golang-jwt (CLEAN)

Triggered rules

Clean AI review downgraded a static finding llm_review

The static rules flagged this LOW, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it CLEAN (confidence 95%): The package builds from the project's own source on GitHub, which is normal for AUR packages; the low vote count and recent upload are not indicators of maliciousness.

1 higher static finding superseded - not the current verdict (shown for transparency)

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

PKGBUILD

      1# Maintainer: noraj <printf %s 'YWxleGFuZHJlLnphbm5pQGV1cm9wZS5jb20='|base64 -d>
    
      2
    
      3pkgname=golang-jwt
    
      4_projectname=jwt
    
      5pkgver=5.3.1
    
      6pkgrel=1
    
      7pkgdesc='Go JWT simple CLI to sign, verify and show tokens.'
    
      8arch=('x86_64' 'aarch64')
    
      9url='https://golang-jwt.github.io/jwt/'
    
      10license=('MIT')
    
      11depends=()
    
      12makedepends=('go')
    
      13source=("https://github.com/$pkgname/$_projectname/archive/refs/tags/v$pkgver.tar.gz")
    
      14sha512sums=('e730a0aae7af5243016ac71290687b41b185a01956c2690ca4c8a7ec9fd9a3d8f57d4a0ce4a8b8e633ee313662b0d9a622a72d86ae8c1c541946a7fe85f3284b')
    
      15conflicts=('golang-jwt-git')
    
      16provides=('golang-jwt')
    
      17
    
      18build() {
    
      19  cd "$_projectname-$pkgver"
    
      20
    
      21  GOPATH="$srcdir" go mod download
    
      22  GOPATH="$srcdir" go build \
    
      23    -trimpath \
    
      24    -buildmode=pie \
    
      25    -mod=readonly \
    
      26    -modcacherw \
    
      27    -ldflags "-s -w" \
    
      28    -o $_projectname ./cmd/$_projectname
    
      29}
    
      30
    
      31package() {
    
      32  cd "$_projectname-$pkgver"
    
      33
    
      34  install -Dm 755 $_projectname "$pkgdir/usr/bin/$pkgname"
    
      35  install -Dm 644 -t "$pkgdir/usr/share/doc/$pkgname/" README.md
    
      36  install -Dm 644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      37}
    
      38
    
      39

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-26 00:12:15	Clean	2
2026-09-25 23:13:47	Low	1