gmod-record-press

LOW

maintainer Aspenini 1 votes scanned 2026-08-30 23:44:22.438554

View on AUR

Why flagged

The package builds from source hosted on GitHub with a SKIP'd checksum, but it is a legitimate desktop app build using standard tools (bun, cargo); the only risk is unverifiable source due to missing hash, not malicious behavior.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from source hosted on GitHub with a SKIP'd checksum, but it is a legitimate desktop app build using standard tools (bun, cargo); the only risk is unverifiable source due to missing hash, not malicious behavior.

PKGBUILD

      1# Maintainer: Aspen Feltner <aspeninifeltner@gmail.com>
    
      2
    
      3pkgname=gmod-record-press
    
      4pkgver=0.1.0
    
      5pkgrel=1
    
      6pkgdesc="Desktop app for creating Working Record Player album addons for Garry's Mod"
    
      7arch=('x86_64')
    
      8url="https://github.com/Aspenini/gmod-record-press"
    
      9license=('MIT')
    
      10
    
      11depends=(
    
      12    'cairo'
    
      13    'desktop-file-utils'
    
      14    'gdk-pixbuf2'
    
      15    'glib2'
    
      16    'gtk3'
    
      17    'hicolor-icon-theme'
    
      18    'libsoup3'
    
      19    'pango'
    
      20    'webkit2gtk-4.1'
    
      21    'xdg-utils'
    
      22)
    
      23
    
      24makedepends=(
    
      25    'bun'
    
      26    'cargo'
    
      27    'openssl'
    
      28    'appmenu-gtk-module'
    
      29    'libappindicator-gtk3'
    
      30    'librsvg'
    
      31)
    
      32
    
      33optdepends=(
    
      34    'steam: Steam Workshop publishing support'
    
      35)
    
      36
    
      37source=(
    
      38    "$pkgname-$pkgver.tar.gz::$url/archive/refs/tags/v$pkgver.tar.gz"
    
      39)
    
      40
    
      41sha256sums=('SKIP')
    
      42
    
      43prepare() {
    
      44    cd "$srcdir/$pkgname-$pkgver"
    
      45
    
      46    export CARGO_HOME="$srcdir/cargo-home"
    
      47
    
      48    bun install --frozen-lockfile
    
      49    cargo fetch \
    
      50        --locked \
    
      51        --manifest-path src-tauri/Cargo.toml
    
      52}
    
      53
    
      54build() {
    
      55    cd "$srcdir/$pkgname-$pkgver"
    
      56
    
      57    export CARGO_HOME="$srcdir/cargo-home"
    
      58
    
      59    # Build only the Debian bundle. Tauri's generated Debian data tree
    
      60    # gives us the executable, .desktop file, icons, etc. in FHS layout.
    
      61    NO_STRIP=1 bun run tauri build -b deb
    
      62}
    
      63
    
      64package() {
    
      65    cd "$srcdir/$pkgname-$pkgver"
    
      66
    
      67    local data_dir
    
      68    data_dir="$(
    
      69        find src-tauri/target/release/bundle/deb \
    
      70            -type d -name data -print -quit
    
      71    )"
    
      72
    
      73    if [[ -z "$data_dir" ]]; then
    
      74        error "Could not find Tauri Debian bundle data directory"
    
      75        return 1
    
      76    fi
    
      77
    
      78    # Install Tauri's generated FHS tree.
    
      79    cp -a "$data_dir/." "$pkgdir/"
    
      80
    
      81    # steamworks-rs dynamically links Valve's Steamworks redistributable.
    
      82    # The project sets an RPATH for this location on Linux.
    
      83    install -Dm755 \
    
      84        src-tauri/target/release/libsteam_api.so \
    
      85        "$pkgdir/usr/lib/$pkgname/libsteam_api.so"
    
      86}
    
      87

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-30 23:44:22	Low	2
2026-08-30 21:44:16	Low	2