rayfish

LOW

maintainer robertfoster 0 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

The package builds from source hosted on the project's official GitHub repository, uses locked dependencies, and installs only the resulting binary and supporting files; the orphaned/re-adopted status is a maintenance concern but does not indicate inherent danger.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from source hosted on the project's official GitHub repository, uses locked dependencies, and installs only the resulting binary and supporting files; the orphaned/re-adopted status is a maintenance concern but does not indicate inherent danger.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

      1# Maintainer: robertfoster
    
      2pkgname=rayfish
    
      3pkgver=0.5.9 # renovate: datasource=github-tags depName=rayfish/rayfish
    
      4pkgrel=1
    
      5pkgdesc="P2P mesh VPN powered by iroh"
    
      6arch=('x86_64' 'aarch64')
    
      7url="https://github.com/rayfish/rayfish"
    
      8license=('MPL-2.0')
    
      9depends=('gcc-libs')
    
      10makedepends=('rust' 'cargo')
    
      11options=(!lto)
    
      12source=("${pkgname}-${pkgver}.tar.gz::${url}/archive/v${pkgver}.tar.gz")
    
      13sha256sums=('6c117f89e7bf695862f7c3b205b2a50e2447ec657fecb79fa71bdf9a47b50a25')
    
      14
    
      15prepare() {
    
      16  cd "${pkgname}-${pkgver}"
    
      17  export RUSTUP_TOOLCHAIN=stable
    
      18  cargo fetch --locked --target "$CARCH-unknown-linux-gnu"
    
      19}
    
      20
    
      21build() {
    
      22  cd "${pkgname}-${pkgver}"
    
      23  export RUSTUP_TOOLCHAIN=stable
    
      24  export CARGO_TARGET_DIR=target
    
      25  cargo build --frozen --release
    
      26}
    
      27
    
      28package() {
    
      29  cd "${pkgname}-${pkgver}"
    
      30  install -Dm755 target/release/ray \
    
      31    "${pkgdir}/usr/bin/ray"
    
      32  install -Dm644 contrib/rayfish.service \
    
      33    "${pkgdir}/usr/lib/systemd/system/${pkgname}.service"
    
      34  sed -i 's|/usr/local/bin/ray|/usr/bin/ray|' \
    
      35    "${pkgdir}/usr/lib/systemd/system/${pkgname}.service"
    
      36  install -Dm644 LICENSE \
    
      37    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      38  install -Dm644 README.md \
    
      39    "${pkgdir}/usr/share/doc/${pkgname}/README.md"
    
      40}
    
      41

Changes since previous scan

--- PKGBUILD @ 2026-10-16 00:12
+++ PKGBUILD @ 2026-10-17 00:21
@@ -1,21 +1,41 @@
-# Maintainer: Sebastian Korotkiewicz <skorotkiewicz@gmail.com>
+# Maintainer: robertfoster
 pkgname=rayfish
-pkgver=0.5.2
+pkgver=0.5.9 # renovate: datasource=github-tags depName=rayfish/rayfish
 pkgrel=1
 pkgdesc="P2P mesh VPN powered by iroh"
 arch=('x86_64' 'aarch64')
 url="https://github.com/rayfish/rayfish"
 license=('MPL-2.0')
 depends=('gcc-libs')
-options=(!strip)
+makedepends=('rust' 'cargo')
+options=(!lto)
+source=("${pkgname}-${pkgver}.tar.gz::${url}/archive/v${pkgver}.tar.gz")
+sha256sums=('6c117f89e7bf695862f7c3b205b2a50e2447ec657fecb79fa71bdf9a47b50a25')
 
-source_x86_64=("ray-linux-x86_64-$pkgver::$url/releases/download/v$pkgver/ray-linux-x86_64")
-source_aarch64=("ray-linux-aarch64-$pkgver::$url/releases/download/v$pkgver/ray-linux-aarch64")
+prepare() {
+  cd "${pkgname}-${pkgver}"
+  export RUSTUP_TOOLCHAIN=stable
+  cargo fetch --locked --target "$CARCH-unknown-linux-gnu"
+}
 
-sha256sums_x86_64=('4b85d32c2cff117e4ada6f9af4a954892bd323653db322b8325ca937c209a568')
-sha256sums_aarch64=('8191382473bf3cab91fd999c6b77ea06326f6304a0bf8f4948fc5911b16c1d1b')
+build() {
+  cd "${pkgname}-${pkgver}"
+  export RUSTUP_TOOLCHAIN=stable
+  export CARGO_TARGET_DIR=target
+  cargo build --frozen --release
+}
 
 package() {
-  install -Dm755 "$srcdir/ray-linux-$CARCH-$pkgver" "$pkgdir/usr/bin/ray"
+  cd "${pkgname}-${pkgver}"
+  install -Dm755 target/release/ray \
+    "${pkgdir}/usr/bin/ray"
+  install -Dm644 contrib/rayfish.service \
+    "${pkgdir}/usr/lib/systemd/system/${pkgname}.service"
+  sed -i 's|/usr/local/bin/ray|/usr/bin/ray|' \
+    "${pkgdir}/usr/lib/systemd/system/${pkgname}.service"
+  install -Dm644 LICENSE \
+    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
+  install -Dm644 README.md \
+    "${pkgdir}/usr/share/doc/${pkgname}/README.md"
 }
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Low	2
2026-10-16 11:16:06	Medium	1
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2
2026-10-13 00:23:45	Low	3
2026-10-12 00:18:51	Low	3
2026-10-11 00:26:05	Low	3
2026-10-10 22:16:18	Medium	2
2026-10-10 00:11:52	Low	2
2026-10-09 00:05:33	Low	2
2026-10-08 00:28:03	Low	2
2026-10-07 00:21:34	Low	2
2026-10-05 23:40:58	Low	1
2026-09-26 05:14:08	Clean	0
2026-09-25 05:10:30	Clean	0
2026-09-20 05:32:24	Clean	0
2026-09-17 00:27:14	Clean	0
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2