mcmodding-mcp

LOW
maintainer xianhongtao 0 votes scanned 2026-09-16 07:21:35.943234
View on AUR
Why flagged
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Triggered rules

Low Few votes, recently uploaded zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
PKGBUILD

      1# Maintainer: xianhongtao <xianhongtao2022@outlook.com>
    
      2pkgname=mcmodding-mcp
    
      3pkgver=0.5.0
    
      4pkgrel=1
    
      5pkgdesc='MCP server for Minecraft Fabric and NeoForge modding documentation'
    
      6arch=('x86_64')
    
      7url='https://github.com/OGMatrix/mcmodding-mcp'
    
      8license=('MIT')
    
      9depends=('nodejs>=22.15.0' 'glibc' 'libgcc' 'libstdc++.so' 'libvips' 'glib2' 'sh')
    
      10makedepends=('node-gyp' 'python' 'pkgconf')
    
      11# Preserve upstream native libraries; do not generate a mostly vendored debug package.
    
      12options=('!strip' '!debug')
    
      13_pnpmver=10.30.0
    
      14source=("${pkgname}-${pkgver}.tar.gz::https://codeload.github.com/OGMatrix/mcmodding-mcp/tar.gz/refs/tags/v${pkgver}"
    
      15        "pnpm-${_pnpmver}.tgz::https://registry.npmjs.org/pnpm/-/pnpm-${_pnpmver}.tgz"
    
      16        'onnxruntime-1.14.0-LICENSE::https://raw.githubusercontent.com/microsoft/onnxruntime/v1.14.0/LICENSE'
    
      17        'onnxruntime-1.14.0-ThirdPartyNotices.txt::https://raw.githubusercontent.com/microsoft/onnxruntime/v1.14.0/ThirdPartyNotices.txt'
    
      18        'xdg-cache.patch')
    
      19sha256sums=('e748b72ddbd1cd81faaf34a93a27abf1ad95d482de79cfb74af599e49d6f82d1'
    
      20            'fde3cebbd4ed0d6d140b1983743bf575cdd4b15e4d5e5b257425152dce5b1b6a'
    
      21            '2f07c72751aed99790b8a4869cf2311df85a860b22ded05fa22803587a48922c'
    
      22            'cc63920441c5681cfb1663caf1de1858349b517fc1bed9ca669a85bc526cd13e'
    
      23            '2d56098d3b4b3d99cc1d4bdfceec7f6e7a476f47f6e72d8aaa322ffc6fa73352')
    
      24
    
      25# The dependency graph is pinned by checksum: this is upstream v0.5.0's
    
      26# pnpm-lock.yaml as shipped inside the sha256-pinned source tarball. See prepare().
    
      27_lockfile_sha256='4b0356ea956fcd537a06c3cadd43544320ac78783af9e133e1bfc693fecceb98'
    
      28
    
      29_pnpm() {
    
      30    # Use upstream's pinned pnpm without a global npm install or user npm prefix.
    
      31    npm_config_cache="${srcdir}/npm-cache" \
    
      32        XDG_STATE_HOME="${srcdir}/pnpm-state" \
    
      33        node "${srcdir}/package/bin/pnpm.cjs" "$@" \
    
      34        --store-dir "${srcdir}/pnpm-store" \
    
      35        --cache-dir "${srcdir}/pnpm-cache"
    
      36}
    
      37
    
      38prepare() {
    
      39    cd "${pkgname}-${pkgver}"
    
      40    # Refuse to build anything other than the pinned dependency graph.
    
      41    echo "${_lockfile_sha256}  pnpm-lock.yaml" | sha256sum -c -
    
      42    patch -Np1 -i "${srcdir}/xdg-cache.patch"
    
      43    # The v0.5.0 tag still carries 0.4.5 in these two metadata fields.
    
