mindforge

LOW

maintainer jetomev 0 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

The package builds from a source tarball hosted on the project's own GitHub releases with a valid PGP signature (though the checksum is skipped), and installs only scripts and data files; the low severity is due to the skipped checksum and new/low-vote status, not active malice.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from a source tarball hosted on the project's own GitHub releases with a valid PGP signature (though the checksum is skipped), and installs only scripts and data files; the low severity is due to the skipped checksum and new/low-vote status, not active malice.

PKGBUILD

      1# Maintainer: jetomev <jetomev@gmail.com>
    
      2# Co-developer: Claude (Anthropic)
    
      3
    
      4pkgname=mindforge
    
      5pkgver=0.1.8
    
      6pkgrel=1
    
      7pkgdesc="A working agreement between you and your AI assistant that does not decay: tiered context, explicit triggers, a closeout that can't be forgotten. Any Linux distribution, no desktop needed: a terminal tool (bash)"
    
      8arch=('any')
    
      9url="https://github.com/jetomev/mindforge"
    
      10license=('GPL3')
    
      11depends=('bash' 'git' 'coreutils' 'grep' 'sed' 'gawk')
    
      12optdepends=('github-cli: checks that a queued task'"'"'s issue is still open (rot check R8)'
    
      13            'libnotify: a desktop notification when a session needs you'
    
      14            'python: the brief'"'"'s project table'
    
      15            'libpulse: the chime sound (paplay)'
    
      16            'pipewire: the chime sound (pw-play)')
    
      17source=("${pkgname}-${pkgver}.tar.gz::${url}/releases/download/v${pkgver}/${pkgname}-${pkgver}.tar.gz"
    
      18        "${pkgname}-${pkgver}.tar.gz.asc::${url}/releases/download/v${pkgver}/${pkgname}-${pkgver}.tar.gz.asc")
    
      19sha256sums=('7965348ccadd34f203e13d7380471af4fb783ac924e398c426ce1b59bda87fc8'
    
      20            'SKIP')
    
      21# Javier (jetomev) release-signing key — import via:
    
      22#   curl -s https://github.com/jetomev.gpg | gpg --import
    
      23validpgpkeys=('32E1D2AB9380BFD6BFE3BC1EAC2A3407CC070F9E')
    
      24
    
      25check() {
    
      26    cd "${srcdir}/${pkgname}-${pkgver}"
    
      27    # 180 checks in a sandbox (its own HOME and state; gh stubbed, no network); the builder's files untouched
    
      28    bash testing/run-tests.sh
    
      29}
    
      30
    
      31package() {
    
      32    cd "${srcdir}/${pkgname}-${pkgver}"
    
      33    install -Dm755 bin/mindforge "${pkgdir}/usr/bin/mindforge"
    
      34    # the starting files the README's Install copies into ~/.config and ~/.claude
    
      35    install -dm755 "${pkgdir}/usr/share/${pkgname}"
    
      36    cp -r templates "${pkgdir}/usr/share/${pkgname}/"
    
      37    install -m644 config.example always.example rules.example persona.example "${pkgdir}/usr/share/${pkgname}/"
    
      38    install -Dm644 README.md "${pkgdir}/usr/share/doc/${pkgname}/README.md"
    
      39    cp -r docs "${pkgdir}/usr/share/doc/${pkgname}/"
    
      40    install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      41}
    
      42

Changes since previous scan

--- PKGBUILD @ 2026-10-10 00:11
+++ PKGBUILD @ 2026-10-17 00:21
@@ -2,7 +2,7 @@
 # Co-developer: Claude (Anthropic)
 
 pkgname=mindforge
-pkgver=0.1.7
+pkgver=0.1.8
 pkgrel=1
 pkgdesc="A working agreement between you and your AI assistant that does not decay: tiered context, explicit triggers, a closeout that can't be forgotten. Any Linux distribution, no desktop needed: a terminal tool (bash)"
 arch=('any')
@@ -16,7 +16,7 @@
             'pipewire: the chime sound (pw-play)')
 source=("${pkgname}-${pkgver}.tar.gz::${url}/releases/download/v${pkgver}/${pkgname}-${pkgver}.tar.gz"
         "${pkgname}-${pkgver}.tar.gz.asc::${url}/releases/download/v${pkgver}/${pkgname}-${pkgver}.tar.gz.asc")
-sha256sums=('42acba0a397b156070461c2161f9d361ee7ef6e8a96a6afa5af55d5cda9cbd3e'
+sha256sums=('7965348ccadd34f203e13d7380471af4fb783ac924e398c426ce1b59bda87fc8'
             'SKIP')
 # Javier (jetomev) release-signing key — import via:
 #   curl -s https://github.com/jetomev.gpg | gpg --import

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2
2026-10-13 01:15:21	Low	2
2026-10-10 00:11:52	Clean	2
2026-10-09 22:12:40	Low	1