steve-git

LOW

maintainer wjhandley 0 votes scanned 2026-10-25 03:41:34.818471

View on AUR

Why flagged

The package builds from a public git repository and downloads prebuilt V8 artifacts via a Python script, but the download is handled by the project's own verified tooling and used as a library; no untrusted remote code execution or obfuscated payloads are present.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from a public git repository and downloads prebuilt V8 artifacts via a Python script, but the download is handled by the project's own verified tooling and used as a library; no untrusted remote code execution or obfuscated payloads are present.

PKGBUILD

      1# Maintainer: Will Handley <wh260@cam.ac.uk> (aur.archlinux.org/account/wjhandley)
    
      2pkgname=steve-git
    
      3pkgver=r12355.8b9fbef1dc
    
      4pkgrel=1
    
      5pkgdesc="Steve: a coding agent for the terminal, forked from OpenAI Codex, for self-hosted and non-OpenAI model providers"
    
      6arch=(x86_64 aarch64)
    
      7url="https://github.com/handley-lab/steve"
    
      8license=(Apache-2.0)
    
      9depends=(gcc-libs glibc openssl zlib xz bzip2 brotli zstd libcap pcre2)
    
      10makedepends=(git rust python clang cmake pkgconf ripgrep)
    
      11optdepends=('bubblewrap: system sandbox helper, preferred over the bundled one')
    
      12provides=("${pkgname%-git}")
    
      13conflicts=("${pkgname%-git}")
    
      14options=(!lto !debug)
    
      15source=("${pkgname%-git}::git+$url.git")
    
      16sha256sums=('SKIP')
    
      17
    
      18_target() {
    
      19	rustc -vV | sed -n 's/^host: //p'
    
      20}
    
      21
    
      22pkgver() {
    
      23	cd "$srcdir/${pkgname%-git}"
    
      24	printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=10 HEAD)"
    
      25}
    
      26
    
      27prepare() {
    
      28	cd "$srcdir/${pkgname%-git}"
    
      29	cargo fetch --locked --target "$(_target)" --manifest-path codex-rs/Cargo.toml
    
      30	# Steve links Codex's prebuilt V8, downloaded and checksum-verified by its own helper.
    
      31	STEVE_REPO_ROOT="$PWD" PYTHONPATH="$PWD/scripts" python - "$(_target)" "$srcdir/v8" <<'EOF'
    
      32import sys
    
      33from pathlib import Path
    
      34from codex_package.targets import TARGET_SPECS
    
      35from codex_package.v8 import fetch_codex_v8_artifacts
    
      36artifacts = fetch_codex_v8_artifacts(TARGET_SPECS[sys.argv[1]], cache_root=Path(sys.argv[2]))
    
      37Path(sys.argv[2], "env").write_text(
    
      38    f"RUSTY_V8_ARCHIVE={artifacts.archive}\nRUSTY_V8_SRC_BINDING_PATH={artifacts.binding}\n")
    
      39EOF
    
      40}
    
      41
    
      42build() {
    
      43	cd "$srcdir/${pkgname%-git}"
    
      44	set -a
    
      45	. "$srcdir/v8/env"
    
      46	set +a
    
      47	export STEVE_REPO_ROOT="$PWD" PYTHONPATH="$PWD/scripts"
    
      48	export CARGO_TARGET_DIR="$srcdir/target" CARGO_NET_OFFLINE=true
    
      49	export STABLE_GIT_COMMIT="$(git rev-parse HEAD)"
    
      50	python scripts/build_codex_package.py \
    
      51		--target "$(_target)" --variant steve --cargo-profile release \
    
      52		--package-version "0.0.0+g$(git rev-parse --short=10 HEAD)" --rg-bin /usr/bin/rg \
    
      53		--package-dir "$srcdir/package" --force
    
      54}
    
      55
    
      56package() {
    
      57	cd "$srcdir/${pkgname%-git}"
    
      58	install -dm755 "$pkgdir/usr/lib" "$pkgdir/usr/bin"
    
      59	cp -a "$srcdir/package" "$pkgdir/usr/lib/steve"
    
      60	ln -s ../lib/steve/bin/steve "$pkgdir/usr/bin/steve"
    
      61	install -Dm644 LICENSE NOTICE -t "$pkgdir/usr/share/licenses/$pkgname"
    
      62}
    
      63

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-25 03:41:34	Low	2