diffstalker-grammars

LOW

maintainer yogh-io 0 votes scanned 2026-08-26 09:30:02.614524

View on AUR

Why flagged

Package contains only non-executable data files (WASM blobs and query files) installed for use by a daemon; download from npm is for convenience and has a verifiable checksum, posing minimal risk.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): Package contains only non-executable data files (WASM blobs and query files) installed for use by a daemon; download from npm is for convenience and has a verifiable checksum, posing minimal risk.

PKGBUILD

      1# Maintainer: yogh-io <info@yogh.nl>
    
      2pkgname=diffstalker-grammars
    
      3pkgver=0.13.0
    
      4pkgrel=1
    
      5pkgdesc="Tree-sitter grammars and outline queries for diffstalkerd's in-file symbol search"
    
      6arch=('any')
    
      7url="https://github.com/yogh-io/diffstalker"
    
      8license=('MIT')
    
      9# Data only: wasm blobs and .scm query files. Nothing is compiled, nothing is
    
      10# executed at build time, and there is no dependency on node or bun - the
    
      11# daemon that reads these is the optdepend, not the other way round.
    
      12depends=()
    
      13makedepends=()
    
      14optdepends=('diffstalker-git: the daemon that reads these grammars')
    
      15
    
      16# The published npm tarball, not the git repo. The .wasm files are deliberately
    
      17# not committed upstream (2.4 MB on every clone of a VCS package), so a source
    
      18# build would have to fetch them anyway - this way makepkg does the download and
    
      19# the checksum, which is the same guarantee upstream's vendor script provides,
    
      20# expressed in the tool Arch already trusts.
    
      21source=("$pkgname-$pkgver.tgz::https://registry.npmjs.org/diffstalkerd-grammars/-/diffstalkerd-grammars-$pkgver.tgz")
    
      22sha256sums=('c3a24c1781d5c6da813065dcdad26097e916f8685c056c4d28f2b65457663aea')
    
      23
    
      24# Where diffstalkerd looks. The systemd unit sets
    
      25# DIFFSTALKER_GRAMMARS_DIR to exactly this path; a pacman-owned install has no
    
      26# node_modules, so package resolution can never find these on its own.
    
      27_grammardir=/usr/share/diffstalker/grammars
    
      28
    
      29package() {
    
      30    cd "$srcdir/package"
    
      31
    
      32    install -dm755 "$pkgdir$_grammardir/queries"
    
      33    install -Dm644 ./*.wasm -t "$pkgdir$_grammardir"
    
      34    install -Dm644 queries/*.scm -t "$pkgdir$_grammardir/queries"
    
      35
    
      36    # checksums.json is not packaging metadata - the daemon READS it at
    
      37    # startup, verifies every file against it, and refuses the whole set on a
    
      38    # mismatch. It also records the web-tree-sitter version these were built
    
      39    # for, which is how a daemon/grammars ABI skew is caught instead of
    
      40    # producing wrong symbols. Shipping without it disables outlines entirely.
    
      41    install -Dm644 checksums.json "$pkgdir$_grammardir/checksums.json"
    
      42
    
      43    install -Dm644 README.md "$pkgdir/usr/share/doc/$pkgname/README.md"
    
      44}
    
      45

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-26 09:30:02	Low	2