git-tpl-bin

LOW

maintainer noirbizarre 1 votes scanned 2026-08-19 03:41:13.749572

View on AUR

Why flagged

The package installs a prebuilt binary from the project's official GitHub releases, which is normal for AUR bin packages; the source is verifiable via signed commits and correct checksums, and no untrusted or obfuscated code is executed.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package installs a prebuilt binary from the project's official GitHub releases, which is normal for AUR bin packages; the source is verifiable via signed commits and correct checksums, and no untrusted or obfuscated code is executed.

PKGBUILD

      1# Maintainer: Axel H. <noirbizarre@gmail.com>
    
      2#
    
      3# Prebuilt binary package. `0.7.0`, `143d839c9df77e73468a6d30d27554e9f65194b5e0b7ed91a69ccca6c0ef9771` and `79eb5071fede6dad057e68fd96754ecd8aa5ff2a89f0c2eed4fa060ad34f3dee`
    
      4# are substituted by .github/workflows/aur.yaml from the published release
    
      5# assets, and the result is pushed to the AUR. Edit this template, never the
    
      6# PKGBUILD in the AUR repository: that one is regenerated at every release.
    
      7
    
      8pkgname=git-tpl-bin
    
      9_pkgname=git-tpl
    
      10pkgver=0.7.0
    
      11pkgrel=1
    
      12pkgdesc="Git-native project templates (prebuilt binary)"
    
      13arch=('x86_64' 'aarch64')
    
      14url="https://github.com/noirbizarre/git-tpl"
    
      15license=('MIT')
    
      16
    
      17# What the published binary actually links. libgit2 is vendored into it, so it
    
      18# is absent here — but zlib and libgcc_s are not, and namcap reports an error
    
      19# for every needed library left undeclared.
    
      20depends=('gcc-libs' 'glibc' 'zlib')
    
      21
    
      22provides=("$_pkgname=$pkgver")
    
      23conflicts=("$_pkgname")
    
      24
    
      25# !strip because the release profile already sets `strip = true`, and !debug
    
      26# for the same reason: there is no debug data left to split into a -debug
    
      27# package, so building one would produce an empty package and a namcap warning.
    
      28options=('!strip' '!debug')
    
      29
    
      30# The `gnu` archives, not `musl`: an AUR package targets Arch's own glibc, and
    
      31# the musl build exists for the systems that are not this one. This project
    
      32# tags without a `v` prefix, so the tag is `$pkgver` as-is.
    
      33source_x86_64=("$pkgname-$pkgver-x86_64.tar.gz::$url/releases/download/$pkgver/git-tpl_${pkgver}_linux-amd64.tar.gz")
    
      34source_aarch64=("$pkgname-$pkgver-aarch64.tar.gz::$url/releases/download/$pkgver/git-tpl_${pkgver}_linux-arm64.tar.gz")
    
      35sha256sums_x86_64=('143d839c9df77e73468a6d30d27554e9f65194b5e0b7ed91a69ccca6c0ef9771')
    
      36sha256sums_aarch64=('79eb5071fede6dad057e68fd96754ecd8aa5ff2a89f0c2eed4fa060ad34f3dee')
    
      37
    
      38# Fetched separately because the release archive carries no licence file, and
    
      39# MIT is not one of the licences Arch keeps in /usr/share/licenses/common — so
    
      40# the package has to install the file itself.
    
      41source=("LICENSE-$pkgver::$url/raw/$pkgver/LICENSE")
    
      42sha256sums=('579ef5ffa922ce743ad6dd7ec4538389c7f66a2b945b7d6284e5b3ec04da156e')
    
      43
    
      44package() {
    
      45	# The archive holds `git-tpl` at its root, named exactly that. The name is
    
      46	# load-bearing: Git resolves `git tpl` only through an executable called
    
      47	# exactly `git-tpl` on PATH.
    
