shitty-git

maintainer daskol · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from source using git repositories with fixed commits, which is normal for AUR packages; the low severity is due to unverifiable sources from non-whitelisted hosts and SKIP'd checksums, but no malicious behavior is evident.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from source using git repositories with fixed commits, which is normal for AUR packages; the low severity is due to unverifiable sources from non-whitelisted hosts and SKIP'd checksums, but no malicious behavior is evident.

PKGBUILD

      1# Maintainer: Daniel Bershatskit <bepshatsky@yandex.ru>
    
      2
    
      3pkgname=shitty-git
    
      4pkgver=2026.07.28.r0.g042c60f
    
      5pkgrel=1
    
      6pkgdesc='Small, fast Wayland Vulkan-enabled terminal emulator'
    
      7arch=('x86_64' 'aarch64')
    
      8url='https://github.com/pg83/shitty'
    
      9license=('GPL-3.0-or-later' 'MIT')
    
      10depends=(
    
      11  'brotli'
    
      12  'fontconfig'
    
      13  'freetype2'
    
      14  'harfbuzz'
    
      15  'libutf8proc'
    
      16  'libxkbcommon'
    
      17  'simdutf'
    
      18  'vulkan-icd-loader'
    
      19  'wayland'
    
      20  'xxhash'
    
      21)
    
      22makedepends=(
    
      23  'clang'
    
      24  'git'
    
      25  'glslang'
    
      26  'pkgconf'
    
      27  'python'
    
      28  'ragel6'
    
      29  'vulkan-headers'
    
      30)
    
      31conflicts=('shitty')
    
      32provides=('shitty')
    
      33_commit=042c60fc3dfcb84d5a7dfb33c040a38a5eb94c64
    
      34_libstd_commit=6ab662255eb2c459e5e69e13248c964eef5eedc1
    
      35_glfw_commit=a2b295420d899be60c6a27ced21eb172bf51f675
    
      36source=(
    
      37  "$pkgname::git+$url.git#commit=$_commit"
    
      38  "libstd::git+https://github.com/pg83/std.git#commit=$_libstd_commit"
    
      39  "glfw::git+https://github.com/pg83/glfw.git#commit=$_glfw_commit"
    
      40)
    
      41sha256sums=('SKIP' 'SKIP' 'SKIP')
    
      42
    
      43prepare() {
    
      44  cd "$srcdir/$pkgname"
    
      45
    
      46  rm -rf third_party/libstd third_party/glfw
    
      47  install -d third_party
    
      48  cp -a "$srcdir/libstd" third_party/libstd
    
      49  cp -a "$srcdir/glfw" third_party/glfw
    
      50
    
      51  sed -i 's/date.today().strftime("%Y.%m.%d")/"2026.07.28"/' build.py
    
      52}
    
      53
    
      54build() {
    
      55  cd "$srcdir/$pkgname"
    
      56
    
      57  # The bundled libstd uses Clang compiler builtins. It also automatically uses
    
      58  # xxhash when its headers are installed, but does not add its library to the
    
      59  # final link itself.
    
      60  CPPFLAGS+=" -ffile-prefix-map=${srcdir}=/usr/src/debug/${pkgname}"
    
      61  LDFLAGS+=" -lxxhash"
    
      62  CC=clang CXX=clang++ AR=ar python3 ./build -B .build
    
      63}
    
      64
    
      65package() {
    
      66  cd "$srcdir/$pkgname"
    
      67
    
      68  install -Dm755 .build/st "$pkgdir/usr/bin/st"
    
      69  install -Dm644 shitty.desktop "$pkgdir/usr/share/applications/shitty.desktop"
    
      70  install -Dm644 shitty.svg "$pkgdir/usr/share/icons/hicolor/scalable/apps/shitty.svg"
    
      71}
    
      72

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 23:36:42	LOW	2