slipmat-git
maintainer SoftARV
· 0 votes
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The package builds from a public Git repository with a SKIP'd checksum, which is normal for -git packages, and includes no remote code execution, malicious payloads, or untrusted prebuilt binaries; the only risk is the typical -git package uncertainty of source freshness and trust in the upstream repo.
Triggered rules
LOW
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
LOW
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from a public Git repository with a SKIP'd checksum, which is normal for -git packages, and includes no remote code execution, malicious payloads, or untrusted prebuilt binaries; the only risk is the typical -git package uncertainty of source freshness and trust in the upstream repo.
PKGBUILD
1
# Maintainer: Miguel Rincon <miguelaezak at gmail dot com>
2
pkgname=slipmat-git
3
_pkgname=slipmat
4
pkgver=0.5.0.r4.gc7bfd67
5
pkgrel=1
6
pkgdesc="A native GNOME client for Apple Music (latest commit)"
7
arch=('x86_64') # Widevine on Linux is x86_64 only
8
url="https://github.com/SoftARV/Slipmat"
9
license=('GPL-3.0-or-later')
10
depends=('gtk4' 'libadwaita' 'librsvg' 'hicolor-icon-theme')
11
makedepends=('cargo' 'nodejs' 'npm' 'git' 'pkgconf')
12
provides=("$_pkgname=$pkgver")
13
conflicts=("$_pkgname")
14
source=("$_pkgname::git+$url.git")
15
sha256sums=('SKIP')
16
options=('!debug' '!lto')
17
18
# The last **tag**, then commits-since-tag and the short hash: `0.4.0.r5.gabc1234`.
19
#
20
# Deliberately *not* Cargo.toml's version, which is what this used to read.
21
# Between releases `main` carries the *next* version as a pre-release —
22
# `0.5.0-dev` — so that scheme produced `0.5.0.dev.rN.gHASH`, and pacman ranks
23
# the extra `.dev` segment as *later* than plain `0.5.0`. A -git build made
24
# before 0.5.0 therefore claimed to be newer than the 0.5.0 release, which made
25
# moving to the `slipmat` package look like a downgrade and let
26
# `provides=slipmat=0.5.0.dev…` satisfy a `slipmat>=0.5.0` it could not honour.
27
#
28
# vercmp 0.5.0.dev.r285.gabc 0.5.0 -> 1 (wrong: -git "newer")
29
# vercmp 0.4.0.r5.gabc 0.5.0 -> -1 (right)
30
# vercmp 0.4.0.r5.gabc 0.4.0 -> 1 (right)
31
#
32
# Needs tags in the clone, which `makepkg` fetches by default.
33
pkgver() {
34
cd "$srcdir/$_pkgname"
35
git describe --long --tags --abbrev=7 | sed 's/^v//;s/\([^-]*-g\)/r\1/;s/-/./g'
36
}
37
38
prepare() {
39
cd "$srcdir/$_pkgname"
40
cargo fetch --locked --target "$(rustc -vV | sed -n 's/host: //p')"
41
# sidecar/.npmrc carries `allow-git=root`; npm 12 refuses git dependencies
42
# without it and castLabs Electron ships only as a GitHub release.
43
cd sidecar
44
npm install --no-audit --no-fund
45
# castLabs ships no postinstall hook — the ~200 MB Chromium is fetched by an
46
# explicit step. Skip it and node_modules is 14 MB with no Electron in it.
47
node node_modules/electron/install.js
48
}
49
50
build() {
51
cd "$srcdir/$_pkgname"
52
export CARGO_TARGET_DIR=target
53
cargo build --release --frozen
54
}
55
56
check() {
57
cd "$srcdir/$_pkgname"
58
cargo test --release --frozen
59
}
60
61
package() {
62
cd "$srcdir/$_pkgname"
63
local appid=dev.miguelrincon.Slipmat
64
65
install -Dm755 target/release/slipmat "$pkgdir/usr/bin/slipmat"
66
67
# Found via XDG_DATA_DIRS by `sidecar::locate`. Read-only: Chromium fetches
68
# the Widevine CDM per-user into ~/.config/Slipmat at first run, so nothing
69
# needs to write inside this directory.
70
install -d "$pkgdir/usr/share/slipmat/sidecar"
71
cp -r sidecar/package.json sidecar/main.js sidecar/preload.js \
72
sidecar/node_modules "$pkgdir/usr/share/slipmat/sidecar/"
73
74
# Prebuilt binaries for architectures this package is not for — 7 MB of
75
# arm64, ia32, darwin and win32 shipped inside one npm dependency. They also
76
# make `strip` complain during packaging, which is how they were noticed.
77
find "$pkgdir/usr/share/slipmat/sidecar" -name '*.node' \
78
! -name '*linux-x64-gnu*' -delete
79
80
install -Dm644 "data/$appid.desktop" \
81
"$pkgdir/usr/share/applications/$appid.desktop"
82
install -Dm644 "data/icons/hicolor/scalable/apps/$appid.svg" \
83
"$pkgdir/usr/share/icons/hicolor/scalable/apps/$appid.svg"
84
install -Dm644 "data/icons/hicolor/symbolic/apps/$appid-symbolic.svg" \
85
"$pkgdir/usr/share/icons/hicolor/symbolic/apps/$appid-symbolic.svg"
86
87
for sz in 16 32 48 64 128 256 512; do
88
install -d "$pkgdir/usr/share/icons/hicolor/${sz}x${sz}/apps"
89
rsvg-convert -w "$sz" -h "$sz" "data/icons/hicolor/scalable/apps/$appid.svg" \
90
-o "$pkgdir/usr/share/icons/hicolor/${sz}x${sz}/apps/$appid.png"
91
done
92
93
install -Dm644 COPYING "$pkgdir/usr/share/licenses/$pkgname/COPYING"
94
install -Dm644 README.md "$pkgdir/usr/share/doc/$pkgname/README.md"
95
}
96
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 2 |
| 2026-08-02 00:16:08 | LOW | 2 |
| 2026-08-01 00:11:18 | LOW | 2 |
| 2026-07-31 00:14:10 | LOW | 2 |
| 2026-07-30 00:17:23 | LOW | 2 |
| 2026-07-29 11:11:22 | LOW | 2 |