inm

maintainer likai · 0 votes · scanned 2026-08-18 15:40:04.149666

LOW

Why flagged Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

PKGBUILD

      1# Maintainer: lee <lee@yizhisec.com>
    
      2#
    
      3# Rendered by .github/workflows/release.yml — 0.2.0 / 3942ecfba6f53660f1603f67003ffcf2f99fddcff7567e03aa6de8b48749bd5d are
    
      4# substituted with the tag and the checksum of the published release's
    
      5# auto-generated source tarball.
    
      6#
    
      7# Built from source rather than shipped as a prebuilt -bin package: inm links
    
      8# directly against spice-gtk and gpui's native Vulkan/Wayland/X11 bindings,
    
      9# which makes cross-compiling a portable binary far riskier than just
    
      10# building on the machine that's about to run it — and the build itself only
    
      11# takes a minute or two.
    
      12
    
      13pkgname=inm
    
      14pkgver=0.2.0
    
      15pkgrel=2
    
      16pkgdesc="Native manager for Incus virtual machines with the SPICE console embedded in the app"
    
      17arch=('x86_64')
    
      18url="https://github.com/loyalpartner/inm"
    
      19license=('MIT')
    
      20depends=('spice-gtk' 'vulkan-icd-loader' 'libxkbcommon-x11')
    
      21makedepends=('cargo' 'pkgconf')
    
      22source=("${pkgname}-${pkgver}.tar.gz::${url}/archive/refs/tags/v${pkgver}.tar.gz")
    
      23sha256sums=('3942ecfba6f53660f1603f67003ffcf2f99fddcff7567e03aa6de8b48749bd5d')
    
      24
    
      25build() {
    
      26    cd "${pkgname}-${pkgver}"
    
      27    # The `ring` crate compiles part of itself as C/assembly via the `cc`
    
      28    # crate, which picks up $CFLAGS automatically. Arch's default
    
      29    # -flto=auto there makes that C code come out as GCC LTO bitcode
    
      30    # instead of real object code, which rust-lld can't read — every
    
      31    # ring_core_* symbol then looks "undefined" at the final link, even
    
      32    # though the archive is right there. Rust has its own LTO knobs (Cargo
    
      33    # profile settings); this flag was never meant for it. Verified this is
    
      34    # the actual cause, not a guess: stripping it from CFLAGS/CXXFLAGS/
    
      35    # LDFLAGS turns a build that fails 100% of the time in a clean chroot
    
      36    # into one that succeeds 100% of the time, same source, same lockfile.
    
      37    export CFLAGS="${CFLAGS//-flto=auto/}"
    
      38    export CXXFLAGS="${CXXFLAGS//-flto=auto/}"
    
      39    export LDFLAGS="${LDFLAGS//-flto=auto/}"
    
      40    cargo build --release --locked
    
      41}
    
      42
    
      43package() {
    
      44    cd "${pkgname}-${pkgver}"
    
      45    install -Dm755 "target/release/${pkgname}" "${pkgdir}/usr/bin/${pkgname}"
    
      46    install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      47    install -Dm644 README.md "${pkgdir}/usr/share/doc/${pkgname}/README.md"
    
      48}
    
      49

Changes since previous scan

--- PKGBUILD @ 2026-08-18 00:03
+++ PKGBUILD @ 2026-08-18 15:40
@@ -1,6 +1,6 @@
 # Maintainer: lee <lee@yizhisec.com>
 #
-# Rendered by .github/workflows/release.yml — 0.1.0 / 67d17ce4cb4d033983639c708a30feb798dea6b5dc62c8a1980005c19f664ea1 are
+# Rendered by .github/workflows/release.yml — 0.2.0 / 3942ecfba6f53660f1603f67003ffcf2f99fddcff7567e03aa6de8b48749bd5d are
 # substituted with the tag and the checksum of the published release's
 # auto-generated source tarball.
 #
@@ -11,8 +11,8 @@
 # takes a minute or two.
 
 pkgname=inm
-pkgver=0.1.0
-pkgrel=1
+pkgver=0.2.0
+pkgrel=2
 pkgdesc="Native manager for Incus virtual machines with the SPICE console embedded in the app"
 arch=('x86_64')
 url="https://github.com/loyalpartner/inm"
@@ -20,10 +20,23 @@
 depends=('spice-gtk' 'vulkan-icd-loader' 'libxkbcommon-x11')
 makedepends=('cargo' 'pkgconf')
 source=("${pkgname}-${pkgver}.tar.gz::${url}/archive/refs/tags/v${pkgver}.tar.gz")
-sha256sums=('67d17ce4cb4d033983639c708a30feb798dea6b5dc62c8a1980005c19f664ea1')
+sha256sums=('3942ecfba6f53660f1603f67003ffcf2f99fddcff7567e03aa6de8b48749bd5d')
 
 build() {
     cd "${pkgname}-${pkgver}"
+    # The `ring` crate compiles part of itself as C/assembly via the `cc`
+    # crate, which picks up $CFLAGS automatically. Arch's default
+    # -flto=auto there makes that C code come out as GCC LTO bitcode
+    # instead of real object code, which rust-lld can't read — every
+    # ring_core_* symbol then looks "undefined" at the final link, even
+    # though the archive is right there. Rust has its own LTO knobs (Cargo
+    # profile settings); this flag was never meant for it. Verified this is
+    # the actual cause, not a guess: stripping it from CFLAGS/CXXFLAGS/
+    # LDFLAGS turns a build that fails 100% of the time in a clean chroot
+    # into one that succeeds 100% of the time, same source, same lockfile.
+    export CFLAGS="${CFLAGS//-flto=auto/}"
+    export CXXFLAGS="${CXXFLAGS//-flto=auto/}"
+    export LDFLAGS="${LDFLAGS//-flto=auto/}"
     cargo build --release --locked
 }
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 15:40:04	LOW	1
2026-08-18 00:03:42	CLEAN	2
2026-08-17 11:35:53	LOW	1
2026-08-17 09:35:23	LOW	1