digimem-bin

LOW

maintainer keithvassallo 0 votes scanned 2026-09-19 21:31:46.356329

View on AUR

Why flagged

The package repackages a published .deb from GitHub releases, which is a common practice for binary packages; the source is verifiable via checksum and hosted on an official project platform, posing minimal risk.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package repackages a published .deb from GitHub releases, which is a common practice for binary packages; the source is verifiable via checksum and hosted on an official project platform, posing minimal risk.

PKGBUILD

      1# Maintainer: Keith Vassallo <keith@vassallo.cloud>
    
      2#
    
      3# Template. `just aur` / `just aur-publish` render this into a real PKGBUILD,
    
      4# substituting 0.2.0 and bab544be8dbfdd82e11bba39b08caa8741f2efbf9fbda51cb2017d0254c662a0 from the published GitHub release.
    
      5# Edit this file, never the generated one.
    
      6#
    
      7# This repackages the official .deb rather than building from source, so the
    
      8# launcher, the .desktop file and the hicolor icon are the same files every
    
      9# other Linux user gets, with nothing to keep in sync by hand. The .deb carries
    
      10# no interpreter and nothing compiled — DigiMem is pure Python living in
    
      11# /usr/lib/digimem, with a wrapper that puts it back on the path — which is why
    
      12# this is arch=('any'), and why a Python upgrade cannot strand it the way an
    
      13# installation into site-packages would.
    
      14pkgname=digimem-bin
    
      15pkgver=0.2.0
    
      16pkgrel=1
    
      17pkgdesc="Two-way face sync between digiKam and Nextcloud Memories"
    
      18arch=('any')
    
      19url="https://github.com/keithvassallomt/digikam-memories-sync"
    
      20license=('GPL-3.0-or-later')
    
      21# The window is served to the user's own browser, so there is no toolkit here:
    
      22# yaml is read at startup, psutil is how the background service finds and stops
    
      23# itself, and keyring is where the Nextcloud app password goes.
    
      24depends=('python' 'python-yaml' 'python-psutil' 'python-keyring' 'hicolor-icon-theme')
    
      25# A digiKam library on SQLite needs none of these, and that is most of them.
    
      26optdepends=(
    
      27    'python-pymysql: digiKam libraries kept in MySQL or MariaDB'
    
      28    'python-psycopg2: digiKam libraries kept in PostgreSQL'
    
      29    'openssh: reaching a remote digiKam or Nextcloud database over an SSH tunnel'
    
      30    'gnome-keyring: somewhere to keep the Nextcloud app password other than a file'
    
      31)
    
      32provides=("digimem=${pkgver}")
    
      33conflicts=('digimem')
    
      34options=('!strip' '!debug')
    
      35source=("digimem_${pkgver}_all.deb::${url}/releases/download/v${pkgver}/digimem_${pkgver}_all.deb")
    
      36sha256sums=('bab544be8dbfdd82e11bba39b08caa8741f2efbf9fbda51cb2017d0254c662a0')
    
      37
    
      38package() {
    
      39    # Match data.tar.* by glob so a future nfpm switching gzip for xz or zst
    
      40    # keeps working; the inner bsdtar detects the compression itself.
    
      41    bsdtar -O -xf "digimem_${pkgver}_all.deb" 'data.tar.*' | bsdtar -C "${pkgdir}" -xf -
    
      42}
    
      43

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-19 21:31:46	Low	2