duet-httpfs-git
maintainer Remenod
· 0 votes
· scanned 2026-08-18 00:03:42.021799
LOW
View on AUR ↗
Why flagged
The package builds from a public git repository with no untrusted remote code execution; the only concerns are low-risk due to few votes, recent upload, and skipped checksum, but it compiles source from a known project repository with appropriate dependencies and no obfuscated or executable downloads.
Triggered rules
LOW
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
LOW
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from a public git repository with no untrusted remote code execution; the only concerns are low-risk due to few votes, recent upload, and skipped checksum, but it compiles source from a known project repository with appropriate dependencies and no obfuscated or executable downloads.
PKGBUILD
1
# Maintainer: Remenod <pixel_borne_0o@icloud.com>
2
3
pkgname=duet-httpfs-git
4
pkgver=1.0.0.r1.ga234024
5
pkgrel=1
6
pkgdesc='FUSE filesystem for the SD card of a Duet RepRapFirmware controller (git)'
7
arch=('x86_64' 'aarch64' 'armv7h')
8
url='https://github.com/Remenod/duet3d-driver-fuse'
9
license=('MIT')
10
# What the binary links directly: libfuse3.so (fuse3), libcurl.so (curl),
11
# libc/libm/libresolv (glibc), libgcc_s.so (libgcc), libstdc++.so (libstdc++).
12
# Arch splits the GCC runtime, so libgcc and libstdc++ are named rather than the
13
# gcc-libs meta package. Everything else in `ldd` — openssl, krb5, nghttp2,
14
# zstd … — arrives through libcurl and is that package's business, not ours.
15
depends=('fuse3' 'curl' 'glibc' 'libgcc' 'libstdc++')
16
# nlohmann-json is header-only, so it is only needed to compile.
17
makedepends=('git' 'nlohmann-json')
18
provides=("duet-httpfs=${pkgver}")
19
conflicts=('duet-httpfs')
20
source=("$pkgname::git+https://github.com/Remenod/duet3d-driver-fuse.git")
21
sha256sums=('SKIP')
22
23
pkgver() {
24
cd "$srcdir/$pkgname"
25
26
# Upstream is tagged, so the version is always <tag>.r<commits>.g<hash>.
27
# Deliberately no r<commits>.<hash> fallback: vercmp ranks that BELOW a
28
# tagged version, so a clone that arrived without tags would quietly build
29
# something pacman treats as a downgrade. Failing here is the loud, correct
30
# outcome — fetch the tags and build again.
31
local _desc
32
if ! _desc=$(git describe --long --tags --abbrev=7 2>/dev/null); then
33
error 'no tags in the clone; cannot derive a version'
34
return 1
35
fi
36
printf '%s\n' "${_desc#v}" | sed 's/\([^-]*-g\)/r\1/;s/-/./g'
37
}
38
39
build() {
40
cd "$srcdir/$pkgname"
41
# CXXFLAGS is ?= and CPPFLAGS/LDFLAGS/LDLIBS are += in the Makefile, so
42
# makepkg's hardening and LTO flags are picked up from the environment.
43
make VERSION="$pkgver"
44
}
45
46
check() {
47
cd "$srcdir/$pkgname"
48
make VERSION="$pkgver" check
49
}
50
51
package() {
52
cd "$srcdir/$pkgname"
53
# Installs the binary, the mount.fuse.duet-httpfs / mount.duet-httpfs
54
# symlinks, doc/duet-httpfs.1, README.md and LICENSE.
55
# LICENSEDIR must match $pkgname or namcap flags the missing licence dir.
56
make VERSION="$pkgver" DESTDIR="$pkgdir" PREFIX=/usr \
57
LICENSEDIR="/usr/share/licenses/$pkgname" install
58
}
59
Changes since previous scan
--- PKGBUILD @ 2026-08-12 00:27+++ PKGBUILD @ 2026-08-18 00:03@@ -1,7 +1,7 @@ # Maintainer: Remenod <pixel_borne_0o@icloud.com> pkgname=duet-httpfs-git-pkgver=1.0.0.r0.g2fc92b5+pkgver=1.0.0.r1.ga234024 pkgrel=1 pkgdesc='FUSE filesystem for the SD card of a Duet RepRapFirmware controller (git)' arch=('x86_64' 'aarch64' 'armv7h')Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-18 00:03:42 | LOW | 2 |
| 2026-08-17 09:35:23 | LOW | 2 |
| 2026-08-17 07:35:18 | LOW | 2 |
| 2026-08-12 00:27:08 | CLEAN | 2 |
| 2026-08-11 15:21:23 | LOW | 1 |