kprompt-dash-git

maintainer zadkiel · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from the official project Git repository, uses standard Go build practices, and installs only the resulting binary and documentation; the low severity is due to unverifiable source (SKIP'd checksum) but no evidence of malicious behavior.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from the official project Git repository, uses standard Go build practices, and installs only the resulting binary and documentation; the low severity is due to unverifiable source (SKIP'd checksum) but no evidence of malicious behavior.

PKGBUILD

      1# Maintainer: Zadkiel AHARONIAN <hello@zadkiel.fr>
    
      2# Repository: https://github.com/aslafy-z/aur-packages
    
      3
    
      4# No `# renovate:` annotation: pkgver() derives the version from the checkout at
    
      5# build time, so there is no pinned version for Renovate to bump.
    
      6pkgname=kprompt-dash-git
    
      7_pkgname=kprompt-dash
    
      8pkgver=0.1.0.r0.g96f5e58
    
      9pkgrel=1
    
      10pkgdesc='Localhost read-only Kubernetes inventory UI for kprompt'
    
      11arch=('x86_64' 'aarch64')
    
      12url='https://github.com/kprompt/kprompt-dash'
    
      13license=('Apache-2.0')
    
      14depends=('glibc')
    
      15makedepends=('git' 'go')
    
      16provides=("kprompt-dash=${pkgver%%.r*}")
    
      17conflicts=('kprompt-dash')
    
      18optdepends=('xdg-utils: open the UI in a browser with --open')
    
      19# -trimpath rewrites every source path out of the binary, leaving the debug
    
      20# package with an empty usr/src/debug and a build-id symlink to nothing.
    
      21options=('!debug')
    
      22source=("${_pkgname}::git+https://github.com/kprompt/kprompt-dash.git")
    
      23sha256sums=('SKIP')
    
      24
    
      25pkgver() {
    
      26    cd "${srcdir}/${_pkgname}"
    
      27
    
      28    git describe --long --tags --abbrev=7 |
    
      29        sed 's/^v//;s/\([^-]*-g\)/r\1/;s/-/./g'
    
      30}
    
      31
    
      32build() {
    
      33    cd "${srcdir}/${_pkgname}"
    
      34
    
      35    # Upstream builds with CGO disabled. Arch's Go packaging guidelines are
    
      36    # followed instead, so the binary gets the distribution hardening flags.
    
      37    export CGO_CPPFLAGS="${CPPFLAGS}"
    
      38    export CGO_CFLAGS="${CFLAGS}"
    
      39    export CGO_CXXFLAGS="${CXXFLAGS}"
    
      40    export CGO_LDFLAGS="${LDFLAGS}"
    
      41    export GOFLAGS='-buildmode=pie -trimpath -mod=readonly -modcacherw'
    
      42
    
      43    go build \
    
      44        -ldflags '-linkmode=external' \
    
      45        -o build/kprompt-dash \
    
      46        ./cmd/kprompt-dash
    
      47}
    
      48
    
      49check() {
    
      50    cd "${srcdir}/${_pkgname}"
    
      51
    
      52    go test ./...
    
      53}
    
      54
    
      55package() {
    
      56    cd "${srcdir}/${_pkgname}"
    
      57
    
      58    install -D -m755 build/kprompt-dash "${pkgdir}/usr/bin/kprompt-dash"
    
      59
    
      60    install -D -m644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      61    install -D -m644 README.md "${pkgdir}/usr/share/doc/${pkgname}/README.md"
    
      62}
    
      63

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 15:39:03	LOW	2