cross-cleaner-bin
LOW
maintainer nekiplay
0 votes
scanned 2026-10-17 07:17:15.137327
Why flagged
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
PKGBUILD
1
# Maintainer: Roman <roman at users.noreply.github.com>
2
# Based on upstream packaging by the Cross-Cleaner authors.
3
#
4
# NOTE: the license in this repository (the packaging files) is 0BSD, per the
5
# AUR submission guidelines. The packaged software itself is GPL-3.0-or-later,
6
# which is what the license= field below refers to.
7
8
# The `-bin` sibling of `cross-cleaner` (see ../PKGBUILD). That package
9
# compiles the release tag on the machine that installs it; this one downloads
10
# the executables the release workflow already published and installs them
11
# unchanged. Nothing is compiled here, so no Rust toolchain and no access to
12
# crates.io are involved, and the "build" takes a download rather than an hour.
13
#
14
# The assets taken are the `-no-updater` ones. release.yml builds those with
15
# `--no-default-features`, which switches the `self-update` feature off in
16
# crates/desktop, crates/tui and crates/cli, so an installed copy can neither
17
# advertise a newer release nor replace the file makepkg put on disk. That is
18
# the same reason ../PKGBUILD builds with `--no-default-features`; installing
19
# the plain `Linux-Cross_Cleaner_GUI` asset instead would put a program on the
20
# system that fights pacman over its own binaries.
21
#
22
# The tag archive is a source here as well, but only for metadata: the release
23
# uploads executables and nothing else, so the desktop entries, the AppStream
24
# file and the icon exist nowhere but in the tree. None of it is compiled.
25
26
pkgname=cross-cleaner-bin
27
# Everything between the markers is rewritten by .github/workflows/aur.yml on
28
# every publication -- the version, the pkgrel, and one checksum per source --
29
# so the block deliberately contains nothing else. The checksums committed here
30
# are the placeholders the workflow replaces: sha256sums accepts `SKIP` for a
31
# source nothing has hashed yet, and the workflow refuses to push while a SKIP
32
# is left.
33
#
34
# One source array per architecture, which is how makepkg chooses the right
35
# upload: it reads the array named after the machine it runs on, and compares
36
# the files against the matching sha256sums array. The tag archive is listed in
37
# both, because both architectures share it; the uploads are not, because the
38
# arm64 assets carry an extra `Arm64` marker in their names.
39
#
40
# The uploads are written as full URLs rather than renamed with `::`, so the
41
# local file name stays the name the asset has on the release page: a checksum
42
# in the AUR can then be checked by hand against the download with the same
43
# name. Only the archive is renamed, because GitHub calls it
44
# v${pkgver}.tar.gz and ../PKGBUILD already established the longer name.
45
# ---AUR-VERSION-BEGIN---
46
pkgver=2.0.4.4
47
pkgrel=1.1
48
source_x86_64=(
49
"cross-cleaner-v${pkgver}.tar.gz::https://github.com/Cross-Cleaner/Cross-Cleaner/archive/refs/tags/v${pkgver}.tar.gz"
50
"https://github.com/Cross-Cleaner/Cross-Cleaner/releases/download/v${pkgver}/Linux-Cross_Cleaner_GUI-no-updater"
51
"https://github.com/Cross-Cleaner/Cross-Cleaner/releases/download/v${pkgver}/Linux-Cross_Cleaner_TUI-no-updater"
52
"https://github.com/Cross-Cleaner/Cross-Cleaner/releases/download/v${pkgver}/Linux-Cross_Cleaner_CLI-no-updater"
53
)
54
sha256sums_x86_64=(
55
'86e98f694c97f518e573c267add2873fc91a751b7905a4a374d326b35b745af5'
56
'7c9dc68b71d0b60dd2cf251f58aabb2354af39bf60e1926d3d9b541b7365e6ef'
57
'6de6ddeff5e974ca314499b883712c0129f382c3ae369699225abdee06aa2f8c'
58
'dc7eb1005a10e2e5243f9d964e9d2fb17876c4bed28f36447822c2c15aec0733'
59
)
60
source_aarch64=(
61
"cross-cleaner-v${pkgver}.tar.gz::https://github.com/Cross-Cleaner/Cross-Cleaner/archive/refs/tags/v${pkgver}.tar.gz"
62
"https://github.com/Cross-Cleaner/Cross-Cleaner/releases/download/v${pkgver}/Linux-Arm64-Cross_Cleaner_GUI-no-updater"
63
"https://github.com/Cross-Cleaner/Cross-Cleaner/releases/download/v${pkgver}/Linux-Arm64-Cross_Cleaner_TUI-no-updater"
64
"https://github.com/Cross-Cleaner/Cross-Cleaner/releases/download/v${pkgver}/Linux-Arm64-Cross_Cleaner_CLI-no-updater"
65
)
66
sha256sums_aarch64=(
67
'86e98f694c97f518e573c267add2873fc91a751b7905a4a374d326b35b745af5'
68
'680ce1839a926410dee0a2c3fff10b33e456f89b2604a2072f761d87a68acb67'
69
'86b24c2e7a2ff5b3b22cf66f0139219acd0eb6aa90928773bc51b6d705fec3b3'
70
'08f793954d8d247174ecfbb2a86f0689d3cbf1ca1d021cfa5cf8cc036814707d'
71
)
72
# ---AUR-VERSION-END---
73
pkgdesc='Addon-style system cleanup tool that removes temporary files, cache and other system junk (prebuilt binaries)'
74
arch=('x86_64' 'aarch64')
75
url='https://github.com/Cross-Cleaner/Cross-Cleaner'
76
license=('GPL-3.0-or-later')
