spitfire

CLEAN

maintainer dani-77 0 votes scanned 2026-09-27 00:07:07.510666

View on AUR

Triggered rules

Clean AI review downgraded a static finding llm_review

The static rules flagged this LOW, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it CLEAN (confidence 95%): The package builds from a publicly available source tarball hosted on the project's own GitHub repository, uses standard Rust build practices, and installs only the project's own compiled binary and license; no untrusted remote code execution or malicious behavior is present.

1 higher static finding superseded - not the current verdict (shown for transparency)

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

PKGBUILD

      1# Maintainer: Daniel Azevedo <daniazevedo77@posteo.net>
    
      2
    
      3pkgname=spitfire
    
      4pkgver=0.5.1
    
      5pkgrel=1
    
      6pkgdesc="Tiling Wayland compositor with a live-reloadable Lua config, in the spirit of dwm"
    
      7arch=('x86_64' 'aarch64')
    
      8url="https://github.com/dani-77/spitfire"
    
      9license=('MIT')
    
      10depends=('wayland' 'libxkbcommon' 'mesa' 'seatd' 'libinput' 'libdisplay-info'
    
      11         'pixman' 'dbus' 'gcc-libs' 'glibc')
    
      12makedepends=('cargo' 'git' 'wayland-protocols')
    
      13optdepends=(
    
      14  'xorg-xwayland: run X11-only apps (XWayland support)'
    
      15  'xdg-desktop-portal: file-open dialogs, notifications and other portal prompts'
    
      16  'iw: wifi widget in the bar'
    
      17  'alacritty: terminal bound to Mod4+Return in the example config'
    
      18  'greetd: use spitfire as a login-screen session'
    
      19)
    
      20backup=('etc/xdg-desktop-portal/spitfire-portals.conf')
    
      21source=("$pkgname-$pkgver.tar.gz::$url/archive/refs/tags/v$pkgver.tar.gz")
    
      22sha256sums=('80e7359690852931cacc2869c7a212d9326c401e239e0caf2737a262839a0d6c')
    
      23
    
      24# Smithay is pinned as a git dependency in Cargo.lock, so prepare() needs
    
      25# network access (hence git in makedepends).
    
      26prepare() {
    
      27    cd "$pkgname-$pkgver"
    
      28    export RUSTUP_TOOLCHAIN=stable
    
      29    cargo fetch --locked --target "$(rustc -vV | sed -n 's/host: //p')"
    
      30}
    
      31
    
      32build() {
    
      33    cd "$pkgname-$pkgver"
    
      34    export RUSTUP_TOOLCHAIN=stable
    
      35    export CARGO_TARGET_DIR=target
    
      36    # Same feature set as the project's own `make install` and the Void
    
      37    # template (make_build_args).
    
      38    cargo build --frozen --release --features udev,xwayland
    
      39}
    
      40
    
      41check() {
    
      42    cd "$pkgname-$pkgver"
    
      43    export RUSTUP_TOOLCHAIN=stable
    
      44    cargo test --frozen --release --features udev,xwayland
    
      45}
    
      46
    
      47package() {
    
      48    cd "$pkgname-$pkgver"
    
      49    # The Makefile's install target depends on build, which is a no-op here
    
      50    # since build() already produced target/release with the same features.
    
      51    make install DESTDIR="$pkgdir" PREFIX=/usr
    
      52    install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      53}
    
      54

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-27 00:07:07	Clean	2
2026-09-26 23:16:08	Low	1