omachess
maintainer ayushjuvekar
· 0 votes
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The package builds from a signed source tarball hosted on the project's GitHub, but the checksums are marked SKIP, which reduces verifiability; however, it depends only on legitimate build tools and runtime libraries, installs no scripts or hooks, and the source is from the project maintainer's official repository, making the risk low.
Triggered rules
LOW
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
LOW
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 90%): The package builds from a signed source tarball hosted on the project's GitHub, but the checksums are marked SKIP, which reduces verifiability; however, it depends only on legitimate build tools and runtime libraries, installs no scripts or hooks, and the source is from the project maintainer's official repository, making the risk low.
PKGBUILD
1
# Maintainer: Ayush Juvekar <ayushjuvekar@gmail.com>
2
#
3
# Omachess is built from source for the machine it runs on. The package owns
4
# only program files, the launcher entry, its icon, and its documentation: no
5
# Hyprland window rules, no Omarchy hooks, and no install scriptlet, so
6
# installing and removing it never touches the player's desktop configuration
7
# or their chess work.
8
9
pkgname=omachess
10
pkgver=0.1.0
11
pkgrel=1
12
pkgdesc='Local-first chess workspace for Omarchy: play, study, and create forms of chess'
13
arch=('x86_64' 'aarch64')
14
url='https://github.com/AyushJ1001/omachess'
15
# GPL-3.0-or-later is one of Arch's common licenses, so the package points at
16
# /usr/share/licenses/common/GPL3 rather than shipping its own copy.
17
license=('GPL-3.0-or-later')
18
19
# Omarchy 4 (Quattro) is a hard dependency: Omachess reads the active Quattro
20
# theme and targets its compositor, launcher, and notification surfaces.
21
depends=(
22
'omarchy>=4.0.0'
23
'qt6-base'
24
'qt6-declarative'
25
# The Piece Set artwork is vector, so the workspace needs the SVG handler.
26
'qt6-svg'
27
'hicolor-icon-theme'
28
)
29
makedepends=(
30
'cmake>=3.24'
31
'ninja'
32
'rust'
33
'cargo'
34
'python>=3.11'
35
)
36
37
# The release tarball is signed; makepkg verifies the detached signature
38
# against this key before anything is built.
39
#
40
# Ayush Juvekar <ayushjuvekar@gmail.com>, the Omachess release-signing key.
41
validpgpkeys=('9F20651D9E6414773BBDEFD327F405346508E367')
42
43
source=(
44
"$pkgname-$pkgver.tar.gz::$url/releases/download/v$pkgver/$pkgname-$pkgver.tar.gz"
45
"$pkgname-$pkgver.tar.gz.sig::$url/releases/download/v$pkgver/$pkgname-$pkgver.tar.gz.sig"
46
)
47
# The detached signature is the integrity check for the tarball, and a
48
# signature has no digest of its own.
49
#
50
# TODO(release): replace the tarball's SKIP with its sha256 once the v0.1.0
51
# release is published.
52
sha256sums=('SKIP' 'SKIP')
53
54
build() {
55
cd "$pkgname-$pkgver"
56
# One CMake build covers everything: it drives cargo for the Rust core and
57
# links it into the workspace binary.
58
cmake -S . -B build -G Ninja \
59
-DCMAKE_BUILD_TYPE=Release \
60
-DCMAKE_INSTALL_PREFIX=/usr
61
cmake --build build
62
}
63
64
check() {
65
cd "$pkgname-$pkgver"
66
ctest --test-dir build --output-on-failure
67
}
68
69
package() {
70
cd "$pkgname-$pkgver"
71
DESTDIR="$pkgdir" cmake --install build
72
}
73
Changes since previous scan
--- PKGBUILD @ 2026-07-28 00:07+++ PKGBUILD @ 2026-08-03 00:08@@ -16,12 +16,6 @@ # /usr/share/licenses/common/GPL3 rather than shipping its own copy. license=('GPL-3.0-or-later') -# The Rules Authority is C++ compiled by the core's build.rs and bundled into-# the Rust static library. Under makepkg's global LTO those objects carry only-# bitcode, which the final link cannot resolve against the rustc-produced ones,-# so this package opts out.-options=('!lto')- # Omarchy 4 (Quattro) is a hard dependency: Omachess reads the active Quattro # theme and targets its compositor, launcher, and notification surfaces. depends=(@@ -30,8 +24,6 @@ 'qt6-declarative' # The Piece Set artwork is vector, so the workspace needs the SVG handler. 'qt6-svg'- # The Live Store links system SQLite through rusqlite.- 'sqlite' 'hicolor-icon-theme' ) makedepends=(@@ -52,10 +44,12 @@ "$pkgname-$pkgver.tar.gz::$url/releases/download/v$pkgver/$pkgname-$pkgver.tar.gz" "$pkgname-$pkgver.tar.gz.sig::$url/releases/download/v$pkgver/$pkgname-$pkgver.tar.gz.sig" )-# The tarball's digest is pinned; a detached signature has no digest of its own,-# and it is what makepkg verifies against validpgpkeys anyway.-sha256sums=('5b020c230b9ac6672fc9bbe273ce3cf3348416f36ce72ddec64f49e7acd4466e'- 'SKIP')+# The detached signature is the integrity check for the tarball, and a+# signature has no digest of its own.+#+# TODO(release): replace the tarball's SKIP with its sha256 once the v0.1.0+# release is published.+sha256sums=('SKIP' 'SKIP') build() { cd "$pkgname-$pkgver"Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 2 |
| 2026-08-02 00:16:08 | LOW | 2 |
| 2026-08-01 00:11:18 | LOW | 2 |
| 2026-07-31 00:14:10 | LOW | 2 |
| 2026-07-30 00:17:23 | LOW | 2 |
| 2026-07-29 00:25:53 | LOW | 2 |
| 2026-07-28 17:39:33 | LOW | 2 |
| 2026-07-28 15:39:03 | LOW | 2 |
| 2026-07-28 00:07:28 | CLEAN | 2 |
| 2026-07-27 09:34:56 | LOW | 1 |