      44    sed -i "s/\"version\": \"0.4.5\"/\"version\": \"${pkgver}\"/" package.json
    
      45    sed -i "s/version: '0.4.5'/version: '${pkgver}'/" src/index.ts
    
      46    # Dependency downloads are not individual source=() entries: upstream's lockfile is
    
      47    # thousands of lines covering hundreds of transitive packages, and the Node.js packaging
    
      48    # guidelines expect the build to fetch them. The graph is checksum-pinned instead: the
    
      49    # lockfile ships inside the sha256-pinned source tarball, its own checksum is asserted
    
      50    # above, and --frozen-lockfile forbids rewriting it, so every resolved version and
    
      51    # integrity hash comes from that file. pnpm verifies each download against
    
      52    # resolution.integrity, and its verify-store-integrity and strict-store-pkg-content-check
    
      53    # options both default to enabled. Lifecycle hooks stay disabled: they would run
    
      54    # upstream scripts and database downloads.
    
      55    _pnpm install --frozen-lockfile --verify-store-integrity --ignore-scripts
    
      56}
    
      57
    
      58build() {
    
      59    cd "${pkgname}-${pkgver}"
    
      60    node node_modules/typescript/bin/tsc --sourceMap false --declarationMap false
    
      61    # Recreate the production tree offline so dev tools cannot leak into the package and
    
      62    # no unverified download can occur.
    
      63    rm -rf node_modules
    
      64    CI=true _pnpm install --prod --offline --frozen-lockfile --verify-store-integrity --ignore-scripts
    
      65    (
    
      66        cd node_modules/better-sqlite3
    
      67        node-gyp rebuild --release --nodedir=/usr
    
      68    )
    
      69    (
    
      70        # transformers 2.x requires this older sharp; use Arch's libvips.
    
      71        cd node_modules/.pnpm/sharp@0.32.6/node_modules/sharp
    
      72        SHARP_FORCE_GLOBAL_LIBVIPS=1 node-gyp rebuild --release --nodedir=/usr
    
      73    )
    
      74}
    
      75
    
      76check() {
    
      77    cd "${pkgname}-${pkgver}"
    
      78    # Both installs used --frozen-lockfile, so the pinned graph must be untouched.
    
      79    echo "${_lockfile_sha256}  pnpm-lock.yaml" | sha256sum -c -
    
      80    XDG_CACHE_HOME="${srcdir}/test-cache" node --input-type=module <<'JS'
    
      81import assert from 'node:assert/strict';
    
      82import path from 'node:path';
    
      83import { createRequire } from 'node:module';
    
      84import { createZstdDecompress } from 'node:zlib';
    
      85import Database from 'better-sqlite3';
    
      86import sharp from 'sharp';
    
      87import { pipeline, env } from '@xenova/transformers';
    
      88import './dist/indexer/embeddings.js';
    
      89const require = createRequire(import.meta.url);
    
      90const oldSharp = require('./node_modules/.pnpm/sharp@0.32.6/node_modules/sharp');
    
      91const db = new Database(':memory:');
    
      92assert.equal(db.prepare('SELECT 42 AS n').get().n, 42);
    
      93db.close();
    
      94assert.equal(typeof pipeline, 'function');
    
      95assert.equal(typeof createZstdDecompress, 'function');
    
      96assert.equal(env.cacheDir, path.join(process.env.XDG_CACHE_HOME, 'mcmodding-mcp', 'transformers'));
    
      97for (const image of [sharp, oldSharp]) {
    
      98    const png = await image({create: {width: 1, height: 1, channels: 3,
    
      99        background: 'white'}}).png().toBuffer();
    
      100    assert.ok(png.length > 0);
    
      101}
    
      102JS
    
      103}
    
      104
    
      105package() {
    
      106    cd "${pkgname}-${pkgver}"
    
      107    install -d "${pkgdir}/usr/lib/${pkgname}"
    
      108    # Break store deduplication hardlinks while retaining relative symlinks.
    
      109    cp -a --no-preserve=ownership,links dist node_modules package.json "${pkgdir}/usr/lib/${pkgname}/"
    
      110
    
      111    # onnxruntime-node bundles several operating systems and CPU architectures.
    
      112    local _onnx="${pkgdir}/usr/lib/${pkgname}/node_modules/.pnpm/onnxruntime-node@1.14.0/node_modules/onnxruntime-node/bin/napi-v3"
    
      113    find "$_onnx" -mindepth 1 -maxdepth 1 ! -name linux -exec rm -rf -- {} +
    
      114    find "$_onnx/linux" -mindepth 1 -maxdepth 1 ! -name x64 -exec rm -rf -- {} +
    
      115    local _prebuild
    
      116    while IFS= read -r -d '' _prebuild; do
    
      117        find "$_prebuild" -mindepth 1 -maxdepth 1 ! -name linux-x64 -exec rm -rf -- {} +
    
      118    done < <(find "${pkgdir}/usr/lib/${pkgname}/node_modules" -type d -name prebuilds -print0)
    
      119    # Keep compiled modules and upstream licenses, discard build intermediates.
    
