moarchy-coins
CLEAN
maintainer simonschubert
0 votes
scanned 2026-09-15 00:25:31.187355
Triggered rules
Clean
AI review downgraded a static finding
llm_review
The static rules flagged this LOW, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it CLEAN (confidence 95%): The package builds from a versioned release asset of the project's own source, includes no untrusted executables, and installs only Python modules and data files; the flagged low votes and recent upload are mitigated by transparent, auditable build practices and no remote code execution.
1 higher static finding superseded - not the current verdict (shown for transparency)
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
PKGBUILD
1
# Maintainer: Simon Schubert <simon@librem.one>
2
pkgname=moarchy-coins
3
pkgver=0.1.1
4
pkgrel=1
5
pkgdesc="A coin tracker for a Linux phone: the top hundred, and the ones you star"
6
arch=('any')
7
url="https://github.com/SimonSchubert/moarchy-apps"
8
license=('MIT')
9
# Pure Python, so arch=any. The GUI stack is all runtime, nothing is compiled.
10
#
11
# Note what is NOT here. There is no python-cairo, because nothing in this app
12
# is drawn: no graph, no sparkline, no coin logo, so every figure on screen is a
13
# label and the whole app is stock widgets. Vitals needs pycairo and says why in
14
# its own PKGBUILD; an app that copied that line without needing it would be a
15
# package the store has to account for on a stock image.
16
#
17
# There is no python-requests either. The one network call this app makes is a
18
# GET of a JSON document, which urllib in the standard library does -- and the
19
# store reports what an app costs in packages onto a stock image, so a
20
# dependency for `requests.get` would be a cost with nothing behind it.
21
depends=('python' 'python-gobject' 'gtk4' 'libadwaita')
22
source=("$url/releases/download/coins-v$pkgver/$pkgname-$pkgver.tar.gz")
23
sha256sums=('5c171a5e03369d2bf77510f38829df40eda96aecc869ef8ac456cbcb43d94896')
24
25
# The source tarball is assembled by packaging/release.sh from two subtrees of
26
# one tag -- apps/coins and shared -- so it holds this app and the shared code it
27
# uses and nothing else. That is what lets a monorepo keep per-app versions:
28
# `git archive <tag>:<subdir>` means one repo does not mean one version number.
29
#
30
# Deliberately a versioned package rather than a -git one, and a release asset
31
# rather than GitHub's auto-generated archive. Both arguments are in
32
# apps/vitals/PKGBUILD in full; neither is any different here.
33
34
check() {
35
cd "$srcdir/$pkgname-$pkgver"
36
# Parsing somebody else's JSON and writing our own file, against records
37
# written by hand in tests/. That is the whole reason nothing in market.py or
38
# store.py imports gi: a build chroot has no display, and neither the shape of
39
# an answer nor the format of a price needs one. Nothing here opens a socket
40
# either -- the one class that would is driven through a stand-in for urlopen,
41
# because a build must not depend on CoinGecko being up. The widget tests skip
42
# themselves without a display; scripts/check.sh runs those.
43
PYTHONPATH=. python3 -m unittest discover -s tests
44
}
45
46
package() {
47
cd "$srcdir/$pkgname-$pkgver"
48
49
# Deliberately NOT site-packages. That path is Python-version-specific
50
# (/usr/lib/python3.13/site-packages), and this is an arch=any package: the
51
# version that built it would be baked in, so a Python minor bump would break
52
# every installed copy until rebuilt. A private dir on sys.path is immune.
53
install -Dm644 moarchy_coins/*.py -t "$pkgdir/usr/lib/$pkgname/moarchy_coins/"
54
55
# The shared code is vendored into this package rather than being a package of
56
# its own. The store reports what an app costs in packages and megabytes onto
57
# a stock image, and a second package for two hundred lines of palette
58
# arithmetic is a cost with nothing behind it. One source copy in the repo,
59
# one self-contained package here, no runtime coupling between apps.
60
install -Dm644 moarchy_ui/*.py -t "$pkgdir/usr/lib/$pkgname/moarchy_ui/"
61
62
install -Dm755 launcher "$pkgdir/usr/bin/moarchy-coins"
63
64
install -Dm644 data/org.moarchy.Coins.desktop \
65
"$pkgdir/usr/share/applications/org.moarchy.Coins.desktop"
66
install -Dm644 data/org.moarchy.Coins.svg \
67
"$pkgdir/usr/share/icons/hicolor/scalable/apps/org.moarchy.Coins.svg"
68
69
install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
70
install -Dm644 README.md "$pkgdir/usr/share/doc/$pkgname/README.md"
71
}
72
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-15 00:25:31 | Clean | 2 |
| 2026-09-14 01:15:25 | Low | 1 |