podium-git

LOW

maintainer lucasion 0 votes scanned 2026-09-25 13:11:58.025550

View on AUR

Why flagged

The package builds from the project's own git repository, uses frozen lockfile for dependency integrity, and installs only the built Electron app; the 'SKIP' checksum is acceptable for git sources, and all actions are transparent and expected for an AUR package.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from the project's own git repository, uses frozen lockfile for dependency integrity, and installs only the built Electron app; the 'SKIP' checksum is acceptable for git sources, and all actions are transparent and expected for an AUR package.

PKGBUILD

      1# Maintainer: Lucasion <ion@ionnet.dev>
    
      2pkgname=podium-git
    
      3_pkgname=podium
    
      4pkgver=0.1.0.r5.g2f12869
    
      5pkgrel=1
    
      6pkgdesc='Open-source, local-first game clipping: an instant replay buffer, global hotkeys and a clip library'
    
      7arch=('x86_64')
    
      8url='https://github.com/LucasionGS/podium'
    
      9license=('GPL-3.0-or-later')
    
      10# Electron's runtime libraries (as in electron-builder.yml); gpu-screen-recorder does the capturing.
    
      11depends=('gtk3' 'nss' 'libxss' 'libnotify' 'alsa-lib' 'at-spi2-core' 'libxkbcommon' 'mesa' 'libcups'
    
      12  'gpu-screen-recorder')
    
      13makedepends=('git' 'nodejs' 'pnpm' 'libarchive')
    
      14provides=("$_pkgname")
    
      15conflicts=("$_pkgname")
    
      16# Electron ships prebuilt, already-stripped binaries.
    
      17options=('!strip' '!debug')
    
      18source=("$_pkgname::git+https://github.com/LucasionGS/podium.git")
    
      19sha256sums=('SKIP')
    
      20
    
      21pkgver() {
    
      22  cd "$_pkgname"
    
      23  printf '%s.r%s.g%s' "$(node -p 'require("./package.json").version')" \
    
      24    "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
    
      25}
    
      26
    
      27prepare() {
    
      28  cd "$_pkgname"
    
      29  pnpm install --frozen-lockfile
    
      30}
    
      31
    
      32build() {
    
      33  cd "$_pkgname"
    
      34  # A reused source dir may still hold the package of an older version.
    
      35  rm -rf dist
    
      36  pnpm dist:pacman --publish never
    
      37}
    
      38
    
      39package() {
    
      40  cd "$_pkgname"
    
      41  # Install what electron-builder packaged, minus its pacman metadata; this PKGBUILD provides its own.
    
      42  bsdtar -xf dist/*.pacman -C "$pkgdir" --exclude .PKGINFO --exclude .MTREE --exclude .INSTALL --exclude .BUILDINFO
    
      43  # electron-builder's install script creates this link at install time; ship it in the package instead.
    
      44  install -d "$pkgdir/usr/bin"
    
      45  ln -s "/opt/Podium/$_pkgname" "$pkgdir/usr/bin/$_pkgname"
    
      46}
    
      47

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-25 13:11:58	Low	2