over-bin
LOW
maintainer noirbizarre
0 votes
scanned 2026-10-22 11:34:35.240931
Why flagged
The package installs a prebuilt binary from the project's official GitHub releases, which is a normal practice for AUR packages; the binary is not executed during build, and the source is verifiable via checksums, making the risk low despite the untrusted host heuristic trigger.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Low
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 90%): The package installs a prebuilt binary from the project's official GitHub releases, which is a normal practice for AUR packages; the binary is not executed during build, and the source is verifiable via checksums, making the risk low despite the untrusted host heuristic trigger.
PKGBUILD
1
# Maintainer: Axel H. <noirbizarre@gmail.com>
2
#
3
# Prebuilt binary package. `0.1.0`, `becbbea3191cd3d5a15e8dd282327ede74ddf417807a8400b2233313182fbdbb` and
4
# `99013719efa87fbfb199bf7076203c0edea88981ab9d1c42e7848299592cc24e` are substituted by .github/workflows/aur.yaml from the
5
# published release assets, and the result is pushed to the AUR. Edit this
6
# template, never the PKGBUILD in the AUR repository: that one is
7
# regenerated at every release.
8
9
pkgname=over-bin
10
_pkgname=over
11
pkgver=0.1.0
12
pkgrel=1
13
pkgdesc="A git-based file overlay manager (dotfiles as overlays) (prebuilt binary)"
14
arch=('x86_64' 'aarch64')
15
url="https://github.com/noirbizarre/over"
16
license=('MIT')
17
18
# What the published binaries actually link. libgit2 and OpenSSL are
19
# vendored into them, so they are absent here — but zlib and libgcc_s are
20
# not, and namcap reports an error for every needed library left undeclared.
21
depends=('gcc-libs' 'glibc' 'zlib')
22
23
provides=("$_pkgname=$pkgver")
24
conflicts=("$_pkgname")
25
26
# !strip because the release profile already sets `strip = true`, and !debug
27
# for the same reason: there is no debug data left to split into a -debug
28
# package, so building one would produce an empty package and a namcap
29
# warning.
30
options=('!strip' '!debug')
31
32
# The `gnu` archives, not `musl`: an AUR package targets Arch's own glibc,
33
# and the musl build exists for the systems that are not this one.
34
source_x86_64=("$pkgname-$pkgver-x86_64.tar.gz::$url/releases/download/$pkgver/over_${pkgver}_linux-amd64.tar.gz")
35
source_aarch64=("$pkgname-$pkgver-aarch64.tar.gz::$url/releases/download/$pkgver/over_${pkgver}_linux-arm64.tar.gz")
36
sha256sums_x86_64=('becbbea3191cd3d5a15e8dd282327ede74ddf417807a8400b2233313182fbdbb')
37
sha256sums_aarch64=('99013719efa87fbfb199bf7076203c0edea88981ab9d1c42e7848299592cc24e')
38
39
# Fetched separately because the release archive carries no licence file, and
40
# MIT is not one of the licences Arch keeps in /usr/share/licenses/common —
41
# so the package has to install the file itself.
42
source=("LICENSE-$pkgver::$url/raw/$pkgver/LICENSE")
43
sha256sums=('579ef5ffa922ce743ad6dd7ec4538389c7f66a2b945b7d6284e5b3ec04da156e')
44
45
package() {
46
# The archive holds `over` at its root, named exactly that.
47
install -Dm755 "$srcdir/over" "$pkgdir/usr/bin/over"
48
install -Dm644 "$srcdir/LICENSE-$pkgver" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
49
50
# Generated by running the extracted binary itself, so the completions
51
# cannot describe flags this build does not have.
52
"$srcdir/over" completion bash |
53
install -Dm644 /dev/stdin "$pkgdir/usr/share/bash-completion/completions/over"
54
"$srcdir/over" completion zsh |
55
install -Dm644 /dev/stdin "$pkgdir/usr/share/zsh/site-functions/_over"
56
"$srcdir/over" completion fish |
57
install -Dm644 /dev/stdin "$pkgdir/usr/share/fish/vendor_completions.d/over.fish"
58
}
59
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-22 11:34:35 | Low | 2 |