pkgforge-git

LOW

maintainer goun7 0 votes scanned 2026-09-09 00:04:09.106193

View on AUR

Why flagged

The package builds from a public git repository with SKIP'd checksum, but it is a development version tracking master; the source is transparent and the build process is standard for Python packages, posing minimal risk.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from a public git repository with SKIP'd checksum, but it is a development version tracking master; the source is transparent and the build process is standard for Python packages, posing minimal risk.

PKGBUILD

      1# Maintainer: goun7 <https://github.com/goun7/pkgforge>
    
      2# AUR development package — tracks master. For the stable release see
    
      3# the PKGBUILD at the repo root (needs a release tag + sha256).
    
      4pkgname=pkgforge-git
    
      5pkgver=2.0.0.r95.gf6e0f74
    
      6pkgrel=1
    
      7pkgdesc="Convert .deb/.rpm packages to Arch Linux with sandbox, SBOM and Tauri desktop (git)"
    
      8arch=('any')
    
      9url="https://github.com/goun7/pkgforge"
    
      10license=('GPL-3.0-or-later')
    
      11depends=(
    
      12    'python'
    
      13    'pacman'
    
      14    'fakeroot'
    
      15    'libarchive'
    
      16)
    
      17makedepends=(
    
      18    'git'
    
      19    'python-build'
    
      20    'python-installer'
    
      21    'python-setuptools'
    
      22    'python-wheel'
    
      23)
    
      24optdepends=(
    
      25    'python-pyqt6: legacy GUI (pkgforge gui, frozen)'
    
      26    'python-fastapi: REST API (pkgforge serve-api)'
    
      27    'python-uvicorn: REST API server'
    
      28    'namcap: Static package analysis'
    
      29    'bubblewrap: Build sandbox isolation'
    
      30    'rpmextract: RPM extraction support'
    
      31    'distrobox: Container fallback support'
    
      32    'clamav: Malware scanning'
    
      33    'trivy: OCI image security scanning'
    
      34    'xdelta3: Binary delta updates'
    
      35    'gnupg: Package signing'
    
      36)
    
      37provides=('pkgforge')
    
      38conflicts=('pkgforge')
    
      39source=("git+https://github.com/goun7/pkgforge.git")
    
      40sha256sums=('SKIP')
    
      41
    
      42pkgver() {
    
      43    cd "$srcdir/pkgforge"
    
      44    git describe --long --tags 2>/dev/null | sed 's/^v//;s/\([^-]*-g\)/r\1/;s/-/./g' \
    
      45        || printf "2.0.0.r%s.g%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
    
      46}
    
      47
    
      48build() {
    
      49    cd "$srcdir/pkgforge"
    
      50    python -m build --wheel --no-isolation
    
      51}
    
      52
    
      53package() {
    
      54    cd "$srcdir/pkgforge"
    
      55    python -m installer --destdir="$pkgdir" dist/*.whl
    
      56
    
      57    # Remove __pycache__ directories (bytecode — unnecessary in packages)
    
      58    find "$pkgdir" -type d -name __pycache__ -exec rm -rf {} + 2>/dev/null || true
    
      59
    
      60    # Desktop entry, icon, metainfo, polkit policy, completions and helper
    
      61    # scripts are shipped by the wheel's data-files and already installed by
    
      62    # `python -m installer` above.
    
      63
    
      64    # Install systemd timer for delta auto-updates
    
      65    if [ -f data/pkgforge-delta.service ]; then
    
      66        install -Dm644 data/pkgforge-delta.service "$pkgdir/usr/lib/systemd/system/pkgforge-delta.service"
    
      67        install -Dm644 data/pkgforge-delta.timer "$pkgdir/usr/lib/systemd/system/pkgforge-delta.timer"
    
      68    fi
    
      69}
    
      70

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-09 00:04:09	Low	2
2026-09-08 17:18:20	Low	2