      48	install -Dm755 "$srcdir/git-tpl" "$pkgdir/usr/bin/git-tpl"
    
      49	install -Dm644 "$srcdir/LICENSE-$pkgver" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      50
    
      51	# Beside the binary, the archive carries the man pages and the completion
    
      52	# scripts, generated at release time. The man page is what makes
    
      53	# `git tpl --help` work: Git execs `man git-tpl` for it, and without a page
    
      54	# that fails with exit 16.
    
      55	install -Dm644 -t "$pkgdir/usr/share/man/man1" "$srcdir"/man/man1/*.1
    
      56
    
      57	# Each under the name its shell looks for — zsh wants a leading underscore,
    
      58	# bash wants none — because a completion script filed under the wrong name
    
      59	# is one nothing ever sources.
    
      60	install -Dm644 "$srcdir/completions/git-tpl.bash" \
    
      61		"$pkgdir/usr/share/bash-completion/completions/git-tpl"
    
      62	install -Dm644 "$srcdir/completions/git-tpl.zsh" \
    
      63		"$pkgdir/usr/share/zsh/site-functions/_git-tpl"
    
      64	install -Dm644 "$srcdir/completions/git-tpl.fish" \
    
      65		"$pkgdir/usr/share/fish/vendor_completions.d/git-tpl.fish"
    
      66}
    
      67

Changes since previous scan

--- PKGBUILD @ 2026-08-18 00:03
+++ PKGBUILD @ 2026-08-19 03:41
@@ -1,13 +1,13 @@
 # Maintainer: Axel H. <noirbizarre@gmail.com>
 #
-# Prebuilt binary package. `0.6.0`, `e216a614b50830e765f8d6e8d8504acd2b95a3aea028d52f57eaf486ad9e9008` and `a53768acec21c7f69add3e3040274057945b2d5a69b3ce2efcc97fcf63fb5c88`
+# Prebuilt binary package. `0.7.0`, `143d839c9df77e73468a6d30d27554e9f65194b5e0b7ed91a69ccca6c0ef9771` and `79eb5071fede6dad057e68fd96754ecd8aa5ff2a89f0c2eed4fa060ad34f3dee`
 # are substituted by .github/workflows/aur.yaml from the published release
 # assets, and the result is pushed to the AUR. Edit this template, never the
 # PKGBUILD in the AUR repository: that one is regenerated at every release.
 
 pkgname=git-tpl-bin
 _pkgname=git-tpl
-pkgver=0.6.0
+pkgver=0.7.0
 pkgrel=1
 pkgdesc="Git-native project templates (prebuilt binary)"
 arch=('x86_64' 'aarch64')
@@ -32,8 +32,8 @@
 # tags without a `v` prefix, so the tag is `$pkgver` as-is.
 source_x86_64=("$pkgname-$pkgver-x86_64.tar.gz::$url/releases/download/$pkgver/git-tpl_${pkgver}_linux-amd64.tar.gz")
 source_aarch64=("$pkgname-$pkgver-aarch64.tar.gz::$url/releases/download/$pkgver/git-tpl_${pkgver}_linux-arm64.tar.gz")
-sha256sums_x86_64=('e216a614b50830e765f8d6e8d8504acd2b95a3aea028d52f57eaf486ad9e9008')
-sha256sums_aarch64=('a53768acec21c7f69add3e3040274057945b2d5a69b3ce2efcc97fcf63fb5c88')
+sha256sums_x86_64=('143d839c9df77e73468a6d30d27554e9f65194b5e0b7ed91a69ccca6c0ef9771')
+sha256sums_aarch64=('79eb5071fede6dad057e68fd96754ecd8aa5ff2a89f0c2eed4fa060ad34f3dee')
 
 # Fetched separately because the release archive carries no licence file, and
 # MIT is not one of the licences Arch keeps in /usr/share/licenses/common — so

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-19 03:41:13	Low	2
2026-08-18 00:03:42	Clean	2
2026-08-17 21:37:43	Low	1
2026-08-17 00:18:29	Low	2
2026-08-16 09:32:18	Low	2
2026-08-16 01:31:50	Low	1