tag-release

LOW

maintainer egor_tensin 0 votes scanned 2026-09-27 15:19:08.759284

View on AUR

Why flagged

The package builds from a source tarball hosted on the project's own GitHub repository; the low severity is due to unverified checksum (SKIP) and few votes, but it installs only a Python script and documentation, with no remote code execution or malicious behavior evident.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from a source tarball hosted on the project's own GitHub repository; the low severity is due to unverified checksum (SKIP) and few votes, but it installs only a Python script and documentation, with no remote code execution or malicious behavior evident.

PKGBUILD

      1# Maintainer: Egor Tensin <egor@tensin.name>
    
      2pkgname=tag-release
    
      3pkgver=0.4.0
    
      4pkgrel=3
    
      5pkgdesc='Script to automate creation of semantic versioning tags'
    
      6arch=(any)
    
      7url="https://github.com/egor-tensin/$pkgname"
    
      8license=(MIT)
    
      9depends=(python)
    
      10source=("$pkgname-$pkgver.tar.gz::$url/archive/v$pkgver.tar.gz")
    
      11md5sums=(SKIP)
    
      12
    
      13package() {
    
      14    cd -- "$srcdir"
    
      15
    
      16    install -D -m 0644 -t "$pkgdir/usr/share/doc/$pkgname" ../README.Arch
    
      17
    
      18    cd -- "$pkgname-$pkgver"
    
      19
    
      20    install -D -m 0644 -t "$pkgdir/usr/share/$pkgname" LICENSE.txt
    
      21    install -D -m 0644 -t "$pkgdir/usr/share/doc/$pkgname" README.md
    
      22    install -D -m 0755 -T src/release.py "$pkgdir/usr/bin/$pkgname"
    
      23}
    
      24

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-27 15:19:08	Low	2
2026-09-27 13:18:29	Low	2