recipe-git

maintainer nmz · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from the project's own git repository, which is normal for AUR packages; the unverifiable checksum and recent re-adoption are minor concerns but do not indicate active malice or supply-chain compromise.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from the project's own git repository, which is normal for AUR packages; the unverifiable checksum and recent re-adoption are minor concerns but do not indicate active malice or supply-chain compromise.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

      1pkgname=recipe-git
    
      2pkgdesc="Capability-driven AOT scheduling and execution for AMD/NVIDIA GPUs"
    
      3pkgver=0.1.1.r444.dabe2a3
    
      4pkgrel=1
    
      5url=https://github.com/nm-z/nates-recipe-rs
    
      6arch=(x86_64)
    
      7license=(MIT)
    
      8provides=("recipe=$pkgver")
    
      9conflicts=(recipe)
    
      10depends=(
    
      11    gcc-libs
    
      12    glibc
    
      13    llvm
    
      14)
    
      15makedepends=(
    
      16    cargo
    
      17    git
    
      18)
    
      19optdepends=(
    
      20    'cuda: NVIDIA PTX assembler'
    
      21    'hsa-rocr: AMD ROCr/HSA runtime'
    
      22    'lld: AMD HSACO linker'
    
      23    'nvidia-utils: NVIDIA CUDA Driver library'
    
      24)
    
      25options=(!debug !lto)
    
      26source=("nates-recipe-rs::git+https://github.com/nm-z/nates-recipe-rs.git#branch=main")
    
      27sha256sums=('SKIP')
    
      28export GIT_LFS_SKIP_SMUDGE=1
    
      29
    
      30pkgver() {
    
      31    cd nates-recipe-rs
    
      32    printf "0.1.1.r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
    
      33}
    
      34
    
      35prepare() {
    
      36    cd nates-recipe-rs
    
      37    # The repository config is tuned for its developer workstation. AUR builds
    
      38    # must use the distribution toolchain instead of requiring clang and mold.
    
      39    rm -f .cargo/config.toml
    
      40}
    
      41
    
      42build() {
    
      43    cd nates-recipe-rs
    
      44    export CARGO_TARGET_DIR="$srcdir/target-pkg"
    
      45    cargo build --release --locked --package recipe --bin recipe
    
      46}
    
      47
    
      48check() {
    
      49    cd nates-recipe-rs
    
      50    export CARGO_TARGET_DIR="$srcdir/target-pkg"
    
      51    # recipe-text's tokenizer corpus is Git LFS data; source-only AUR builds
    
      52    # deliberately skip the multi-gigabyte dataset checkout.
    
      53    cargo test --workspace --exclude recipe-text --locked
    
      54}
    
      55
    
      56package() {
    
      57    local target="$srcdir/target-pkg/release"
    
      58    install -Dm755 "$target/recipe" "$pkgdir/usr/bin/recipe"
    
      59    install -Dm644 "$srcdir/nates-recipe-rs/LICENSE" \
    
      60        "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      61}
    
      62

Changes since previous scan

--- PKGBUILD @ 2026-07-24 00:02
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,46 +1,62 @@
 pkgname=recipe-git
-pkgdesc="WIP DO NOT INSTALL - ML/DL/AI training+inference for AMD/NVIDIA GPUs (fp64)"
-pkgver=0.0.r243.d61b7a1
+pkgdesc="Capability-driven AOT scheduling and execution for AMD/NVIDIA GPUs"
+pkgver=0.1.1.r444.dabe2a3
 pkgrel=1
 url=https://github.com/nm-z/nates-recipe-rs
 arch=(x86_64)
 license=(MIT)
-depends=(rust hip-runtime-amd hipblas hipsolver gcc-libs xz bzip2)
-makedepends=(git perl)
-provides=(recipe)
+provides=("recipe=$pkgver")
 conflicts=(recipe)
+depends=(
+    gcc-libs
+    glibc
+    llvm
+)
+makedepends=(
+    cargo
+    git
+)
+optdepends=(
+    'cuda: NVIDIA PTX assembler'
+    'hsa-rocr: AMD ROCr/HSA runtime'
+    'lld: AMD HSACO linker'
+    'nvidia-utils: NVIDIA CUDA Driver library'
+)
 options=(!debug !lto)
-source=("nates-recipe-rs::git+https://github.com/nm-z/nates-recipe-rs.git")
+source=("nates-recipe-rs::git+https://github.com/nm-z/nates-recipe-rs.git#branch=main")
 sha256sums=('SKIP')
 export GIT_LFS_SKIP_SMUDGE=1
 
 pkgver() {
     cd nates-recipe-rs
-    printf "0.0.r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
+    printf "0.1.1.r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
+}
+
+prepare() {
+    cd nates-recipe-rs
+    # The repository config is tuned for its developer workstation. AUR builds
+    # must use the distribution toolchain instead of requiring clang and mold.
+    rm -f .cargo/config.toml
 }
 
 build() {
-    set -o pipefail
     cd nates-recipe-rs
-    unset RUSTFLAGS DEBUG_RUSTFLAGS CFLAGS CXXFLAGS LDFLAGS
     export CARGO_TARGET_DIR="$srcdir/target-pkg"
-    cargo build --release -p recipe -p gpu-core -p pantry -p recipe-infer -p ogdl \
-        --message-format=json-render-diagnostics \
-        | perl -nle 'while (m{"([^"]+/deps/lib[^"]+\.(?:rlib|so))"}g) { print $1 }' \
-        | sort -u > "$srcdir/deps.files"
+    cargo build --release --locked --package recipe --bin recipe
+}
+
+check() {
+    cd nates-recipe-rs
+    export CARGO_TARGET_DIR="$srcdir/target-pkg"
+    # recipe-text's tokenizer corpus is Git LFS data; source-only AUR builds
+    # deliberately skip the multi-gigabyte dataset checkout.
+    cargo test --workspace --exclude recipe-text --locked
 }
 
 package() {
-    export SOURCE_DATE_EPOCH=$(git -C "$srcdir/nates-recipe-rs" log -1 --format=%ct)
-    local t="$srcdir/target-pkg/release"
-    install -Dm755 "$t/recipe" "$pkgdir/usr/bin/recipe"
-    install -d "$pkgdir/usr/lib/recipe/deps"
-    install -m644 "$t/librecipe.rlib" "$pkgdir/usr/lib/recipe/"
-    install -m644 "$t/libogdl.rlib" "$pkgdir/usr/lib/recipe/"
-    install -m644 "$t/libgpu_core.rlib" "$pkgdir/usr/lib/recipe/"
-    install -m644 "$t/libpantry.rlib" "$pkgdir/usr/lib/recipe/"
-    install -m644 "$t/librecipe_infer.rlib" "$pkgdir/usr/lib/recipe/"
-    xargs -a "$srcdir/deps.files" install -m644 -t "$pkgdir/usr/lib/recipe/deps/"
-    install -Dm644 "$srcdir/nates-recipe-rs/LICENSE" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
+    local target="$srcdir/target-pkg/release"
+    install -Dm755 "$target/recipe" "$pkgdir/usr/bin/recipe"
+    install -Dm644 "$srcdir/nates-recipe-rs/LICENSE" \
+        "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
 }
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 05:27:22	MEDIUM	1
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	3
2026-07-22 00:29:32	LOW	3
2026-07-21 00:24:15	LOW	3
2026-07-20 00:19:49	LOW	3
2026-07-19 00:17:08	LOW	3
2026-07-18 00:14:48	LOW	3
2026-07-17 00:06:16	LOW	3
2026-07-16 00:05:41	LOW	3