narsil-mcp-bin
LOW
maintainer catHeadCoffee
0 votes
scanned 2026-09-10 03:20:13.410330
Why flagged
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
PKGBUILD
1
# Maintainer: coffee <catheadcoffee@gmail.com>
2
# narsil-mcp — Rust MCP server for deep code intelligence (postrv/narsil-mcp).
3
#
4
# Prebuilt release binaries for linux x86_64 + aarch64. Upstream CI builds
5
# them via .github/workflows/build-binaries.yml with `--features graph`
6
# (default "native" set plus the RDF/SPARQL graph tools). The release tarball
7
# contains only the already-stripped binary: mode 644, no docs, no LICENSE
8
# files — the licenses are fetched from the release tag instead.
9
#
10
# update.sh tracks new stable vX.Y.Z tags (pre-release -rcN tags are skipped)
11
# via git ls-remote and rewrites both per-arch checksum arrays. Keep those
12
# arrays on single lines: update.sh replaces each one wholesale, which also
13
# refreshes the license checksums when upstream edits them.
14
15
pkgname=narsil-mcp-bin
16
pkgver=1.7.0
17
pkgrel=1
18
pkgdesc="Rust MCP server for deep code intelligence: semantic search, call graphs, taint analysis, SBOM"
19
arch=('x86_64' 'aarch64')
20
url="https://github.com/postrv/narsil-mcp"
21
license=('MIT' 'Apache-2.0')
22
depends=('glibc' 'gcc-libs')
23
provides=('narsil-mcp')
24
conflicts=('narsil-mcp' 'narsil-mcp-git')
25
26
# Per-architecture sources: the release assets differ per arch, and makepkg
27
# pairs source_<arch> with <sum>sums_<arch> arrays — a generic source array
28
# must not be mixed with per-arch checksums (integrity check size mismatch).
29
#
30
# The arch names in these URLs are literal on purpose (not $CARCH): $CARCH
31
# is expanded once for the host arch, which would write the host asset URL
32
# into the other arch's .SRCINFO field. namcap's "use $CARCH" hint is a
33
# known false positive here.
34
_license_sources=(
35
"LICENSE-MIT::https://raw.githubusercontent.com/postrv/narsil-mcp/v${pkgver}/LICENSE-MIT"
36
"LICENSE-APACHE::https://raw.githubusercontent.com/postrv/narsil-mcp/v${pkgver}/LICENSE-APACHE"
37
)
38
source_x86_64=(
39
"narsil-mcp-${pkgver}-linux-x86_64.tar.gz::https://github.com/postrv/narsil-mcp/releases/download/v${pkgver}/narsil-mcp-v${pkgver}-linux-x86_64.tar.gz"
40
"${_license_sources[@]}"
41
)
42
source_aarch64=(
43
"narsil-mcp-${pkgver}-linux-aarch64.tar.gz::https://github.com/postrv/narsil-mcp/releases/download/v${pkgver}/narsil-mcp-v${pkgver}-linux-aarch64.tar.gz"
44
"${_license_sources[@]}"
45
)
46
# Both tarball hashes match the upstream .sha256 release assets; license
47
# hashes are identical for both architectures (tag content, arch-agnostic).
48
sha256sums_x86_64=('46986fe312f6fc1bb5fd57d028ee007a321a810084b7e0a6c6c66b337291f4f0' '22610661fd90ef80e47a421c4417fcd624c3e9571612d4f5e2401fd2b4fe68ef' '38140d0016ebc4e835fe7466764ec59e9bf8ae1678a9143a6bd3ebd87dcd32a6')
49
sha256sums_aarch64=('ef79328cf397f21a5ab24b9e932f0254043c9e5672bf7b9df66229fc44c76026' '22610661fd90ef80e47a421c4417fcd624c3e9571612d4f5e2401fd2b4fe68ef' '38140d0016ebc4e835fe7466764ec59e9bf8ae1678a9143a6bd3ebd87dcd32a6')
50
51
package() {
52
# Tarball layout: a single ./narsil-mcp entry, already stripped by
53
# upstream CI. Install fixes its 644 mode and runner/runner ownership.
54
install -Dm755 "${srcdir}/narsil-mcp" "${pkgdir}/usr/bin/narsil-mcp"
55
56
install -Dm644 "${srcdir}/LICENSE-MIT" \
57
"${pkgdir}/usr/share/licenses/${pkgname}/LICENSE-MIT"
58
install -Dm644 "${srcdir}/LICENSE-APACHE" \
59
"${pkgdir}/usr/share/licenses/${pkgname}/LICENSE-APACHE"
60
}
61
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-10 03:20:13 | Low | 1 |