mothx-git

LOW

maintainer taotieren 0 votes scanned 2026-11-03 12:04:35.126831

View on AUR

Why flagged

Package builds from a public Git repository of a known project, uses a SKIP'd checksum which is common for -git packages, and does not execute untrusted prebuilt binaries or remote code; the low severity is due to limited votes and recent upload, not inherent risk.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): Package builds from a public Git repository of a known project, uses a SKIP'd checksum which is common for -git packages, and does not execute untrusted prebuilt binaries or remote code; the low severity is due to limited votes and recent upload, not inherent risk.

PKGBUILD

      1# Maintainer: taotieren <admin@taotieren.com>
    
      2
    
      3pkgname=mothx-git
    
      4pkgver=1.3.108.pre.1.r7.gb433fe0
    
      5pkgrel=1
    
      6pkgdesc="🚀 One Binary to Rule Them All — Your AI Coding Assistant in the Terminal"
    
      7arch=($CARCH)
    
      8url="https://github.com/oschina/mothx"
    
      9license=('MIT')
    
      10provides=(${pkgname%-git} vibecoding)
    
      11conflicts=(${pkgname%-git} vibecoding)
    
      12#replaces=(${pkgname})
    
      13depends=(
    
      14    sh
    
      15    bubblewrap
    
      16)
    
      17makedepends=(
    
      18    git
    
      19    go
    
      20    npm
    
      21    nodejs
    
      22)
    
      23optdepends=()
    
      24backup=()
    
      25options=('!debug')
    
      26#install=${pkgname}.install
    
      27source=("${pkgname}::git+${url}.git")
    
      28sha256sums=('SKIP')
    
      29
    
      30pkgver() {
    
      31    cd "${srcdir}/${pkgname}"
    
      32    (
    
      33        set -o pipefail
    
      34        git describe --long --tag --abbrev=7 2>/dev/null | sed 's/^[vV]//g;s/\([^-]*-g\)/r\1/;s/-/./g' ||
    
      35            printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
    
      36    )
    
      37}
    
      38
    
      39prepare() {
    
      40    git -C "${srcdir}/${pkgname}" clean -dfx
    
      41}
    
      42
    
      43build() {
    
      44    cd "${srcdir}/${pkgname}"
    
      45    export CGO_CPPFLAGS="${CPPFLAGS}"
    
      46    export CGO_CFLAGS="${CFLAGS}"
    
      47    export CGO_CXXFLAGS="${CXXFLAGS}"
    
      48    export CGO_LDFLAGS="${LDFLAGS}"
    
      49    export GOFLAGS="-buildmode=pie -trimpath -ldflags=-linkmode=external -mod=readonly -modcacherw"
    
      50    export GO111MODULE=on
    
      51    export GOPROXY=https://goproxy.cn,direct
    
      52
    
      53    # mkdir -pv build/
    
      54    # go build -o build/${pkgname%-git} ./cmd/mothx
    
      55    make ui-install
    
      56    make ui-build
    
      57    make build
    
      58}
    
      59
    
      60package() {
    
      61    cd "${srcdir}/${pkgname}"
    
      62
    
      63    install -vDm755 bin/${pkgname%-git} -t ${pkgdir}/usr/bin/
    
      64    install -vDm0644 *.md -t "${pkgdir}/usr/share/doc/${pkgname}/"
    
      65    cp -R docs "${pkgdir}/usr/share/doc/${pkgname}/"
    
      66    install -vDm0644 "LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}/"
    
      67    ln -sf /usr/bin/${pkgname%-git} ${pkgdir}/usr/bin/vibecoding
    
      68}
    
      69

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-03 12:04:35	Low	2