melody-watch-git

LOW

maintainer Rasi 0 votes scanned 2026-09-27 00:07:07.510666

View on AUR

Why flagged

The package builds a small client component from the project's own Git repository; the source is transparent and the build is standard, with no remote code execution or untrusted binaries, though the SKIP'd checksum and low votes slightly increase supply-chain risk.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds a small client component from the project's own Git repository; the source is transparent and the build is standard, with no remote code execution or untrusted binaries, though the SKIP'd checksum and low votes slightly increase supply-chain risk.

PKGBUILD

      1# Maintainer: Rasmus Steinke <rasi@xssn.at>
    
      2#
    
      3# melody-watch on its own: run where the music is -- a NAS that cannot run
    
      4# the engine -- it tells an engine elsewhere which files changed, so that
    
      5# engine re-reads just those instead of scanning over the network. It needs
    
      6# the protocol client only, so it builds in seconds without the engine.
    
      7pkgname=melody-watch-git
    
      8pkgver=r462.gd3c7d32
    
      9pkgrel=1
    
      10pkgdesc='Tells a Melody engine which music files changed on a NAS, so it need not scan'
    
      11arch=(x86_64 aarch64)
    
      12url='https://github.com/carnager/melody-next'
    
      13license=(GPL-3.0-only)
    
      14depends=(gcc-libs glibc libutf8proc)
    
      15makedepends=(cmake git ninja nlohmann-json)
    
      16provides=(melody-watch)
    
      17conflicts=(melody-watch)
    
      18install=melody-watch.install
    
      19source=("melody-next::git+https://github.com/carnager/melody-next.git")
    
      20sha256sums=('SKIP')
    
      21
    
      22pkgver() {
    
      23  cd melody-next
    
      24  printf 'r%s.g%s' "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
    
      25}
    
      26
    
      27build() {
    
      28  cd melody-next
    
      29  cmake -B build -G Ninja -DCMAKE_BUILD_TYPE=Release -DCMAKE_INSTALL_PREFIX=/usr \
    
      30    -DTRACKKNIFE_CLI_ONLY=ON -DTRACKKNIFE_BUILD_UI=OFF -DBUILD_TESTING=OFF \
    
      31    -DTRACKKNIFE_BUILD_BENCHMARKS=OFF -DTRACKKNIFE_WARNINGS_AS_ERRORS=OFF
    
      32  cmake --build build --target melody_watch
    
      33}
    
      34
    
      35package() {
    
      36  cd melody-next
    
      37  DESTDIR="$pkgdir" cmake --install build --component watch
    
      38  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      39}
    
      40

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-27 00:07:07	Low	2
2026-09-26 11:15:02	Low	2