git-wipe

CLEAN

maintainer noirbizarre 0 votes scanned 2026-08-20 00:05:13.298181

View on AUR

Triggered rules

Clean AI review downgraded a static finding llm_review

The static rules flagged this LOW, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it CLEAN (confidence 95%): The package builds from source hosted on GitHub, uses a verifiable release tarball with a fixed sha256sum, and follows standard Rust packaging practices; the flagged low votes and recent upload are not indicators of malicious intent.

1 higher static finding superseded - not the current verdict (shown for transparency)

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

PKGBUILD

      1# Maintainer: Axel Haustant <noirbizarre@gmail.com>
    
      2#
    
      3# Source package. `0.5.0` and `61f50314a7ec89a0c3898e1fc573e6e50042da22d6650c179d7b743dc182e3c8` are substituted by
    
      4# .github/workflows/aur.yml from the published release assets.
    
      5
    
      6pkgname=git-wipe
    
      7pkgver=0.5.0
    
      8pkgrel=1
    
      9pkgdesc="Wipe out merged local branches and worktrees"
    
      10arch=('x86_64' 'aarch64')
    
      11url="https://github.com/noirbizarre/git-wipe"
    
      12license=('MIT')
    
      13# `git` is a runtime dependency, not just a build one: every operation shells
    
      14# out to it, and the test suite builds real repositories with it.
    
      15depends=('gcc-libs' 'glibc' 'git')
    
      16makedepends=('cargo')
    
      17# `replaces`/`conflicts` on the pre-rename name so `pacman -Syu` migrates
    
      18# anyone still on git-synchronizer instead of leaving both installed.
    
      19provides=('git-synchronizer')
    
      20conflicts=('git-synchronizer')
    
      21replaces=('git-synchronizer')
    
      22# The project tags with a `v` prefix while `pkgver` is the bare version, hence
    
      23# the `v$pkgver` in the URL against `$pkgname-$pkgver.tar.gz` as the file name.
    
      24source=("$pkgname-$pkgver.tar.gz::$url/releases/download/v$pkgver/$pkgname-$pkgver.tar.gz")
    
      25sha256sums=('61f50314a7ec89a0c3898e1fc573e6e50042da22d6650c179d7b743dc182e3c8')
    
      26
    
      27prepare() {
    
      28  cd "$pkgname-$pkgver"
    
      29  # Arch's Rust package guidelines: vendor the dependency graph up front so
    
      30  # build() can run offline with `--frozen`.
    
      31  export RUSTUP_TOOLCHAIN=stable
    
      32  cargo fetch --locked --target "$(rustc -vV | sed -n 's/host: //p')"
    
      33}
    
      34
    
      35build() {
    
      36  cd "$pkgname-$pkgver"
    
      37  export RUSTUP_TOOLCHAIN=stable
    
      38  export CARGO_TARGET_DIR=target
    
      39  # `--frozen` honours the tracked Cargo.lock shipped in the tarball, so the
    
      40  # package is built from the exact dependency graph upstream CI tested.
    
      41  cargo build --frozen --release --all-features
    
      42}
    
      43
    
      44check() {
    
      45  cd "$pkgname-$pkgver"
    
      46  export RUSTUP_TOOLCHAIN=stable
    
      47  cargo test --frozen --release --all-features
    
      48}
    
      49
    
      50package() {
    
      51  cd "$pkgname-$pkgver"
    
      52
    
      53  install -Dm755 target/release/git-wipe "$pkgdir/usr/bin/git-wipe"
    
      54
    
      55  # build.rs writes the man pages and completions into the build script's
    
      56  # OUT_DIR, which cargo places in a hash-suffixed directory.
    
      57  local out
    
      58  out=$(find target/release/build -type d -path '*git-wipe-*/out' -print -quit)
    
      59  [ -n "$out" ] || return 1
    
      60
    
      61  # The man pages are not a nicety: git rewrites `git wipe --help` into
    
      62  # `git help wipe`, which runs `man git-wipe` and fails without them.
    
      63  install -Dm644 -t "$pkgdir/usr/share/man/man1" "$out"/man/*.1
    
      64
    
      65  install -Dm644 "$out/completions/git-wipe.bash" \
    
      66    "$pkgdir/usr/share/bash-completion/completions/git-wipe"
    
      67  install -Dm644 "$out/completions/_git-wipe" \
    
      68    "$pkgdir/usr/share/zsh/site-functions/_git-wipe"
    
      69  install -Dm644 "$out/completions/git-wipe.fish" \
    
      70    "$pkgdir/usr/share/fish/vendor_completions.d/git-wipe.fish"
    
      71
    
      72  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      73  install -Dm644 README.md "$pkgdir/usr/share/doc/$pkgname/README.md"
    
      74}
    
      75

Changes since previous scan

--- PKGBUILD @ 2026-08-17 00:18
+++ PKGBUILD @ 2026-08-20 00:05
@@ -1,10 +1,10 @@
 # Maintainer: Axel Haustant <noirbizarre@gmail.com>
 #
-# Source package. `0.4.0` and `bf02ff7385d022516a0d5a8e599341d4ef5b9b9002c6ccb5d9c172b02dbf016d` are substituted by
+# Source package. `0.5.0` and `61f50314a7ec89a0c3898e1fc573e6e50042da22d6650c179d7b743dc182e3c8` are substituted by
 # .github/workflows/aur.yml from the published release assets.
 
 pkgname=git-wipe
-pkgver=0.4.0
+pkgver=0.5.0
 pkgrel=1
 pkgdesc="Wipe out merged local branches and worktrees"
 arch=('x86_64' 'aarch64')
@@ -22,7 +22,7 @@
 # The project tags with a `v` prefix while `pkgver` is the bare version, hence
 # the `v$pkgver` in the URL against `$pkgname-$pkgver.tar.gz` as the file name.
 source=("$pkgname-$pkgver.tar.gz::$url/releases/download/v$pkgver/$pkgname-$pkgver.tar.gz")
-sha256sums=('bf02ff7385d022516a0d5a8e599341d4ef5b9b9002c6ccb5d9c172b02dbf016d')
+sha256sums=('61f50314a7ec89a0c3898e1fc573e6e50042da22d6650c179d7b743dc182e3c8')
 
 prepare() {
   cd "$pkgname-$pkgver"

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-20 00:05:13	Clean	2
2026-08-19 23:42:47	Low	1
2026-08-17 00:18:29	Clean	2
2026-08-16 09:32:18	Low	1