matchplane-git

maintainer lightjunction · 0 votes · scanned 2026-08-18 00:03:42.021799

LOW

Why flagged The 'bun install' runs in the project's own web directory from a locked, version-controlled source; it installs declared development dependencies for building the frontend, not external unreviewed code.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The 'bun install' runs in the project's own web directory from a locked, version-controlled source; it installs declared development dependencies for building the frontend, not external unreviewed code.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM bun install of an undeclared external package bun_install_external

`bun add` / `bun install <package>` fetches an external package outside source=(). Severity downgraded: the package declares/looks like a Node.js consumer.

PKGBUILD:34 bun install --frozen-lockfile --cwd web

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: LIghtJUNction <lightjunction.me@gmail.com>
    
      2pkgname=matchplane-git
    
      3pkgver=0.1.8.r26.g42cdce6
    
      4pkgrel=1
    
      5pkgdesc='Federated AI matching infrastructure (development version)'
    
      6arch=('x86_64')
    
      7url='https://github.com/LIghtJUNction/matchplane'
    
      8license=('LicenseRef-MatchPlane-Pending')
    
      9depends=('ca-certificates' 'gcc-libs' 'glibc' 'openssl' 'zlib')
    
      10makedepends=('bun' 'cargo' 'cmake' 'curl' 'git' 'protobuf' 'rust')
    
      11provides=('matchplane')
    
      12conflicts=('matchplane' 'matchplane-bin')
    
      13# makepkg's cross-language LTO drops native crypto symbols from SQLx's
    
      14# proc-macro shared object. Cargo still applies its safe per-crate optimizations.
    
      15options=('!lto')
    
      16backup=('etc/matchplane/matchplane.env')
    
      17install=matchplane.install
    
      18# The release workflow replaces 42cdce6a5cd63506c86f5d566bbb9302db938d5d with the exact GitHub commit being
    
      19# published. Keeping the VCS source immutable prevents a moving main branch from
    
      20# changing an AUR build after its review.
    
      21source=('matchplane::git+https://github.com/LIghtJUNction/matchplane.git#commit=42cdce6a5cd63506c86f5d566bbb9302db938d5d')
    
      22sha256sums=('SKIP')
    
      23
    
      24pkgver() {
    
      25  cd matchplane
    
      26  local count revision
    
      27  count=$(git rev-list --count HEAD)
    
      28  revision=$(git rev-parse --short=7 HEAD)
    
      29  printf '0.1.8.r%s.g%s' "$count" "$revision"
    
      30}
    
      31
    
      32build() {
    
      33  cd matchplane
    
      34  bun install --frozen-lockfile --cwd web
    
      35  bun run --cwd web build
    
      36  cargo build --release --locked --workspace --bins
    
      37}
    
      38
    
      39check() {
    
      40  cd matchplane
    
      41  bun run --cwd web test
    
      42  cargo test --release --locked --workspace
    
      43}
    
      44
    
      45package() {
    
      46  cd matchplane
    
      47  packaging/scripts/stage.sh "$pkgdir" target/release
    
      48}
    
      49

Changes since previous scan

--- PKGBUILD @ 2026-08-15 01:30
+++ PKGBUILD @ 2026-08-18 00:03
@@ -1,6 +1,6 @@
 # Maintainer: LIghtJUNction <lightjunction.me@gmail.com>
 pkgname=matchplane-git
-pkgver=0.1.7.r19.g15a2c6c
+pkgver=0.1.8.r26.g42cdce6
 pkgrel=1
 pkgdesc='Federated AI matching infrastructure (development version)'
 arch=('x86_64')
@@ -15,7 +15,10 @@
 options=('!lto')
 backup=('etc/matchplane/matchplane.env')
 install=matchplane.install
-source=('matchplane::git+https://github.com/LIghtJUNction/matchplane.git')
+# The release workflow replaces 42cdce6a5cd63506c86f5d566bbb9302db938d5d with the exact GitHub commit being
+# published. Keeping the VCS source immutable prevents a moving main branch from
+# changing an AUR build after its review.
+source=('matchplane::git+https://github.com/LIghtJUNction/matchplane.git#commit=42cdce6a5cd63506c86f5d566bbb9302db938d5d')
 sha256sums=('SKIP')
 
 pkgver() {
@@ -23,7 +26,7 @@
   local count revision
   count=$(git rev-list --count HEAD)
   revision=$(git rev-parse --short=7 HEAD)
-  printf '0.1.7.r%s.g%s' "$count" "$revision"
+  printf '0.1.8.r%s.g%s' "$count" "$revision"
 }
 
 build() {

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	LOW	3
2026-08-17 00:18:29	LOW	3
2026-08-16 00:03:42	LOW	3
2026-08-15 05:30:14	MEDIUM	2
2026-08-15 01:30:13	MEDIUM	2
2026-08-15 00:26:13	LOW	3
2026-08-14 23:30:04	MEDIUM	2
2026-08-14 21:29:33	MEDIUM	2
2026-08-14 17:29:23	LOW	2