currant-git

LOW

maintainer trougnouf 0 votes scanned 2026-09-15 01:18:20.793362

View on AUR

Why flagged

The package builds from source hosted on a maintainer-controlled git server, which is not whitelisted but plausibly project-owned; the SKIP'd checksum is expected for git sources and not inherently dangerous; no remote code execution or malicious patterns present.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from source hosted on a maintainer-controlled git server, which is not whitelisted but plausibly project-owned; the SKIP'd checksum is expected for git sources and not inherently dangerous; no remote code execution or malicious patterns present.

PKGBUILD

      1# Maintainer: Benoit Brummer (Trougnouf) <trougnouf@disroot.org>
    
      2pkgname=currant-git
    
      3_pkgname=currant
    
      4pkgver=57.abce92e.rolling
    
      5pkgrel=1
    
      6pkgdesc="Fast and powerful music player with a Rust core and thin frontends (git version)"
    
      7arch=('x86_64')
    
      8url="https://git.disroot.org/trougnouf/currant"
    
      9license=('GPL-3.0-or-later')
    
      10depends=(
    
      11    'gcc-libs'
    
      12    'glibc'
    
      13    'opus'       # opus playback (libopus, linked by the opus crate)
    
      14    'libogg'     # ogg container demuxer (libogg, linked by the ogg crate)
    
      15    'alsa-lib'   # audio output via cpal/rodio
    
      16)
    
      17makedepends=('cargo' 'pkgconf' 'git')
    
      18conflicts=("$_pkgname")
    
      19provides=("$_pkgname")
    
      20source=("$_pkgname::git+$url.git")
    
      21sha256sums=('SKIP')
    
      22options=('!lto' '!strip' '!debug')
    
      23
    
      24pkgver() {
    
      25  cd "$_pkgname"
    
      26  local commit_hash=$(git rev-parse --short HEAD)
    
      27  local commit_count=$(git rev-list --count HEAD)
    
      28  local latest_tag=$(git describe --tags --abbrev=0 2>/dev/null || echo "rolling")
    
      29  # Strip leading 'v' from the workspace release tag (e.g. v0.1.1 -> 0.1.1)
    
      30  # and sanitize characters that makepkg forbids in pkgver.
    
      31  latest_tag="${latest_tag##*-v}"
    
      32  latest_tag="${latest_tag#v}"
    
      33  latest_tag="${latest_tag//[-\/]/.}"
    
      34  echo "$commit_count.$commit_hash.$latest_tag"
    
      35}
    
      36
    
      37build() {
    
      38  cd "$_pkgname"
    
      39  cargo build --release --locked
    
      40}
    
      41
    
      42package() {
    
      43  cd "$_pkgname"
    
      44
    
      45  install -Dm755 "target/release/currant-tui" "$pkgdir/usr/bin/currant-tui"
    
      46  install -Dm755 "target/release/currant-ctl" "$pkgdir/usr/bin/currant-ctl"
    
      47
    
      48  install -Dm644 README.md "$pkgdir/usr/share/doc/$pkgname/README.md"
    
      49}
    
      50

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-15 01:18:20	Low	2