      120    local _mod
    
      121    for _mod in better-sqlite3@12.10.0/node_modules/better-sqlite3 sharp@0.32.6/node_modules/sharp; do
    
      122        rm -rf "${pkgdir}/usr/lib/${pkgname}/node_modules/.pnpm/${_mod}/build/Release/obj.target"
    
      123        rm -f "${pkgdir}/usr/lib/${pkgname}/node_modules/.pnpm/${_mod}/build/Release/test_extension.node"
    
      124        find "${pkgdir}/usr/lib/${pkgname}/node_modules/.pnpm/${_mod}/build" \
    
      125            -type f ! -name '*.node' -delete
    
      126        find "${pkgdir}/usr/lib/${pkgname}/node_modules/.pnpm/${_mod}/build" \
    
      127            -type d -empty -delete
    
      128    done
    
      129    # node-addon-api is a header-only build dependency, but gyp resolves its placeholder
    
      130    # target through pnpm's store paths and writes leftovers outside build/: mangled
    
      131    # node-addon-api@* directories holding only gyp output, and an empty static archive
    
      132    # whose ar timestamps differ between builds. The real package is kept at
    
      133    # .pnpm/node-addon-api@*, which this exclusion preserves.
    
      134    find "${pkgdir}/usr/lib/${pkgname}/node_modules" -type d -name 'node-addon-api@*' \
    
      135        ! -path '*/node_modules/.pnpm/node-addon-api@*' -exec rm -rf -- {} +
    
      136    # pnpm's installer metadata contains absolute paths to the build store.
    
      137    rm -f "${pkgdir}/usr/lib/${pkgname}/node_modules/.modules.yaml" \
    
      138          "${pkgdir}/usr/lib/${pkgname}/node_modules/.pnpm-workspace-state-v1.json"
    
      139    # These dependency build-tool shims embed NODE_PATH from the build directory.
    
      140    # The application invokes JS modules directly, not these private CLI shims.
    
      141    find "${pkgdir}/usr/lib/${pkgname}/node_modules" -type d -name .bin \
    
      142        -prune -exec rm -rf -- {} +
    
      143    # This nested CLI is private, so its man pages do not belong in /usr/lib.
    
      144    rm -rf "${pkgdir}/usr/lib/${pkgname}/node_modules/.pnpm/protobufjs@6.11.4/node_modules/protobufjs/cli/node_modules/marked/man"
    
      145    find "${pkgdir}/usr/lib/${pkgname}/node_modules" -type d -empty -delete
    
      146
    
      147    install -Dm755 /dev/stdin "${pkgdir}/usr/bin/mcmodding-mcp" <<'WRAPPER'
    
      148#!/bin/sh
    
      149exec /usr/bin/node /usr/lib/mcmodding-mcp/dist/index.js "$@"
    
      150WRAPPER
    
      151    install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      152    install -Dm644 "${srcdir}/onnxruntime-1.14.0-LICENSE" \
    
      153        "${pkgdir}/usr/share/licenses/${pkgname}/onnxruntime-LICENSE"
    
      154    install -Dm644 "${srcdir}/onnxruntime-1.14.0-ThirdPartyNotices.txt" \
    
      155        "${pkgdir}/usr/share/licenses/${pkgname}/onnxruntime-ThirdPartyNotices.txt"
    
      156    install -Dm644 node_modules/.pnpm/@img+sharp-libvips-linux-x64@1.2.4/node_modules/@img/sharp-libvips-linux-x64/README.md \
    
      157        "${pkgdir}/usr/share/licenses/${pkgname}/sharp-libvips-licensing.md"
    
      158    install -Dm644 README.md "${pkgdir}/usr/share/doc/${pkgname}/README.md"
    
      159}
    
      160
Scan history

Scanned at (UTC)	Severity	Rules
2026-09-16 07:21:35	Low	1