picom-nhktmdzhg-git

LOW

maintainer nanoka 1 votes scanned 2026-09-09 03:18:52.192921

View on AUR

Why flagged

The package builds from a legitimate git fork of picom on GitHub, which is a normal AUR practice; the low severity is due to few votes and recent upload, not malicious content.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from a legitimate git fork of picom on GitHub, which is a normal AUR practice; the low severity is due to few votes and recent upload, not malicious content.

PKGBUILD

      1# Maintainer: WorMzy Tykashi <wormzy.tykashi@gmail.com>
    
      2# Contributor: OK100 <ok100 at lavabit dot com>
    
      3# Contributor: Valère Monseur <valere dot monseur at ymail dot com>
    
      4# Contributor: Nguyen Ky <nhktmdzhg at google mail>
    
      5
    
      6pkgname=picom-nhktmdzhg-git
    
      7_gitname=picom
    
      8pkgver=2858__2026.09.09
    
      9pkgrel=1
    
      10pkgdesc="X compositor (fork of compton) (git-version)"
    
      11arch=(i686 x86_64)
    
      12url="https://github.com/nhktmdzhg/${_gitname}"
    
      13license=('MIT' 'MPL-2.0' 'GPL-3.0-or-later')
    
      14depends=('gcc-libs' 'glibc' 'hicolor-icon-theme' 'libconfig' 'libdbus' 'libepoxy' 'libev' 'libx11'
    
      15'libxcb' 'pcre2' 'pixman' 'xcb-util' 'xcb-util-image' 'xcb-util-renderutil')
    
      16makedepends=('asciidoctor' 'cmake' 'git' 'libglvnd' 'mesa' 'meson' 'uthash' 'xorgproto')
    
      17optdepends=('dbus:          To control picom via D-Bus'
    
      18    'python:        For picom-convgen.py'
    
      19    'xorg-xwininfo: For picom-trans'
    
      20'xorg-xprop:    For picom-trans')
    
      21provides=('compton' 'compton-git' 'picom')
    
      22conflicts=('compton' 'compton-git' 'picom')
    
      23replaces=('compton-git')
    
      24source=(git+"https://github.com/nhktmdzhg/${_gitname}.git#branch=next")
    
      25md5sums=("SKIP")
    
      26
    
      27pkgver() {
    
      28    cd ${_gitname}
    
      29    _tag=$(git describe --tags | sed 's:^v::') # tag is mobile, and switches between numbers and letters, can't use it for versioning
    
      30    _commits=$(git rev-list --count HEAD) # total commits is the most sane way of getting incremental pkgver
    
      31    _date=$(git log -1 --date=short --pretty=format:%cd)
    
      32    printf "%s_%s_%s\n" "${_commits}" "${_tag}" "${_date}" | sed 's/-/./g'
    
      33}
    
      34
    
      35build() {
    
      36    cd "${srcdir}/${_gitname}"
    
      37    meson setup --buildtype=release . build --prefix=/usr -Dwith_docs=true
    
      38    ninja -C build
    
      39}
    
      40
    
      41package() {
    
      42    cd "${srcdir}/${_gitname}"
    
      43    
    
      44    DESTDIR="${pkgdir}" ninja -C build install
    
      45    
    
      46    # install license
    
      47    install -d "${pkgdir}/usr/share/licenses/${pkgname}"
    
      48    cp -r "LICENSES/." "${pkgdir}/usr/share/licenses/${pkgname}/"
    
      49    
    
      50    # example conf
    
      51    install -D -m644 "picom.sample.conf" "${pkgdir}/etc/xdg/picom.conf.example"
    
      52}
    
      53

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-09 03:18:52	Low	2