jas-git

maintainer alexytomi · 1 votes · scanned 2026-08-18 00:03:42.021799

LOW

Why flagged The flagged 'external install' is cargo-leptos installed into a sandboxed CARGO_HOME/RUSTUP_HOME within srcdir at build time, which is a common pattern for Rust/WASM projects requiring build tools not packaged in the AUR; the package builds from the project's own GitHub source and the bundled local files (wrapper, service, config) have checksums. The main concern is SKIP on the git source (normal for VCS) and that cargo-leptos is fetched from crates.io at build time, but this is standard Rust packaging practice with no evidence of malice.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): The flagged 'external install' is cargo-leptos installed into a sandboxed CARGO_HOME/RUSTUP_HOME within srcdir at build time, which is a common pattern for Rust/WASM projects requiring build tools not packaged in the AUR; the package builds from the project's own GitHub source and the bundled local files (wrapper, service, config) have checksums. The main concern is SKIP on the git source (normal for VCS) and that cargo-leptos is fetched from crates.io at build time, but this is standard Rust packaging practice with no evidence of malice.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM External install via pipx/uv/poetry/cargo/go/gem alt_pkg_manager_install

A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.

PKGBUILD:51 rustup run stable cargo install --locked cargo-leptos

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: alexytomi <alexytomi101@gmail.com>
    
      2pkgname=jas-git
    
      3pkgver=0.1.0.r17.gb8613f1
    
      4pkgrel=1
    
      5pkgdesc="JAS — Jackson's App Sensei: self-hosted iOS IPA signing + install server (Leptos fullstack)"
    
      6arch=('x86_64')
    
      7url="https://github.com/jkcoxson/jas"
    
      8license=('custom:jas-noncommercial')
    
      9depends=('libimobiledevice' 'libplist')
    
      10makedepends=( 'rustup' 'openssl' 'pkgconf' 'git') # Refer to the README if you can't have OpenSSL for some reason
    
      11provides=('jas')
    
      12conflicts=('jas')
    
      13
    
      14backup=('etc/jas/jas.toml')
    
      15install=jas.install
    
      16
    
      17source=(
    
      18  "git+https://github.com/jkcoxson/jas.git"
    
      19  "jas_wrapper.sh"
    
      20  "jas.service"
    
      21  "jas.sysusers"
    
      22  "jas.toml"
    
      23  "jas.install"
    
      24  "LICENSE" 
    
      25)
    
      26sha512sums=(
    
      27  'SKIP'
    
      28  'aa9d0fb8d968b61b5a40bc3cfdff5b4effb3cb54c338e2bb441098de9477ae9aa03884b33686eee3bd75ed578057663765bafc4537a69e4cb35df930cac65d4b'
    
      29  'b2a8e94eba060b16bfb7d7ba0f320bd2dd2b7e6c17df6f62291e3eba94518a1b2b0a780d521796c85e42bf2af9b0b3057fb02c68b3bc83dc3389afe237b840f6'
    
      30  '00462b92cca78f67c4ee72c014547fdfeae87405a08365e6aac0560b3c868ef2deffeb3f87d473841ad26a731092952b96abd5e562f6ff141dfbd794ca133b1d'
    
      31  '4913c387c3dcc3c1f269dabd6781c9775cc827ca138b340d24204f20e77dbbeae0aacb1bc52770fa696faf75d66e45647038d7d4ca94e43b768985a4acc6ed59'
    
      32  '0725634b179b663cded9feac3791bb18f6419744e30f6f010a09e3b62b52da82c7402e95b858165efecc384509e1541d0766163893235a096e4428c9809ab3fe'
    
      33  'd3cd4f1214e92bc6f1940fdd357750791c456557abc88d2750bacb5ad30779ae0c916a66673076f035b00ab28b147571a851f387c6869f545c3f5ed73c6cfccc'
    
      34)
    
      35
    
      36pkgver() {
    
      37    cd "$srcdir/jas" || exit
    
      38    local ver
    
      39    ver=$(awk -F'"' '/^version = / { print $2; exit }' Cargo.toml)
    
      40    printf "%s.r%s.g%s" \
    
      41        "$ver" \
    
      42        "$(git rev-list --count HEAD)" \
    
      43        "$(git rev-parse --short HEAD)"
    
      44}
    
      45
    
      46prepare() {
    
      47  export RUSTUP_HOME="$srcdir/rustup"
    
      48  export CARGO_HOME="$srcdir/cargo"
    
      49  rustup toolchain install stable --profile minimal
    
      50  rustup target add wasm32-unknown-unknown
    
      51  rustup run stable cargo install --locked cargo-leptos
    
      52}
    
      53
    
      54build() {
    
      55  cd "$srcdir/jas" || exit
    
      56  rustup run stable cargo leptos build --release
    
      57}
    
      58
    
      59package() {
    
      60  cd "$srcdir/jas" || exit
    
      61
    
      62  install -Dm755 "$srcdir/jas_wrapper.sh" "$pkgdir/usr/bin/jas"
    
      63  install -Dm755 "$srcdir/jas/target/release/jas" "$pkgdir/usr/lib/jas/jas-bin"
    
      64  install -Dm644 "$srcdir/jas.service" "$pkgdir/usr/lib/systemd/system/jas.service"
    
      65  install -Dm644 "$srcdir/jas.sysusers" "$pkgdir/usr/lib/sysusers.d/jas.conf"
    
      66  install -Dm644 "$srcdir/jas.toml" "$pkgdir/etc/jas/jas.toml"
    
      67
    
      68  install -d "$pkgdir/usr/share/jas"
    
      69  cp -ra target/site "$pkgdir/usr/share/jas/site"
    
      70
    
      71  if [ -f LICENSE ]; then
    
      72    install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      73  fi
    
      74  if [ -f README.md ]; then
    
      75    install -Dm644 README.md "$pkgdir/usr/share/doc/$pkgname/README.md"
    
      76  fi
    
      77}
    
      78

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	LOW	3
2026-08-17 00:18:29	LOW	3
2026-08-16 00:03:42	LOW	3
2026-08-15 17:34:41	LOW	3
2026-08-15 17:30:51	MEDIUM	2