moarchy-habits
LOW
maintainer simonschubert
0 votes
scanned 2026-09-12 19:12:35.548512
Why flagged
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
PKGBUILD
1
# Maintainer: Simon Schubert <simon@librem.one>
2
pkgname=moarchy-habits
3
pkgver=0.1.2
4
pkgrel=1
5
pkgdesc="Habit tracking for a Linux phone, kept on the device"
6
arch=('any')
7
url="https://github.com/SimonSchubert/moarchy-apps"
8
license=('MIT')
9
# Pure Python, so arch=any. The GUI stack is all runtime, nothing is compiled.
10
# python-cairo is for the today-ring, which is drawn rather than laid out.
11
# It is already on the phone image, so it adds nothing there -- but an
12
# undeclared dependency does not fail, it just silently draws nothing, which
13
# is how the ring came to be missing from every screenshot taken in a
14
# container that did not have it.
15
depends=('python' 'python-gobject' 'gtk4' 'libadwaita' 'python-cairo')
16
source=("$url/releases/download/habits-v$pkgver/$pkgname-$pkgver.tar.gz")
17
sha256sums=('52d2a8ae1ef4595330262ce6fd84a45dc130caf68aa7c755b4edfc4dc525f7e4')
18
19
# The source tarball is assembled by packaging/release.sh from two subtrees of
20
# one tag -- apps/habits and shared -- so it holds this app and the shared code
21
# it uses and nothing else. That is what lets a monorepo keep per-app versions:
22
# `git archive <tag>:<subdir>` means one repo does not mean one version number.
23
#
24
# Deliberately a versioned package rather than a -git one. mobileomarchy pins
25
# each package by a commit; for a VCS package that pin governs the packaging and
26
# says nothing about the code makepkg then clones at HEAD, so "pinned" would
27
# read as reproducible without being it. A tarball with a checksum makes the pin
28
# name the exact code, and gives pacman a version it can compare for upgrades.
29
#
30
# The source is a release asset built with `git archive`, not GitHub's
31
# auto-generated archive: those are produced on demand, and a change to the
32
# compression GitHub uses has broken every checksum pinned against them before.
33
34
check() {
35
cd "$srcdir/$pkgname-$pkgver"
36
# The storage layer and every date calculation in it. The widget tests skip
37
# themselves without a display, which a build chroot does not have;
38
# scripts/check.sh runs those.
39
PYTHONPATH=. python3 -m unittest discover -s tests
40
}
41
42
package() {
43
cd "$srcdir/$pkgname-$pkgver"
44
45
# Deliberately NOT site-packages. That path is Python-version-specific
46
# (/usr/lib/python3.13/site-packages), and this is an arch=any package: the
47
# version that built it would be baked in, so a Python minor bump would break
48
# every installed copy until rebuilt. A private dir on sys.path is immune.
49
install -Dm644 moarchy_habits/*.py -t "$pkgdir/usr/lib/$pkgname/moarchy_habits/"
50
51
# The shared code is vendored into this package rather than being a package of
52
# its own. The store reports what an app costs in packages and megabytes onto
53
# a stock image, and a second package for two hundred lines of palette
54
# arithmetic is a cost with nothing behind it. One source copy in the repo,
55
# one self-contained package here, no runtime coupling between apps.
56
install -Dm644 moarchy_ui/*.py -t "$pkgdir/usr/lib/$pkgname/moarchy_ui/"
57
58
install -Dm755 launcher "$pkgdir/usr/bin/moarchy-habits"
59
60
install -Dm644 data/org.moarchy.Habits.desktop \
61
"$pkgdir/usr/share/applications/org.moarchy.Habits.desktop"
62
install -Dm644 data/org.moarchy.Habits.svg \
63
"$pkgdir/usr/share/icons/hicolor/scalable/apps/org.moarchy.Habits.svg"
64
65
install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
66
install -Dm644 README.md "$pkgdir/usr/share/doc/$pkgname/README.md"
67
}
68
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-12 19:12:35 | Low | 1 |