i3status-rs-ai-usage
LOW
maintainer Alfred456654
0 votes
scanned 2026-08-31 21:46:19.858046
Why flagged
The package builds from a signed-off Git tag of the project's own repository, which is a normal AUR practice; the SKIP'd checksum is justified because the PKGBUILD is part of the source, and the installed files are scripts and configs that do not execute untrusted remote code.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Low
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from a signed-off Git tag of the project's own repository, which is a normal AUR practice; the SKIP'd checksum is justified because the PKGBUILD is part of the source, and the installed files are scripts and configs that do not execute untrusted remote code.
PKGBUILD
1
# Maintainer: alfdupont <93726722+alfdupont@users.noreply.github.com>
2
3
pkgname=i3status-rs-ai-usage
4
pkgver=1.0.3
5
pkgrel=1
6
pkgdesc='AI subscription quota (Claude, Codex, Copilot) as an i3status-rust block for swaybar and i3bar'
7
arch=('any')
8
url='https://github.com/alfdupont/i3status-rs-ai-usage'
9
license=('GPL-3.0-or-later')
10
# i3status-rust is a hard dependency: `render` emits i3status-rust's custom
11
# block JSON, which is the entire point of the package. Note that the AUR
12
# i3status-rust-git / -full-git packages do not declare provides=('i3status-rust'),
13
# so users of those will need to add it locally.
14
depends=('python' 'i3status-rust')
15
makedepends=('git')
16
# The font is genuinely optional: the default labels are the ASCII strings
17
# CL/CX/CP, and the only other glyphs on the default path are the ordinary
18
# text characters U+221E, U+2026 and U+00B7. Icons are opt-in via config.
19
optdepends=(
20
'github-cli: fallback for reading the Copilot quota'
21
'otf-font-awesome: vendor logo glyphs instead of text labels'
22
'libnotify: right-click usage breakdown via notify-send'
23
)
24
# Sourced from the signed-off tag rather than a generated tarball: this
25
# PKGBUILD ships inside the repository, so a tarball checksum would have to
26
# live inside the tarball it verifies. The tag is the integrity anchor.
27
source=("git+$url.git#tag=v$pkgver")
28
sha256sums=('SKIP')
29
30
package() {
31
cd "$pkgname"
32
33
install -Dm755 "$pkgname" "$pkgdir/usr/bin/$pkgname"
34
35
# The shipped units point at ~/.local/bin for manual installs; a packaged
36
# install lives in /usr/bin.
37
install -dm755 "$pkgdir/usr/lib/systemd/user"
38
for unit in systemd/"$pkgname".{service,timer}; do
39
sed "s|%h/\.local/bin/$pkgname|/usr/bin/$pkgname|" "$unit" \
40
> "$pkgdir/usr/lib/systemd/user/${unit##*/}"
41
chmod 644 "$pkgdir/usr/lib/systemd/user/${unit##*/}"
42
done
43
44
install -Dm644 README.md -t "$pkgdir/usr/share/doc/$pkgname"
45
install -Dm644 examples/* -t "$pkgdir/usr/share/doc/$pkgname/examples"
46
install -Dm644 LICENSE -t "$pkgdir/usr/share/licenses/$pkgname"
47
}
48
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-31 21:46:19 | Low | 2 |