unset the compiler flags makepkg exports, and tell rustc not to read a
    
  # rustflags setting from anywhere. Arch's CFLAGS
    
  #
    
  #   -march=x86-64 -mtune=generic -O2 -pipe -fno-plt -fexceptions
    
  #   -Wp,-D_FORTIFY_SOURCE=3 -fstack-clash-protection -fcf-protection ...
    
  #
    
  # are handed to the `cc` crate, which passes them straight to the C compiler
    
  # that ring's build.rs uses for its crypto core. At least one of them makes
    
  # that build produce objects whose symbols the final link cannot resolve,
    
  # and the whole binary then fails to link:
    
  #
    
  #   ld.lld: error: undefined symbol: ring_core_0_17_14__x25519_sc_mask
    
  #   ld.lld: error: undefined symbol: ring_core_0_17_14__aes_nohw_set_encrypt_key
    
  #   ... every symbol of ring's native core
    
  #
    
  # ring's own build.rs output is correct throughout -- it emits both
    
  # `rustc-link-lib=static=ring_core_0_17_14_` and `rustc-link-search`, and
    
  # the archive really does contain all 157 symbols. What breaks is the link
    
  # step, which sees the `-L` search path but not the `-l`.
    
  #
    
  # Verified by bisection on a reduced crate (ureq -> rustls -> ring): the
    
  # build passes with makepkg's CFLAGS removed and fails with them set, while
    
  # LTO, RUSTFLAGS, LDFLAGS and the rest of makepkg's environment are all
    
  # neutral. Note this is NOT upstream's fat LTO profile causing it -- the
    
  # release profile in Cargo.toml builds these binaries fine on Ubuntu.
    
  #
    
  # Clearing the variables is also the more correct behaviour for a package:
    
  # these are the distribution's hardening flags for distribution-built
    
  # software, not something a third-party package should silently inherit.
    
  unset CFLAGS CXXFLAGS CPPFLAGS FCFLAGS FFLAGS ARFLAGS LDFLAGS LTOFLAGS
    
  unset RUSTFLAGS CARGO_ENCODED_RUSTFLAGS
    
      245
    
  # No --locked. The Cargo.lock committed in the release tags is stale with
    
  # respect to the manifests in those same tags: tag v2.0.4.2.5 declares
    
  # version = "2.0.4" in crates/*/Cargo.toml while its Cargo.lock still records
    
  # the workspace crates at 2.0.1, so cargo insists on rewriting the lock and
    
  # --locked aborts the build before anything is compiled.
    
  #
    
  # The thing --locked was here to protect still holds without it. Cargo.lock
    
  # already pins gpu-allocator to a concrete git revision through
    
  # Cargo.toml's [patch.crates-io], and cargo does not revisit entries that
    
  # are present and still satisfy the manifests -- the only edits it makes are
    
  # the workspace version numbers above. Upstream's own release builds do not
    
  # pass --locked either.
    
  cargo build --release --no-default-features -p desktop
    
  cargo build --release --no-default-features -p tui
    
  cargo build --release --no-default-features -p cli
    
      261}
    
      262
    
      263# No check() on purpose. The workspace release profile sets panic = "abort",
    
      264# which is not what the test harness wants, and the android crate in the
    
      265# workspace needs the NDK to build at all. The upstream CI does not run
    
      266# `cargo test` either, so there is no suite this package would be able to run
    
      267# that CI is not already running.
    
      268package() {
    
  cd "$srcdir/$_srcdir_tag"
    
      270
    
  # cargo names each binary after its package. They are renamed to
    
  # hyphenated commands so the desktop entries and the AppImage agree with
    
  # this package: Exec lines and shell completions must not change per release.
    
  install -Dm755 target/release/desktop "$pkgdir/usr/bin/cross-cleaner"
    
  install -Dm755 target/release/tui "$pkgdir/usr/bin/cross-cleaner-tui"
    
  install -Dm755 target/release/cli "$pkgdir/usr/bin/cross-cleaner-cli"
    
      277
    
  install -Dm644 packaging/linux/cross-cleaner.desktop \
    
      "$pkgdir/usr/share/applications/cross-cleaner.desktop"
    
  install -Dm644 packaging/linux/cross-cleaner-tui.desktop \
    
      "$pkgdir/usr/share/applications/cross-cleaner-tui.desktop"
    
      282
    
  install -Dm644 "$srcdir/icons/cross-cleaner.png" \
    
      "$pkgdir/usr/share/icons/hicolor/96x96/apps/cross-cleaner.png"
    
      285
    
  install -Dm644 "$srcdir/cross-cleaner.appdata.xml" \
    
      "$pkgdir/usr/share/metainfo/cross-cleaner.appdata.xml"
    
      288}
    
      289
Changes since previous scan

--- PKGBUILD @ 2026-10-17 00:21
+++ PKGBUILD @ 2026-10-17 07:17
@@ -22,7 +22,7 @@
 # nothing else -- regenerating it must not delete the explanation around it.
 # ---AUR-VERSION-BEGIN---
 pkgver=2.0.4.4
-pkgrel=1
+pkgrel=1.1
 source=("cross-cleaner-v${pkgver}.tar.gz::https://github.com/Cross-Cleaner/Cross-Cleaner/archive/refs/tags/v${pkgver}.tar.gz")
 sha256sums=('86e98f694c97f518e573c267add2873fc91a751b7905a4a374d326b35b745af5')
 # ---AUR-VERSION-END---
Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 07:17:15	Low	1
2026-10-17 00:21:55	Clean	2
2026-10-16 15:16:11	Low	1
2026-10-14 00:06:47	Clean	2
2026-10-13 11:16:23	Low	1
2026-10-11 00:26:05	Clean	2
2026-10-10 14:14:18	Low	1
2026-10-10 10:13:47	Low	1
2026-10-10 08:13:38	Low	1