77
# The two packages own the same paths, so a system can hold one of them and
78
# not both. Without this, installing either over the other fails on a file
79
# conflict from pacman instead of replacing it.
80
provides=('cross-cleaner')
81
conflicts=('cross-cleaner')
82
# Copied from ../PKGBUILD, and for its reason rather than because anything
83
# here links them at build time: winit reaches the X11 and Wayland stacks
84
# through x11-dl and wayland-backend's dlopen, so ldd cannot see those
85
# libraries and neither can any automatic dependency sweep. The prebuilt
86
# binary dlopens them exactly like the compiled one does.
87
depends=('gcc-libs'
88
'alsa-lib'
89
'mesa'
90
'libdrm'
91
'wayland'
92
'wayland-protocols'
93
'libx11'
94
'libxcursor'
95
'libxrandr'
96
'libxi'
97
'libxinerama'
98
'libxrender'
99
'libxext'
100
'libxkbcommon'
101
'libxkbcommon-x11'
102
'fontconfig')
103
# icoutils is the only build-side dependency, and it is here for the icon: the
104
# .ico that ships in the tag holds a single 96px frame that has to be pulled
105
# out of it before it can be installed.
106
#
107
# desktop-file-utils and appstream are deliberately absent, unlike in
108
# ../PKGBUILD. Nothing here writes a desktop entry or an AppStream file -- both
109
# come from the tag -- and the release pipeline validates those exact files
110
# with those exact tools before it uploads anything, so a second validation
111
# would only add build dependencies to every user's machine (see
112
# .github/actions/linux-package/action.yml).
113
makedepends=('icoutils')
114
optdepends=('gtk-update-icon-cache: update the icon cache without restarting the session')
115
116
# No pkgver() function, for the reason spelled out in ../PKGBUILD: the version
117
# names one tag, and a pkgver() that computes anything at build time is what
118
# made this package family unusable on the AUR before.
119
120
# GitHub names a tag archive's top-level directory after the tag without its
121
# leading `v`, the same directory ../PKGBUILD expects.
122
_srcdir_tag="Cross-Cleaner-${pkgver}"
123
124
# Which upload belongs to this machine. A function rather than two `case`
125
# blocks because prepare(), which checks the file, and package(), which
126
# installs it, must not be able to disagree: a disagreement would not fail the
127
# build, it would install a binary for the other architecture.
128
_asset_prefix() {
129
case "$CARCH" in
130
x86_64) printf '%s' 'Linux' ;;
131
aarch64) printf '%s' 'Linux-Arm64' ;;
132
*)
133
printf 'no asset is published for %s\n' "$CARCH" >&2
134
return 1
135
;;
136
esac
137
}
138
139
prepare() {
140
local prefix
141
prefix=$(_asset_prefix) || return 1
142
143
cd "$srcdir/$_srcdir_tag"
144
145
# Unchanged from ../PKGBUILD. crates/winicon/assets/icon.ico holds one
146
# 96px frame, so this is a straight extraction rather than a resize, and
147
# only that one real size is installed: the AppImage build upscales to 128
148
# and 256, this one does not invent sizes upstream never provided.
149
#
150
# The extraction goes through a throwaway directory because prepare() has
151
# to be idempotent: makepkg reuses an existing $srcdir whenever only the
152
# PKGBUILD changed, and writing the frame next to its destination and then
153
# `mv`-ing it onto itself fails the second time round with
154
# "mv: ... and ... are the same file".
155
local extract frame
156
extract=$(mktemp -d)
157
icotool -x -o "$extract" crates/winicon/assets/icon.ico
158
frame=$(find "$extract" -name '*.png' -print -quit)
159
if [[ -z "$frame" ]]; then
160
rm -rf "$extract"
161
printf 'icotool extracted no frame from icon.ico\n' >&2
162
return 1
163
fi
164
install -Dm644 "$frame" "$srcdir/icons/cross-cleaner.png"
165
rm -rf "$extract"
