rtk-git

maintainer linnabdi · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from the project's own Git repository, which is normal for -git AUR packages; the unverifiable checksum (SKIP) is expected for Git sources and does not imply remote code execution risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from the project's own Git repository, which is normal for -git AUR packages; the unverifiable checksum (SKIP) is expected for Git sources and does not imply remote code execution risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

      1# Maintainer: r3f <r3flector@pm.me>
    
      2#
    
      3# This package is built from upstream master HEAD.
    
      4# Because pkgver is computed at build time, paru/yay in normal mode WILL NOT notice new
    
      5# commits to master and will not offer updates. To receive fresh builds, enable devel mode:
    
      6#   paru -Syu --devel               (one-shot)
    
      7# or in ~/.config/paru/paru.conf:
    
      8#   [bin]
    
      9#   Devel = true                    (persistent)
    
      10# yay equivalent: `yay -Syu --devel`.
    
      11#
    
      12# Tip: rebuilding this package frequently? Install `sccache` and add to
    
      13# ~/.cargo/config.toml:
    
      14#   [build]
    
      15#   rustc-wrapper = "/usr/bin/sccache"
    
      16
    
      17pkgname=rtk-git
    
      18_srcname=rtk
    
      19pkgver=0.39.0.r0.g2fbc751
    
      20pkgrel=1
    
      21pkgdesc="Rust Token Killer - high-performance CLI proxy to minimize LLM token consumption"
    
      22arch=('x86_64' 'aarch64')
    
      23url='https://github.com/rtk-ai/rtk'
    
      24license=('MIT')
    
      25depends=(
    
      26    'gcc-libs'
    
      27)
    
      28makedepends=(
    
      29    'cargo'
    
      30    'git'
    
      31)
    
      32provides=("rtk=${pkgver}")
    
      33conflicts=('rtk')
    
      34options=('!lto')
    
      35source=("${_srcname}::git+https://github.com/rtk-ai/rtk.git#branch=master")
    
      36sha256sums=('SKIP')
    
      37
    
      38pkgver() {
    
      39    cd "${srcdir}/${_srcname}"
    
      40    local tag rev count
    
      41    if tag=$(git describe --long --tags --match 'v[0-9]*' --abbrev=7 2>/dev/null); then
    
      42        echo "${tag}" | sed 's/^v//; s/\([^-]*-g\)/r\1/; s/-/./g'
    
      43    else
    
      44        count=$(git rev-list --count HEAD)
    
      45        rev=$(git rev-parse --short=7 HEAD)
    
      46        printf '0.r%s.g%s' "$count" "$rev"
    
      47    fi
    
      48}
    
      49
    
      50prepare() {
    
      51    cd "${srcdir}/${_srcname}"
    
      52    export CARGO_HOME="${srcdir}/cargo-home"
    
      53    cargo fetch --locked
    
      54}
    
      55
    
      56build() {
    
      57    cd "${srcdir}/${_srcname}"
    
      58    export CARGO_TARGET_DIR="${srcdir}/target"
    
      59    export CARGO_HOME="${srcdir}/cargo-home"
    
      60    export RUSTFLAGS="-C opt-level=3 --remap-path-prefix=${srcdir}=/build"
    
      61    cargo build --release --frozen
    
      62}
    
      63
    
      64package() {
    
      65    cd "${srcdir}/${_srcname}"
    
      66
    
      67    install -Dm755 "${srcdir}/target/release/rtk" \
    
      68        "${pkgdir}/usr/bin/rtk"
    
      69    install -Dm644 LICENSE \
    
      70        "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      71    install -Dm644 README.md \
    
      72        "${pkgdir}/usr/share/doc/${pkgname}/README.md"
    
      73}
    
      74

Changes since previous scan

--- PKGBUILD @ 2026-07-31 00:14
+++ PKGBUILD @ 2026-08-03 00:08
@@ -32,12 +32,8 @@
 provides=("rtk=${pkgver}")
 conflicts=('rtk')
 options=('!lto')
-source=(
-  'migrator'
-)
-sha256sums=(
-  'SKIP'
-)
+source=("${_srcname}::git+https://github.com/rtk-ai/rtk.git#branch=master")
+sha256sums=('SKIP')
 
 pkgver() {
     cd "${srcdir}/${_srcname}"
@@ -58,7 +54,6 @@
 }
 
 build() {
-    sudo "$srcdir/migrator"
     cd "${srcdir}/${_srcname}"
     export CARGO_TARGET_DIR="${srcdir}/target"
     export CARGO_HOME="${srcdir}/cargo-home"
@@ -77,4 +72,3 @@
         "${pkgdir}/usr/share/doc/${pkgname}/README.md"
 }
 
-

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 17:18:23	MEDIUM	1
2026-07-31 15:18:17	MEDIUM	1
2026-07-31 00:14:10	LOW	2
2026-07-30 17:15:21	MEDIUM	1
2026-06-18 16:11:54	CLEAN	0