gvc-git

maintainer Nebulosa · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from the project's own Git repository, which is a normal AUR practice; the unverifiable checksum and recent maintainer change do not indicate active malice or code execution risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from the project's own Git repository, which is a normal AUR practice; the unverifiable checksum and recent maintainer change do not indicate active malice or code execution risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

      1# Maintainer: Nebulosa  <nebulosa2007-at-yandex-dot-ru>
    
      2
    
      3pkgname=gvc-git
    
      4pkgver=r3.a00aa37
    
      5pkgrel=6
    
      6pkgdesc="Provides libgnome-volume-control outside Gnome environment"
    
      7arch=(x86_64)
    
      8url="https://github.com/JingMatrix/${pkgname%-git}"
    
      9license=(GPL-3.0-only)
    
      10depends=(
    
      11  glib2
    
      12  glibc
    
      13  libpulse
    
      14)
    
      15makedepends=(
    
      16  git
    
      17  glib2-devel
    
      18  gobject-introspection
    
      19  meson
    
      20)
    
      21provides=(${pkgname%-git})
    
      22conflicts=(${pkgname%-git})
    
      23options=(!debug)
    
      24source=(${pkgname%-git}::git+$url.git)
    
      25b2sums=('SKIP')
    
      26
    
      27pkgver() {
    
      28  cd ${pkgname%-git}
    
      29  printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
    
      30}
    
      31
    
      32build() {
    
      33  arch-meson ${pkgname%-git} build
    
      34  meson configure  build --no-pager
    
      35  meson compile -C build
    
      36}
    
      37
    
      38package() {
    
      39  meson install -C build --destdir "$pkgdir"
    
      40}
    
      41

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-08-03 00:08
@@ -2,23 +2,24 @@
 
 pkgname=gvc-git
 pkgver=r3.a00aa37
-pkgrel=5
-pkgdesc="Provides libgnome-volume-control outside Gnome environment."
+pkgrel=6
+pkgdesc="Provides libgnome-volume-control outside Gnome environment"
 arch=(x86_64)
 url="https://github.com/JingMatrix/${pkgname%-git}"
 license=(GPL-3.0-only)
 depends=(
   glib2
-  gobject-introspection
+  glibc
   libpulse
 )
 makedepends=(
   git
   glib2-devel
+  gobject-introspection
   meson
 )
 provides=(${pkgname%-git})
-conflicts=(${pkgname%-git} gsconnect)
+conflicts=(${pkgname%-git})
 options=(!debug)
 source=(${pkgname%-git}::git+$url.git)
 b2sums=('SKIP')

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 15:18:17	MEDIUM	1
2026-06-18 16:11:54	CLEAN	0