heft-bin

LOW

maintainer gissf1 0 votes scanned 2026-09-12 03:10:21.490280

View on AUR

Why flagged

The package downloads prebuilt static binaries and auxiliary data (completions, man page) from the project's official GitHub releases; while the host is not whitelisted, the binaries are from a legitimate project source and the worst case of a swapped release would be code execution, but no obfuscation or suspicious behavior is present beyond the low-vote, recent-upload heuristic flag.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package downloads prebuilt static binaries and auxiliary data (completions, man page) from the project's official GitHub releases; while the host is not whitelisted, the binaries are from a legitimate project source and the worst case of a swapped release would be code execution, but no obfuscation or suspicious behavior is present beyond the low-vote, recent-upload heuristic flag.

PKGBUILD

      1# Maintainer: Damon Blais <damon.blais@gmail.com>
    
      2
    
      3pkgname=heft-bin
    
      4pkgver=0.6.0
    
      5pkgrel=1
    
      6pkgdesc="Read-only Linux TUI for application-weight process accounting"
    
      7arch=('x86_64' 'aarch64')
    
      8url="https://github.com/Rethunk-Tech/heft"
    
      9license=('Apache-2.0')
    
      10# [profile.release] already strips, so there is nothing for makepkg to strip or
    
      11# to put in a debug package.
    
      12options=('!strip' '!debug')
    
      13provides=("heft=$pkgver")
    
      14conflicts=('heft')
    
      15# The musl builds are static, so this package has no depends at all: heft
    
      16# needs sysconf and geteuid from libc and reads /etc/passwd itself, so there
    
      17# is no NSS lookup to link against.
    
      18_url_rel="$url/releases/download/v$pkgver"
    
      19source=("heft-completions-man-$pkgver.tar.gz::$_url_rel/heft-completions-man.tar.gz")
    
      20source_x86_64=("heft-$pkgver-x86_64::$_url_rel/heft-x86_64-unknown-linux-musl")
    
      21source_aarch64=("heft-$pkgver-aarch64::$_url_rel/heft-aarch64-unknown-linux-musl")
    
      22sha256sums=('c8569c54579de3564234c716787d0f15e4dfcac6221769e5064bb5b876fbb86f')
    
      23sha256sums_x86_64=('9b4c443511ac5633e081de133530262f310e0d0565f24adfc7a4891d17a56cf0')
    
      24sha256sums_aarch64=('354bc62fb4a006ac5d19f48654bc6a363af3462de997fe1f8c79108eb8e478df')
    
      25
    
      26package() {
    
      27  # Apache-2.0 is an SPDX common licence shipped in /usr/share/licenses/spdx
    
      28  # by the `licenses` package, so this installs no copy of it.
    
      29  install -Dm0755 "$srcdir/heft-$pkgver-$CARCH" "$pkgdir/usr/bin/heft"
    
      30  install -Dm0644 "$srcdir/heft.bash" "$pkgdir/usr/share/bash-completion/completions/heft"
    
      31  install -Dm0644 "$srcdir/_heft" "$pkgdir/usr/share/zsh/site-functions/_heft"
    
      32  install -Dm0644 "$srcdir/heft.fish" "$pkgdir/usr/share/fish/vendor_completions.d/heft.fish"
    
      33  install -Dm0644 "$srcdir/heft.1" "$pkgdir/usr/share/man/man1/heft.1"
    
      34}
    
      35

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-12 03:10:21	Low	2
2026-09-12 01:24:32	Low	2