schemasmith-bin

maintainer schemasmith · 0 votes · scanned 2026-08-18 00:03:42.021799

LOW

Why flagged Package builds from official GitHub releases, uses self-contained .NET binaries with proper checksums for executables; the only concern is a SKIP'd checksum for the LICENSE file, which is non-executable data and poses no real risk.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 90%): Package builds from official GitHub releases, uses self-contained .NET binaries with proper checksums for executables; the only concern is a SKIP'd checksum for the LICENSE file, which is non-executable data and poses no real risk.

PKGBUILD

      1# Maintainer: SchemaSmith Contributors <support@schemasmith.com>
    
      2# Version and the two linux tarball SHA-256s are filled in by packaging/aur/render.sh at release time.
    
      3pkgname=schemasmith-bin
    
      4pkgver=2.4.0
    
      5pkgrel=1
    
      6pkgdesc='State-based database schema deployment for SQL Server, PostgreSQL, MySQL and MariaDB (CLI tools)'
    
      7arch=('x86_64' 'aarch64')
    
      8url='https://github.com/Schema-Smith/SchemaSmith'
    
      9license=('custom:SSCL-2.0')
    
      10provides=('schemasmith' 'schemaquench' 'schematongs' 'datatongs' 'schemashears')
    
      11conflicts=('schemasmith')
    
      12# Self-contained single-file .NET binaries with bundled ICU — do not strip or scan .so deps.
    
      13options=('!strip' '!debug')
    
      14_icuver=72.1.0.3
    
      15source_x86_64=("SchemaSmith-${pkgver}-linux-x64.tar.gz::${url}/releases/download/v${pkgver}/SchemaSmith-${pkgver}-linux-x64.tar.gz")
    
      16source_aarch64=("SchemaSmith-${pkgver}-linux-arm64.tar.gz::${url}/releases/download/v${pkgver}/SchemaSmith-${pkgver}-linux-arm64.tar.gz")
    
      17source=("LICENSE-${pkgver}::${url}/raw/v${pkgver}/LICENSE")
    
      18sha256sums=('SKIP')
    
      19sha256sums_x86_64=('5ca517a2c0347c0845c0df0541948db7b63fdea302a9e8299a5f832481dafe9c')
    
      20sha256sums_aarch64=('def8f9b5fcea7561feaae63a11d3325fa912627b5689d7de8fc553335e442f82')
    
      21
    
      22package() {
    
      23  install -dm755 "${pkgdir}/usr/lib/schemasmith" "${pkgdir}/usr/bin"
    
      24
    
      25  local tool lc
    
      26  for tool in SchemaQuench SchemaTongs DataTongs SchemaShears; do
    
      27    lc="${tool,,}"
    
      28    install -Dm755 "${srcdir}/${tool}" "${pkgdir}/usr/lib/schemasmith/${lc}"
    
      29    ln -s "/usr/lib/schemasmith/${lc}" "${pkgdir}/usr/bin/${lc}"
    
      30  done
    
      31
    
      32  # ICU libraries the self-contained binaries load from their own directory.
    
      33  install -m644 "${srcdir}"/libicu*.so.* -t "${pkgdir}/usr/lib/schemasmith/"
    
      34
    
      35  install -Dm644 "${srcdir}/LICENSE-${pkgver}" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      36}
    
      37

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	LOW	2
2026-08-17 00:18:29	LOW	2
2026-08-16 00:03:42	LOW	2
2026-08-15 00:26:13	LOW	2
2026-08-14 15:29:17	LOW	2