gomodel-git
LOW
maintainer weselben
0 votes
scanned 2026-10-27 05:46:44.858863
Why flagged
The package builds from a legitimate git repository and includes two npm dependencies from the official npm registry with fixed versions and valid checksums; the only concern is the skipped checksum for the git source, which is common for -git packages and does not imply malicious intent.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Low
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from a legitimate git repository and includes two npm dependencies from the official npm registry with fixed versions and valid checksums; the only concern is the skipped checksum for the git source, which is common for -git packages and does not imply malicious intent.
PKGBUILD
1
# Maintainer: weselben <bengottwaldi04 at gmail dot com>
2
# Contributor: weselben <bengottwaldi04 at gmail dot com>
3
4
pkgname=gomodel-git
5
pkgver=0.1.108.r10.g6096b766
6
pkgrel=1
7
pkgdesc="High-performance AI gateway (git main build, quasi-nightly)"
8
arch=('x86_64' 'aarch64')
9
url="https://github.com/ENTERPILOT/GoModel"
10
license=('MIT')
11
depends=('glibc')
12
makedepends=('go' 'git' 'nodejs' 'npm')
13
provides=('gomodel')
14
conflicts=('gomodel')
15
optdepends=('bun: faster UI dependency install + build (auto-used when installed, GOMODEL_UI_PM=npm forces npm)'
16
'go: build and load plugin shared objects (gomodel plugin build)'
17
'redis: distributed rate limiting and response cache backend'
18
'postgresql: cost/history storage backend')
19
install=gomodel.install
20
source=("${pkgname}::git+${url}.git#branch=main"
21
"plugin-message-format-4.4.0.tgz::https://registry.npmjs.org/@inlang/plugin-message-format/-/plugin-message-format-4.4.0.tgz"
22
"plugin-m-function-matcher-2.2.6.tgz::https://registry.npmjs.org/@inlang/plugin-m-function-matcher/-/plugin-m-function-matcher-2.2.6.tgz"
23
"gomodel-user.service")
24
sha256sums=('SKIP'
25
'c3027edad173f88ab94a7e4aca2e935aedad5820470230a3e0896977ade281be'
26
'834622fe28c0195b1ae78008bb75688f3be3bb2612b5efce73f01ceb9ac782a8'
27
'fe63ac54caa66676e59bfa5044ebe1372e3cc5546ac68fac9bde4ddb19f82973')
28
options=('!lto')
29
30
pkgver() {
31
cd "${pkgname}"
32
git describe --tags --long 2>/dev/null \
33
| sed 's/^v//;s/\([^-]*-g\)/r\1/;s/-/./g' \
34
|| printf "r%s.g%s" \
35
"$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
36
}
37
38
prepare() {
39
# The inlang/paraglide plugin references moved into node_modules upstream
40
# (declared in package.json). The sed below is now a no-op-safe rewrite
41
# that also covers older CDN-URL forms on tag-based rebuilds.
42
mkdir -p "${srcdir}/inlang-plugins/plugin-message-format"
43
mkdir -p "${srcdir}/inlang-plugins/plugin-m-function-matcher"
44
tar -xzf "${srcdir}/plugin-message-format-4.4.0.tgz" \
45
-C "${srcdir}/inlang-plugins/plugin-message-format" --strip-components=1
46
tar -xzf "${srcdir}/plugin-m-function-matcher-2.2.6.tgz" \
47
-C "${srcdir}/inlang-plugins/plugin-m-function-matcher" --strip-components=1
48
49
cd "${pkgname}"
50
sed -i \
51
"s|\"./node_modules/@inlang/plugin-message-format/dist/index.js\"|\"${srcdir}/inlang-plugins/plugin-message-format/dist/index.js\"|" \
52
web/dashboard/project.inlang/settings.json
53
sed -i \
54
"s|\"./node_modules/@inlang/plugin-m-function-matcher/dist/index.js\"|\"${srcdir}/inlang-plugins/plugin-m-function-matcher/dist/index.js\"|" \
55
web/dashboard/project.inlang/settings.json
56
}
57
58
build() {
59
cd "${pkgname}"
60
61
export CGO_ENABLED=1
62
export GOFLAGS='-mod=readonly'
63
export GOPATH="${srcdir}/gopath"
64
export GOCACHE="${srcdir}/gocache"
65
66
# UI build parallel to Go build; see gomodel/PKGBUILD for the rationale.
67
( cd web/dashboard
68
case "${GOMODEL_UI_PM:-auto}" in
69
npm) npm ci --no-audit --no-fund && npm run build ;;
70
bun) bun install --frozen-lockfile && bun run build ;;
71
auto)
72
if command -v bun >/dev/null 2>&1; then
73
bun install --frozen-lockfile && bun run build
74
else
75
npm ci --no-audit --no-fund && npm run build
76
fi
77
;;
78
*) echo "GOMODEL_UI_PM must be npm, bun or auto" >&2; exit 2 ;;
79
esac
80
) &
81
local ui_pid=$!
82
83
local _commit _date
84
_commit="$(git rev-parse HEAD)"
85
_date="$(git log -1 --format=%cI)"
86
87
go build -trimpath \
88
-buildmode=pie \
89
-ldflags "-s -w \
90
-X github.com/enterpilot/gomodel/internal/version.Version=${pkgver} \
91
-X github.com/enterpilot/gomodel/internal/version.Commit=${_commit} \
92
-X github.com/enterpilot/gomodel/internal/version.Date=${_date}" \
93
-o gomodel ./cmd/gomodel &
94
local go_pid=$!
95
96
local rc=0
97
wait "$ui_pid" || rc=1
98
wait "$go_pid" || rc=1
99
return "$rc"
100
}
101
102
check() {
103
# Skipped: integration tests need Redis, Postgres and live providers.
104
true
105
}
106
107
package() {
108
cd "${pkgname}"
109
110
install -Dm755 gomodel "${pkgdir}/usr/bin/gomodel"
111
install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
112
install -Dm644 README.md "${pkgdir}/usr/share/doc/${pkgname}/README.md"
113
114
# Per-user service only for the -git package: nightly builds belong to
115
# developer/user setups, not servers. The release package ships both units.
116
install -Dm644 "${srcdir}/gomodel-user.service" \
117
"${pkgdir}/usr/lib/systemd/user/gomodel.service"
118
}
119
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-27 05:46:44 | Low | 2 |
| 2026-10-27 03:46:34 | Low | 2 |