oh-my-pi-grammars-bin
LOW
maintainer bjin
1 votes
scanned 2026-10-17 00:21:55.226236
Why flagged
The package downloads and verifies prebuilt WebAssembly grammars from the project's official GitHub repository using a checksum-pinned manifest, which ensures integrity; the source is not executed but installed as data, and the build process is transparent and reproducible.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Low
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package downloads and verifies prebuilt WebAssembly grammars from the project's official GitHub repository using a checksum-pinned manifest, which ensures integrity; the source is not executed but installed as data, and the build process is transparent and reproducible.
PKGBUILD
1
# Maintainer: Bin Jin <bjin@protonmail.com>
2
3
pkgname=oh-my-pi-grammars-bin
4
_grammar_release=1
5
pkgver=${_grammar_release}
6
pkgrel=1
7
pkgdesc="Prebuilt WebAssembly tree-sitter grammars for oh-my-pi"
8
arch=('any')
9
url="https://github.com/stencil-hq/wasm-grammars"
10
license=('MIT' 'Apache-2.0')
11
# compression.zstd joined the Python standard library in 3.14.
12
makedepends=('python>=3.14')
13
options=('!strip')
14
source=(
15
"manifest-v${_grammar_release}.json::${url}/releases/download/v${_grammar_release}/manifest.json"
16
"THIRD-PARTY-NOTICES-v${_grammar_release}.txt::${url}/releases/download/v${_grammar_release}/THIRD-PARTY-NOTICES.txt"
17
)
18
sha256sums=('3a2539de2f48b28569aa02e4023398a97ad3806e6a7e1891fba3be76a0288a1d'
19
'104b20b8919282e7b559cbe68c55b50bffd18ec0ffeb2f51b9881065ad584c8d')
20
21
prepare() {
22
# The checksum-pinned manifest is the sole registry. Fetch here so
23
# package() is offline; discard old outputs if the manifest changes.
24
rm -rf "${srcdir}/grammars"
25
python - "${srcdir}/manifest-v${_grammar_release}.json" "${_grammar_release}" "${srcdir}/grammars" <<'PY'
26
from compression import zstd
27
import hashlib
28
import json
29
from pathlib import Path
30
import sys
31
from urllib.request import urlopen
32
33
manifest_path, release, destination = sys.argv[1:]
34
with open(manifest_path) as source:
35
manifest = json.load(source)
36
if manifest["release"] != f"v{release}":
37
sys.exit(f"Grammar manifest release mismatch: expected v{release}, got {manifest['release']}")
38
39
base = f"https://github.com/stencil-hq/wasm-grammars/releases/download/{manifest['release']}"
40
destination = Path(destination)
41
destination.mkdir()
42
for grammar in manifest["grammars"]:
43
filename = grammar["file"]
44
print(f"Fetching {manifest['release']}/{filename}.zst", flush=True)
45
with urlopen(f"{base}/{filename}.zst") as response:
46
data = zstd.decompress(response.read())
47
if len(data) != grammar["size"] or hashlib.sha256(data).hexdigest() != grammar["sha256"]:
48
sys.exit(f"Grammar size or SHA-256 mismatch: {filename}")
49
(destination / filename).write_bytes(data)
50
print(f"Verified {len(manifest['grammars'])} grammars from {manifest['release']}")
51
PY
52
}
53
54
package() {
55
install -dm755 "${pkgdir}/usr/share/oh-my-pi/grammars"
56
install -m644 "${srcdir}/grammars/"*.wasm \
57
"${pkgdir}/usr/share/oh-my-pi/grammars/"
58
install -Dm644 "${srcdir}/THIRD-PARTY-NOTICES-v${_grammar_release}.txt" \
59
"${pkgdir}/usr/share/licenses/${pkgname}/THIRD-PARTY-NOTICES.txt"
60
}
61
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |
| 2026-10-14 00:06:47 | Low | 2 |
| 2026-10-13 00:23:45 | Low | 2 |
| 2026-10-12 00:18:51 | Low | 2 |
| 2026-10-11 00:26:05 | Low | 2 |
| 2026-10-10 02:12:41 | Low | 2 |