166
167
# packaging/linux/cross-cleaner.appdata.xml carries %%VERSION%% and %%DATE%%
168
# for whoever packages it. The date comes from the build date here as well
169
# as in ../PKGBUILD: the source is a tag archive, not a git checkout, so
170
# there is no .git to ask for the commit's timestamp.
171
#
172
# The version is where the two packages part company. ../PKGBUILD rewrites
173
# the sources so that `--version` reports the full four-component release
174
# version; a prebuilt binary cannot be rewritten, so this substitution only
175
# changes what the metadata claims. The uploads were compiled against the
176
# three-component version upstream puts in Cargo.toml, which is 2.0.4 for
177
# this 2.0.4.2.5 package -- the fourth component has no representation
178
# inside a cargo version at all. See the README.
179
local release_date
180
release_date=$(date -u +%Y-%m-%d)
181
sed -e "s/%%VERSION%%/$pkgver/g" \
182
-e "s/%%DATE%%/$release_date/g" \
183
packaging/linux/cross-cleaner.appdata.xml > "$srcdir/cross-cleaner.appdata.xml"
184
if grep -q '%%' "$srcdir/cross-cleaner.appdata.xml"; then
185
printf 'unsubstituted placeholder left in the AppStream metadata\n' >&2
186
return 1
187
fi
188
189
# Two properties of the downloads are worth checking, because both are
190
# silent when they go wrong and only show up in someone's install:
191
#
192
# 1. the architecture. A URL that lost its `Arm64` marker resolves happily
193
# on the wrong machine, and pacman reports a successful installation of
194
# a binary it cannot execute. file(1) spells this machine "x86-64" with
195
# a hyphen, which is not the Rust spelling of the same architecture, so
196
# the expected string is worked out here rather than reusing $CARCH.
197
# 2. the feature set. The `-no-updater` suffix is the whole reason this
198
# package exists: a self-updating binary would replace its own file
199
# behind pacman's back and drift from the version the database records.
200
# Nothing else in a -bin package can notice that, so `strings` is asked
201
# for the `selfupdate` crate -- the same canary the release pipeline
202
# applies to the .deb it builds from this same code (see
203
# linux-package/action.yml). Matching lines are printed rather than just
204
# counted, so a false positive names itself.
205
#
206
# `canary=$(... || :)` rather than a pipeline into `if`: a grep that finds
207
# nothing exits 1, which is the answer being asked for and not an error.
208
local elf_arch
209
case "$CARCH" in
210
x86_64) elf_arch='x86-64' ;;
211
aarch64) elf_arch='aarch64' ;;
212
esac
213
214
local component asset desc canary
215
for component in GUI TUI CLI; do
216
asset="$srcdir/${prefix}-Cross_Cleaner_${component}-no-updater"
217
# -L is not decoration. makepkg does not copy a source into $srcdir, it
218
# symlinks it there -- the download stays in the directory holding the
219
# PKGBUILD -- and file(1) does not follow symlinks unless it is told to
220
# (that is its POSIXLY_CORRECT behaviour, not its default). Reading the
221
# link instead of the binary gives "symbolic link to ...", which matches
222
# neither architecture, so the check below rejected every build of the
223
# first published version of this package. -b drops the file name,
224
# which is printed here anyway.
225
desc=$(file -Lb "$asset")
226
printf '%s: %s\n' "${asset##*/}" "$desc"
227
if [[ "$desc" != *"$elf_arch"* ]]; then
228
printf '%s is not a %s binary\n' "$asset" "$elf_arch" >&2
229
return 1
230
fi
231
canary=$(strings "$asset" | grep -i 'selfupdate' || :)
232
if [[ -n "$canary" ]]; then
233
printf '%s carries self-update code:\n%s\n' "$asset" "$canary" >&2
234
return 1
235
fi
236
done
237
}
238
239
# No build() on purpose: the executable this package installs is already built
240
# and is downloaded by makepkg as a source. That also means no check(): there is
241
# no source tree here to run a test suite against.
242
243
package() {
244
local prefix
245
prefix=$(_asset_prefix) || return 1
246
247
cd "$srcdir"
248
249
# Installed under the same hyphenated names ../PKGBUILD uses. cargo names
250
# the uploads after their packages (desktop, tui, cli) while every desktop
251
# entry and both project-packaged installers say `cross-cleaner`,
252
# `cross-cleaner-tui` and `cross-cleaner-cli`; renaming here keeps Exec=
253
# lines valid across releases and keeps the two AUR packages
254
# interchangeable.
255
install -Dm755 "${prefix}-Cross_Cleaner_GUI-no-updater" \
256
"$pkgdir/usr/bin/cross-cleaner"
257
install -Dm755 "${prefix}-Cross_Cleaner_TUI-no-updater" \
258
"$pkgdir/usr/bin/cross-cleaner-tui"
259
install -Dm755 "${prefix}-Cross_Cleaner_CLI-no-updater" \
260
"$pkgdir/usr/bin/cross-cleaner-cli"
261
262
install -Dm644 "$srcdir/$_srcdir_tag/packaging/linux/cross-cleaner.desktop" \
263
"$pkgdir/usr/share/applications/cross-cleaner.desktop"
264
install -Dm644 "$srcdir/$_srcdir_tag/packaging/linux/cross-cleaner-tui.desktop" \
265
"$pkgdir/usr/share/applications/cross-cleaner-tui.desktop"
266
267
install -Dm644 "$srcdir/icons/cross-cleaner.png" \
268
"$pkgdir/usr/share/icons/hicolor/96x96/apps/cross-cleaner.png"
269
270
install -Dm644 "$srcdir/cross-cleaner.appdata.xml" \
271
"$pkgdir/usr/share/metainfo/cross-cleaner.appdata.xml"
272
}
273
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-17 07:17:15 | Low | 1 |