kendex-cli-git
LOW
maintainer vanillagreen
0 votes
scanned 2026-09-24 07:42:22.111601
Why flagged
The package builds from a public git repository with a SKIP'd checksum, but it is the project's own source code and not an executable payload; the low severity is due to lack of source integrity verification, not malicious behavior.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Low
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from a public git repository with a SKIP'd checksum, but it is the project's own source code and not an executable payload; the low severity is due to lack of source integrity verification, not malicious behavior.
PKGBUILD
1
# Maintainer: VanillaGreen <ai1@vanillagreen.com>
2
pkgname=kendex-cli-git
3
# kendex 1.0.0 follows 5.0.1, so the version number goes backwards. pacman
4
# compares versions, and without an epoch it reads 1.0.0 as older than the
5
# 5.x a machine already holds and refuses the upgrade. Every kendex package
6
# carries the same epoch so the four stay comparable with each other.
7
epoch=1
8
pkgver=r0.0000000
9
pkgrel=1
10
pkgdesc='Package manager for AI coding agents, skills, and hooks (CLI only, latest commit)'
11
arch=('x86_64' 'aarch64')
12
url='https://kendex.ai'
13
license=('MIT')
14
# The other three install the same `kendex` command and cannot be
15
# co-installed with this one. This package does not provide `kendex`: that
16
# name is the package that installs the desktop app and the command
17
# together, and a dependency on it would be mis-satisfied by the command
18
# alone. No `replaces`: a `replaces` on kendex-git would take the desktop
19
# app away from everyone who installed that package, during an ordinary
20
# system upgrade and without asking.
21
conflicts=('kendex' 'kendex-git' 'kendex-bin')
22
# git is a runtime as well as a build need, and they are different needs:
23
# the build clones with it, and the installed program materializes a catalog
24
# with it. 2.41 is the first that takes `--attr-source`, below which every
25
# install of a package from a git repository is refused.
26
#
27
# dbus is both needs too: the command links libdbus-1 directly through the
28
# keyring crate sync-secret-service backend, and the libdbus-sys build
29
# probes dbus-1.pc with pkg-config and panics when it is absent. Arch ships
30
# the shared library, the headers and dbus-1.pc in one package.
31
#
32
# Nothing beyond those two: this package builds and installs the command
33
# alone, so none of the webkit2gtk, gtk3, icon-theme or freedesktop-tool
34
# dependencies the three desktop packages carry belong here.
35
depends=('git>=2.41' 'dbus')
36
makedepends=('cargo' 'git')
37
# makepkg LTO makes ring's C objects fail to link with rust-lld.
38
options=('!lto')
39
source=('git+https://github.com/vanillagreencom/kendex.git')
40
sha256sums=('SKIP')
41
42
pkgver() {
43
cd "$srcdir/kendex"
44
printf 'r%s.%s' "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
45
}
46
47
prepare() {
48
cd "$srcdir/kendex"
49
cargo fetch --locked --target "$(rustc -vV | sed -n 's/host: //p')"
50
}
51
52
build() {
53
cd "$srcdir/kendex"
54
export RUSTUP_TOOLCHAIN=stable
55
# The CLI package alone. Building the workspace would pull the app in and
56
# with it every desktop library this package deliberately does not depend
57
# on.
58
cargo build --release --locked -p kendex-cli
59
}
60
61
package() {
62
cd "$srcdir/kendex"
63
install -Dm755 target/release/kendex "$pkgdir/usr/bin/kendex"
64
install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
65
}
66
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-24 07:42:22 | Low | 2 |