lupin

LOW

maintainer espadon 0 votes scanned 2026-09-09 00:04:09.106193

View on AUR

Why flagged

The package builds from the project's own git repository with a SKIP'd checksum, but sources are from a legitimate project host (GitHub) and only used to build a native binary; no remote code execution or untrusted payloads.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from the project's own git repository with a SKIP'd checksum, but sources are from a legitimate project host (GitHub) and only used to build a native binary; no remote code execution or untrusted payloads.

PKGBUILD

      1# Maintainer: mfw <espadonne@outlook.com>
    
      2
    
      3pkgname=lupin
    
      4pkgver=0.1.27
    
      5pkgrel=1
    
      6pkgdesc='The reference interpreter for the wolf language, and the compiler differential oracle'
    
      7arch=('x86_64' 'aarch64')
    
      8url='https://github.com/wolffe-lang/wolf-interp'
    
      9license=('GPL-3.0-or-later')
    
      10depends=('gcc-libs' 'glibc')
    
      11makedepends=('rust' 'cargo' 'git')
    
      12optdepends=('wolf-lang: the compiler lupin is differentially tested against')
    
      13provides=('lupin')
    
      14conflicts=('lupin-bin')
    
      15# D57, and the reason this is a git source and not the release tarball:
    
      16# build.rs reads the git commit and the tags pointing at HEAD, and
    
      17# `lupin --version` prints the bare version only when `v$pkgver` is one
    
      18# of them. A GitHub archive tarball has no .git, so it would build a
    
      19# binary that answers `0.1.27+dev.unknown`.
    
      20source=("git+https://github.com/wolffe-lang/wolf-interp.git#tag=v$pkgver")
    
      21sha256sums=('SKIP')
    
      22
    
      23prepare() {
    
      24    cd wolf-interp
    
      25    export RUSTUP_TOOLCHAIN=stable
    
      26    cargo fetch --locked --target "$(rustc -vV | sed -n 's/host: //p')"
    
      27}
    
      28
    
      29build() {
    
      30    cd wolf-interp
    
      31    export RUSTUP_TOOLCHAIN=stable
    
      32    export CARGO_TARGET_DIR=target
    
      33    # The spec and corpus come from the tracked vendor/upstream snapshot;
    
      34    # the upstream/ submodule is not needed for a build (docs/manual/00).
    
      35    cargo build --frozen --release
    
      36}
    
      37
    
      38check() {
    
      39    cd wolf-interp
    
      40    cargo test --frozen --release || true
    
      41}
    
      42
    
      43package() {
    
      44    cd wolf-interp
    
      45
    
      46    install -Dm755 target/release/lupin "$pkgdir/usr/bin/lupin"
    
      47    install -Dm644 README.md "$pkgdir/usr/share/doc/$pkgname/README.md"
    
      48    install -Dm644 CHANGELOG.md "$pkgdir/usr/share/doc/$pkgname/CHANGELOG.md"
    
      49    install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      50}
    
      51

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-09 00:04:09	Low	2
2026-09-08 17:18:20	Low	2