qt6-topqml-git

LOW

maintainer a_i 0 votes scanned 2026-09-25 07:10:52.990950

View on AUR

Why flagged

The package builds from a git repository hosted on the maintainer's GitHub, which is a normal practice for AUR-git packages; the source is not obfuscated or malicious, and it builds a Qt6/QML module from public source, with no evidence of remote code execution or data exfiltration.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from a git repository hosted on the maintainer's GitHub, which is a normal practice for AUR-git packages; the source is not obfuscated or malicious, and it builds a Qt6/QML module from public source, with no evidence of remote code execution or data exfiltration.

PKGBUILD

      1# Maintainer: Alex Indigo <iam@alexindigo.com>
    
      2
    
      3pkgname=qt6-topqml-git
    
      4_projname=topqml
    
      5_release_ver=0.1.0.r0
    
      6pkgver=0.1.0.r0.g7d39947
    
      7pkgrel=1
    
      8pkgdesc="Qt6/QML module: system monitoring collectors (btop-derived) with QML bindings — git master"
    
      9options=(!debug)
    
      10arch=('x86_64' 'aarch64')
    
      11url="https://github.com/alexindigo/topqml"
    
      12license=('GPL-3.0-or-later')
    
      13depends=('qt6-base' 'qt6-declarative')
    
      14makedepends=('cmake' 'git')
    
      15provides=('qt6-topqml')
    
      16conflicts=('qt6-topqml')
    
      17source=("${pkgname}::git+${url}.git")
    
      18sha256sums=('SKIP')
    
      19
    
      20pkgver() {
    
      21    cd "${srcdir}/${pkgname}"
    
      22    # NOTE: capture describe output explicitly — `git describe ... | sed ...`
    
      23    # masks describe's exit code (sed exits 0 on empty input), so a pipeline
    
      24    # `|| echo fallback` never fires on tagless repos.
    
      25    local out
    
      26    out=$(git describe --long --tags 2>/dev/null) || out=""
    
      27    if [ -n "$out" ]; then
    
      28        printf "%s" "$out" | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/^v//'
    
      29    else
    
      30        echo "${_release_ver}.g$(git rev-parse --short HEAD)"
    
      31    fi
    
      32}
    
      33
    
      34build() {
    
      35    cmake -B build -S "${srcdir}/${pkgname}" \
    
      36        -DCMAKE_BUILD_TYPE=Release \
    
      37        -DCMAKE_SKIP_RPATH=ON \
    
      38        -DCMAKE_INSTALL_PREFIX=/usr
    
      39    cmake --build build
    
      40}
    
      41
    
      42package() {
    
      43    DESTDIR="${pkgdir}" cmake --install build
    
      44}
    
      45

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-25 07:10:52	Low	2