tanglewire (CLEAN)

Triggered rules

Clean AI review downgraded a static finding llm_review

The static rules flagged this LOW, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it CLEAN (confidence 95%): The package builds from source hosted on the project's own GitHub repository, uses standard Rust build practices, and installs only the resulting binary and associated data files; the low-vote, recent-upload flag is a metadata concern, not a security risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

PKGBUILD

      1# Maintainer: RainOrigami <rain+github@codefreak.net>
    
      2
    
      3pkgname=tanglewire
    
      4pkgver=0.1.2
    
      5pkgrel=1
    
      6pkgdesc="PipeWire patchbay that lays the graph out by itself"
    
      7arch=('x86_64')
    
      8url="https://github.com/RainOrigami/TangleWire"
    
      9license=('Unlicense')
    
      10depends=(
    
      11  'gcc-libs'
    
      12  'glib2'
    
      13  'glibc'
    
      14  'graphene'
    
      15  'gtk4'
    
      16  'hicolor-icon-theme'
    
      17  'libadwaita'
    
      18  'libpipewire'
    
      19  'pango'
    
      20)
    
      21makedepends=('cargo' 'clang')
    
      22source=("$pkgname-$pkgver.tar.gz::$url/archive/refs/tags/v$pkgver.tar.gz")
    
      23sha256sums=('eb97d22e91df8ce8742c065928c34433889ff6a2eb425707cd058b384dfeebd0')
    
      24
    
      25prepare() {
    
      26  cd "TangleWire-$pkgver"
    
      27  export RUSTUP_TOOLCHAIN=stable
    
      28  cargo fetch --locked --target "$(rustc -vV | sed -n 's/host: //p')"
    
      29}
    
      30
    
      31build() {
    
      32  cd "TangleWire-$pkgver"
    
      33  export RUSTUP_TOOLCHAIN=stable
    
      34  export CARGO_TARGET_DIR=target
    
      35  cargo build --frozen --release
    
      36}
    
      37
    
      38check() {
    
      39  cd "TangleWire-$pkgver"
    
      40  export RUSTUP_TOOLCHAIN=stable
    
      41  export CARGO_TARGET_DIR=target
    
      42  cargo test --frozen --release
    
      43}
    
      44
    
      45package() {
    
      46  cd "TangleWire-$pkgver"
    
      47  install -Dm755 target/release/tanglewire "$pkgdir/usr/bin/tanglewire"
    
      48  install -Dm644 data/net.codefreak.TangleWire.desktop \
    
      49    "$pkgdir/usr/share/applications/net.codefreak.TangleWire.desktop"
    
      50  install -Dm644 data/net.codefreak.TangleWire.svg \
    
      51    "$pkgdir/usr/share/icons/hicolor/scalable/apps/net.codefreak.TangleWire.svg"
    
      52  install -Dm644 UNLICENSE "$pkgdir/usr/share/licenses/$pkgname/UNLICENSE"
    
      53  install -Dm644 README.md "$pkgdir/usr/share/doc/$pkgname/README.md"
    
      54}
    
      55

Changes since previous scan

--- PKGBUILD @ 2026-10-14 00:06
+++ PKGBUILD @ 2026-10-22 00:13
@@ -1,7 +1,7 @@
 # Maintainer: RainOrigami <rain+github@codefreak.net>
 
 pkgname=tanglewire
-pkgver=0.1.1
+pkgver=0.1.2
 pkgrel=1
 pkgdesc="PipeWire patchbay that lays the graph out by itself"
 arch=('x86_64')
@@ -20,7 +20,7 @@
 )
 makedepends=('cargo' 'clang')
 source=("$pkgname-$pkgver.tar.gz::$url/archive/refs/tags/v$pkgver.tar.gz")
-sha256sums=('c59cc97f0e5b4abaae07dc1674df4eed54b57153e53ae542dd5ee6bfea669629')
+sha256sums=('eb97d22e91df8ce8742c065928c34433889ff6a2eb425707cd058b384dfeebd0')
 
 prepare() {
   cd "TangleWire-$pkgver"

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-22 00:13:10	Clean	2
2026-10-21 23:33:14	Low	1
2026-10-14 00:06:47	Clean	2
2026-10-13 17:17:20	Low	1