shed-sh-git

maintainer cecilerodriguez · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from the project's own Git repository, which is normal for AUR packages; the only concern is a skipped checksum, but the source is verifiably from the official project, reducing risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from the project's own Git repository, which is normal for AUR packages; the only concern is a skipped checksum, but the source is verifiably from the official project, reducing risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

      1# shellcheck shell=bash
    
      2# -*- sh -*-
    
      3
    
      4# Contributor: Klaus Alexander Seiﬆrup <$(echo 0x1fd+d59decfa=40 | tr 0-9+a-f=x ka-i@p-u.l)>
    
      5# Contributor: Kyler Clay <kylerclay@proton.me>
    
      6
    
      7_pkgname=shed-sh
    
      8pkgname="$_pkgname-git"
    
      9pkgdesc='Shell that strives to be POSIX compliant, with a powerful line editor and IPC socket extensibility (development version)'
    
      10pkgver=0.37.2.r1.gea8303b
    
      11pkgrel=1
    
      12url='https://github.com/km-clay/shed'
    
      13install=shed.install
    
      14arch=('aarch64' 'x86_64')
    
      15license=('MIT')
    
      16makedepends=('cargo' 'git')
    
      17depends=('glibc' 'libgcc' 'sqlite')
    
      18optdepends=('python: needed to run the copilot example code')
    
      19provides=(shed{,-sh})
    
      20conflicts=("${provides[@]}")
    
      21source=("git+$url.git")
    
      22sha256sums=('SKIP')
    
      23
    
      24prepare() {
    
      25  cd shed
    
      26
    
      27  sed -i 's/, features = \["bundled"\]//' Cargo.toml
    
      28  export RUSTUP_TOOLCHAIN=stable
    
      29  cargo fetch --target "$(rustc -vV | sed -n 's/host: //p')"
    
      30}
    
      31
    
      32pkgver() {
    
      33  cd shed
    
      34
    
      35  git describe --long --tags | sed 's/^v//;s/\([^-]*-g\)/r\1/;s/-/./g'
    
      36}
    
      37
    
      38build() {
    
      39  cd shed
    
      40
    
      41  export RUSTUP_TOOLCHAIN=stable
    
      42  cargo build --release
    
      43}
    
      44
    
      45check() {
    
      46  cd shed
    
      47
    
      48  target/release/shed --version
    
      49}
    
      50
    
      51package() {
    
      52  cd shed
    
      53
    
      54  install -Dm0755 -t "$pkgdir/usr/bin" \
    
      55    target/release/shed
    
      56  install -Dm0644 -t "$pkgdir/usr/share/doc/$pkgname" \
    
      57    ./*.md
    
      58  install -Dm0644 -t "$pkgdir/usr/share/doc/$pkgname/examples" \
    
      59    examples/*.*
    
      60  install -Dm0644 -t "$pkgdir/usr/share/licenses/$pkgname" \
    
      61    LICENSE
    
      62  # These are hardcoded into the binary, but they might be
    
      63  # nice to have in clear text:
    
      64  install -Dm0644 -t "$pkgdir/usr/share/shed/help" \
    
      65    include/help/*.txt
    
      66
    
      67  for _dir in doc licenses; do
    
      68    pushd "$pkgdir/usr/share/$_dir"
    
      69    ln -sr "$pkgname" "$_pkgname"
    
      70    popd
    
      71  done > /dev/null
    
      72}
    
      73
    
      74# eof
    
      75

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,13 +1,13 @@
 # shellcheck shell=bash
 # -*- sh -*-
 
-#  Maintainer: Klaus Alexander Seiﬆrup <$(echo 0x1fd+d59decfa=40 | tr 0-9+a-f=x ka-i@p-u.l)>
+# Contributor: Klaus Alexander Seiﬆrup <$(echo 0x1fd+d59decfa=40 | tr 0-9+a-f=x ka-i@p-u.l)>
 # Contributor: Kyler Clay <kylerclay@proton.me>
 
 _pkgname=shed-sh
 pkgname="$_pkgname-git"
 pkgdesc='Shell that strives to be POSIX compliant, with a powerful line editor and IPC socket extensibility (development version)'
-pkgver=0.22.0.r2.g866a439
+pkgver=0.37.2.r1.gea8303b
 pkgrel=1
 url='https://github.com/km-clay/shed'
 install=shed.install
@@ -15,6 +15,7 @@
 license=('MIT')
 makedepends=('cargo' 'git')
 depends=('glibc' 'libgcc' 'sqlite')
+optdepends=('python: needed to run the copilot example code')
 provides=(shed{,-sh})
 conflicts=("${provides[@]}")
 source=("git+$url.git")

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 17:15:21	MEDIUM	1
2026-07-18 17:58:54	CLEAN	0
2026-06-18 16:11:54	CLEAN	0