optmem-git

maintainer lapsus · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged Package builds from a legitimate git source with a SKIP'd checksum, but the source is the project's own repository and the build process is transparent, involving only Python scripting to generate a configuration template; no remote code execution or malicious payloads are present.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): Package builds from a legitimate git source with a SKIP'd checksum, but the source is the project's own repository and the build process is transparent, involving only Python scripting to generate a configuration template; no remote code execution or malicious payloads are present.

PKGBUILD

      1# Maintainer: Yakov Till <yakov.till@gmail.com>
    
      2
    
      3# Upstream ships no license file and states no license terms anywhere, so the
    
      4# terms are genuinely unknown rather than merely non-SPDX; 'custom' would imply
    
      5# a license file that does not exist.
    
      6
    
      7pkgname=optmem-git
    
      8pkgver=r37.d618a3a
    
      9pkgrel=2
    
      10_toolpath=/usr/bin/memo
    
      11pkgdesc="Permanent memory for AI agents: an append-only memory store and a 426-token prompt"
    
      12arch=('any')
    
      13url="https://github.com/VictorTaelin/OptMem"
    
      14license=('unknown')
    
      15depends=('python')
    
      16makedepends=('git')
    
      17provides=('optmem')
    
      18conflicts=('optmem')
    
      19source=("${pkgname}::git+${url}.git")
    
      20sha256sums=('SKIP')
    
      21
    
      22pkgver() {
    
      23    cd "${srcdir}/${pkgname}"
    
      24    printf 'r%s.%s' "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
    
      25}
    
      26
    
      27build() {
    
      28    cd "${srcdir}/${pkgname}"
    
      29    # Render upstream's own prompt template against this package's paths, so the
    
      30    # shipped block is what `memo init` prints here rather than the README's copy,
    
      31    # which hardcodes upstream's curl-installer location. A user who overrides
    
      32    # MEMORY_DIR makes the block's data line inaccurate; `memo init` stays correct.
    
      33    python - memo "${_toolpath}" > prompt.md <<'PY'
    
      34import importlib.machinery, importlib.util, sys
    
      35loader = importlib.machinery.SourceFileLoader("optmem_memo", sys.argv[1])
    
      36spec = importlib.util.spec_from_loader(loader.name, loader)
    
      37module = importlib.util.module_from_spec(spec)
    
      38loader.exec_module(module)
    
      39print(module.TEMPLATE.format(memo=sys.argv[2],
    
      40                             data="~/.optmem/memory",
    
      41                             chars=module.ENTRY_CHARS).rstrip())
    
      42PY
    
      43}
    
      44
    
      45check() {
    
      46    cd "${srcdir}/${pkgname}"
    
      47    python test.py
    
      48}
    
      49
    
      50package() {
    
      51    cd "${srcdir}/${pkgname}"
    
      52    install -Dm755 memo "${pkgdir}${_toolpath}"
    
      53    # Not under /usr/share/doc: this is meant to be referenced by a live agent
    
      54    # config, and a builder with !docs in makepkg.conf would strip it from there.
    
      55    install -Dm644 prompt.md "${pkgdir}/usr/share/${pkgname%-git}/prompt.md"
    
      56    install -Dm644 README.md "${pkgdir}/usr/share/doc/${pkgname%-git}/README.md"
    
      57}
    
      58

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 23:33:54	LOW	2