lazysubmodules-git
LOW
maintainer fpgartktic
0 votes
scanned 2026-09-17 21:26:26.072849
Why flagged
The package builds from a public Git repository with no unverifiable prebuilt binaries, and the only risk is a low-impact, recently uploaded AUR package with few votes, but the build process is transparent and follows standard practices.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Low
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from a public Git repository with no unverifiable prebuilt binaries, and the only risk is a low-impact, recently uploaded AUR package with few votes, but the build process is transparent and follows standard practices.
PKGBUILD
1
# SPDX-License-Identifier: GPL-3.0-only
2
# Copyright (C) 2026 Mateusz Okulanis <FPGArtktic@outlook.com>
3
# Maintainer: Mateusz Okulanis <FPGArtktic at outlook dot com>
4
#
5
# PKGBUILD - Arch User Repository recipe for lazysubmodules-git
6
#
7
# Builds lazysubmodules from the default branch of the upstream repository
8
# with the flags of the Arch Linux Go package guidelines, runs the test
9
# suite, and installs the binary, the short name lsm, the license with the
10
# notices of the third-party code linked into the binary, and the README.
11
# The binary contains no paths of the build directory, so there is no debug
12
# package.
13
# Dependencies come from the vendor/ directory of the repository, so the
14
# build downloads no Go modules.
15
#
16
# Usage: makepkg -si
17
# makepkg --printsrcinfo > .SRCINFO (after every change)
18
#
19
# makepkg reads the variables, sets pkgdir, srcdir and the build flags, and
20
# runs the functions with errexit, so a failed cd stops the build.
21
# shellcheck shell=bash disable=SC2034,SC2154,SC2164
22
23
pkgname=lazysubmodules-git
24
_pkgname=lazysubmodules
25
pkgver=0.1.0rc1.r0.gdd57e1b
26
pkgrel=1
27
pkgdesc='Track git submodules by branch, tag, tag pattern or commit'
28
arch=('x86_64' 'aarch64')
29
url='https://github.com/FPGArtktic/lazysubmodules'
30
# The project, then the licenses of the Go modules linked into the binary
31
# (see THIRD_PARTY_NOTICES).
32
license=('GPL-3.0-only AND BSD-3-Clause AND MIT')
33
depends=('git' 'glibc')
34
# The VCS package guidelines list git here as well, for the source and
35
# pkgver(); namcap then reports it as redundant.
36
makedepends=('git' 'go' 'go-licenses')
37
# ssh-keygen, for the tests of SSH-signed tags.
38
checkdepends=('openssh')
39
provides=("${_pkgname}=${pkgver}")
40
conflicts=("${_pkgname}")
41
# -trimpath leaves debugedit no source paths to collect, so a debug package
42
# would hold no sources.
43
options=('!debug')
44
source=("${_pkgname}::git+${url}.git")
45
sha256sums=('SKIP')
46
47
# Release tags are annotated and named vX.Y.Z or vX.Y.Z-rc.N. A pre-release
48
# loses its separators (0.1.0-rc.1 becomes 0.1.0rc1), so that vercmp sorts
49
# it below the release: 0.1.0rc1.r5.g1234abc < 0.1.0.r0.g5678def. Before the
50
# first release tag the version is r<commit count>.<commit>.
51
pkgver()
52
{
53
local desc count tag base pre
54
55
cd "${_pkgname}"
56
if ! desc="$(git describe --long --abbrev=7 --match 'v[0-9]*' 2>/dev/null)"; then
57
count="$(git rev-list --count HEAD)"
58
desc="$(git rev-parse --short=7 HEAD)"
59
printf 'r%s.%s\n' "${count}" "${desc}"
60
return
61
fi
62
desc="${desc#v}"
63
count="${desc%-g*}"
64
tag="${count%-*}"
65
count="${count##*-}"
66
base="${tag%%-*}"
67
pre="${tag#"${base}"}"
68
printf '%s%s.r%s.g%s\n' "${base}" "${pre//[^[:alnum:]]/}" "${count}" "${desc##*-g}"
69
}
70
71
build()
72
{
73
local commit commit_time commit_date
74
75
cd "${_pkgname}"
76
export CGO_CPPFLAGS="${CPPFLAGS}"
77
export CGO_CFLAGS="${CFLAGS}"
78
export CGO_CXXFLAGS="${CXXFLAGS}"
79
export CGO_LDFLAGS="${LDFLAGS}"
80
export GOPATH="${srcdir}"
81
# -trimpath keeps the paths of the build directory out of the binary.
82
export GOFLAGS='-buildmode=pie -trimpath -mod=vendor -modcacherw'
83
# Build with the installed Go only, and never download modules.
84
export GOTOOLCHAIN=local GOPROXY=off
85
commit="$(git rev-parse HEAD)"
86
# The date of the commit, not of the build, as in the release binaries:
87
# a rebuild of the same commit gives the same binary.
88
commit_time="$(git show -s --format=%ct HEAD)"
89
commit_date="$(date -u -d "@${commit_time}" '+%Y-%m-%dT%H:%M:%SZ')"
90
go build -o build/ -ldflags "-linkmode=external -extldflags '${LDFLAGS}' \
91
-X main.version=${pkgver} -X main.commit=${commit} -X main.date=${commit_date}" \
92
./cmd/lazysubmodules
93
# THIRD_PARTY_NOTICES and licenses/ for the modules in the binary.
94
scripts/third-party-licenses.sh -o build/third-party
95
}
96
97
check()
98
{
99
cd "${_pkgname}"
100
export GOPATH="${srcdir}"
101
export GOFLAGS='-mod=vendor -modcacherw'
102
export GOTOOLCHAIN=local GOPROXY=off
103
go test ./...
104
}
105
106
package()
107
{
108
local licenses="${pkgdir}/usr/share/licenses/${pkgname}"
109
110
cd "${_pkgname}"
111
install -Dm755 build/lazysubmodules "${pkgdir}/usr/bin/lazysubmodules"
112
ln -s lazysubmodules "${pkgdir}/usr/bin/lsm"
113
install -Dm644 -t "${licenses}" LICENSE build/third-party/THIRD_PARTY_NOTICES
114
cp -r --no-preserve=mode,ownership build/third-party/licenses "${licenses}/"
115
install -Dm644 -t "${pkgdir}/usr/share/doc/${pkgname}" README.md
116
}
117
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 21:26:26 | Low | 2 |