niri-tracker-bin

LOW

maintainer Qiumix 0 votes scanned 2026-11-05 12:09:09.970845

View on AUR

Why flagged

The package installs a prebuilt binary from the project's own GitHub releases, which is normal for AUR packages; the source is verifiable via checksums and hosted on an official platform, posing minimal risk despite few votes and recent upload.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package installs a prebuilt binary from the project's own GitHub releases, which is normal for AUR packages; the source is verifiable via checksums and hosted on an official platform, posing minimal risk despite few votes and recent upload.

PKGBUILD

      1# Maintainer: Qiumix <j487428862@gmail.com>
    
      2#
    
      3# Prebuilt binary from the release workflow. The tarball unpacks into
    
      4# niri-tracker-<target>/ containing the binary, its JSON schema, the systemd
    
      5# unit and the licence, so nothing is fetched from a second place.
    
      6
    
      7pkgname=niri-tracker-bin
    
      8_pkgname=niri-tracker
    
      9pkgver=0.1.1
    
      10pkgrel=1
    
      11pkgdesc="Screen time tracking for the niri Wayland compositor (prebuilt binary)"
    
      12arch=('x86_64' 'aarch64')
    
      13url="https://github.com/Qiumix/niri-tracker"
    
      14license=('MIT')
    
      15depends=('glibc')
    
      16makedepends=()
    
      17checkdepends=()
    
      18provides=("$_pkgname")
    
      19conflicts=("$_pkgname" "${_pkgname}-git")
    
      20options=('!strip')
    
      21source_x86_64=("$pkgname-$pkgver.tar.gz::${url}/releases/download/v${pkgver}/${_pkgname}-x86_64-unknown-linux-gnu.tar.gz")
    
      22source_aarch64=("$pkgname-$pkgver.tar.gz::${url}/releases/download/v${pkgver}/${_pkgname}-aarch64-unknown-linux-gnu.tar.gz")
    
      23sha256sums_x86_64=('5b0982f99ef70b0d363759d8033f05e95781c533954aa692d169a3498357d638')
    
      24sha256sums_aarch64=('8bf9a04f31f54deea5312809a62d85e0678b8f404fa7400926cfd4c1dbc57a35')
    
      25
    
      26package() {
    
      27  local _target _dir
    
      28  case "$CARCH" in
    
      29    x86_64)  _target=x86_64-unknown-linux-gnu ;;
    
      30    aarch64) _target=aarch64-unknown-linux-gnu ;;
    
      31    *) error "unsupported architecture: $CARCH" ;;
    
      32  esac
    
      33  _dir="$srcdir/${_pkgname}-${_target}"
    
      34
    
      35  install -Dm755 "$_dir/$_pkgname" "$pkgdir/usr/bin/$_pkgname"
    
      36  install -Dm644 "$_dir/niri-tracker.service" \
    
      37    "$pkgdir/usr/lib/systemd/user/niri-tracker.service"
    
      38  install -Dm644 "$_dir/LICENSE" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      39  install -Dm644 "$_dir/schema.json" "$pkgdir/usr/share/niri-tracker/schema.json"
    
      40
    
      41  # Completions come from the shipped binary, so they match the prebuilt one
    
      42  # rather than whatever the packager happens to have installed.
    
      43  install -d "$srcdir/completions"
    
      44  local shell
    
      45  for shell in bash zsh fish; do
    
      46    "$_dir/$_pkgname" completions "$shell" > "$srcdir/completions/$shell"
    
      47  done
    
      48  install -Dm644 "$srcdir/completions/bash" \
    
      49    "$pkgdir/usr/share/bash-completion/completions/$_pkgname"
    
      50  install -Dm644 "$srcdir/completions/zsh" \
    
      51    "$pkgdir/usr/share/zsh/site-functions/_$_pkgname"
    
      52  install -Dm644 "$srcdir/completions/fish" \
    
      53    "$pkgdir/usr/share/fish/vendor_completions.d/$_pkgname.fish"
    
      54}
    
      55

Changes since previous scan

--- PKGBUILD @ 2026-11-05 10:09
+++ PKGBUILD @ 2026-11-05 12:09
@@ -6,7 +6,7 @@
 
 pkgname=niri-tracker-bin
 _pkgname=niri-tracker
-pkgver=0.1.0
+pkgver=0.1.1
 pkgrel=1
 pkgdesc="Screen time tracking for the niri Wayland compositor (prebuilt binary)"
 arch=('x86_64' 'aarch64')
@@ -20,8 +20,8 @@
 options=('!strip')
 source_x86_64=("$pkgname-$pkgver.tar.gz::${url}/releases/download/v${pkgver}/${_pkgname}-x86_64-unknown-linux-gnu.tar.gz")
 source_aarch64=("$pkgname-$pkgver.tar.gz::${url}/releases/download/v${pkgver}/${_pkgname}-aarch64-unknown-linux-gnu.tar.gz")
-sha256sums_x86_64=('2c1f152039b7e33cb2d8725fa73c9d3e05894b1370752bbec52d8ec1d640c4b3')
-sha256sums_aarch64=('2c1f152039b7e33cb2d8725fa73c9d3e05894b1370752bbec52d8ec1d640c4b3')
+sha256sums_x86_64=('5b0982f99ef70b0d363759d8033f05e95781c533954aa692d169a3498357d638')
+sha256sums_aarch64=('8bf9a04f31f54deea5312809a62d85e0678b8f404fa7400926cfd4c1dbc57a35')
 
 package() {
   local _target _dir

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-05 12:09:09	Low	2
2026-11-05 10:09:05	Low	2