dotnet-build-deps-10.0

CLEAN

maintainer ChrisTX 0 votes scanned 2026-11-02 00:26:00.633185

View on AUR

Triggered rules

Clean AI review downgraded a static finding llm_review

The static rules flagged this LOW, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it CLEAN (confidence 100%): The package is a meta-package that installs only a license file and depends on other locally-built .NET packages; it does not download or execute remote code, and the flagged low-vote/recent-upload concern does not indicate active malice or supply-chain risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

PKGBUILD

      1# Maintainer: Christian Pfeiffer <cpfeiffer at rev-crew dot info>
    
      2# shellcheck disable=SC2034,SC2154
    
      3# shellcheck shell=bash
    
      4
    
      5# The .NET packages build against the packages of one .NET build, never a mix: they makedepend on
    
      6# dotnet-build-deps-10.0, which this package (the source-built .NET of Arch Linux) or
    
      7# dotnet-build-deps-10.0-bin (Microsoft's build) provides. The source-built artifacts, the reference
    
      8# packages and the native library of System.IO.Ports are built from the same sources (the VMR's) as
    
      9# Microsoft's packages on nuget.org, but by a different build, with different versions and RIDs.
    
      10# The name has the .NET version, as the packages build with that SDK.
    
      11_dotnetver=10.0
    
      12pkgname=dotnet-build-deps-$_dotnetver
    
      13pkgver=1
    
      14pkgrel=1
    
      15pkgdesc="Build dependencies of the .NET packages from the source-built .NET $_dotnetver of Arch Linux (meta package)"
    
      16arch=('x86_64')
    
      17url='https://github.com/dotnet/dotnet'
    
      18license=('0BSD')
    
      19depends=(
    
      20  dotnet-sdk-"$_dotnetver"
    
      21  dotnet-source-built-artifacts-"$_dotnetver"
    
      22  # The packages the source-built artifacts lack, built from the same sources
    
      23  dotnet-source-build-reference-packages
    
      24  dotnet-system-io-ports-native
    
      25)
    
      26# Microsoft's build, which provides dotnet-sdk-$_dotnetver and dotnet-runtime-$_dotnetver as well.
    
      27# The packages for older .NET versions have the version in the name.
    
      28conflicts=(
    
      29  dotnet-runtime-bin
    
      30  dotnet-runtime-"$_dotnetver"-bin
    
      31  dotnet-sdk-bin
    
      32  dotnet-sdk-"$_dotnetver"-bin
    
      33)
    
      34source=("LICENSE")
    
      35sha512sums=('a33658d9271e5c537ccd41bf540b463ad2a5eca4a060c80486ff42a736f0aa042d10436e7177c34d792177cb11285243dee1f31c4df54fb0bfaabbc306406930')
    
      36b2sums=('a29664104e1ee73ca0aee1d633e9095d92a57c92787f8d8740bdb7211ba3205782ed8677f539bdb8cae3dd75a3694be3132e185fa3fc4b3f401e1f88eb776101')
    
      37
    
      38package() {
    
      39  install -Dm644 LICENSE -t "$pkgdir/usr/share/licenses/$pkgname/"
    
      40}
    
      41

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-02 00:26:00	Clean	2
2026-11-02 00:02:06	Low	1
2026-11-01 22:01:45	Low	1