tidra-git

LOW

maintainer stiermid 0 votes scanned 2026-11-06 12:12:41.156139

View on AUR

Why flagged

The package builds from source via git (plausibly the project's own repository), disables upstream update mechanisms, and installs only the resulting binary, icons, and metadata; the low severity is due to few votes and recent upload, not malicious behavior.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from source via git (plausibly the project's own repository), disables upstream update mechanisms, and installs only the resulting binary, icons, and metadata; the low severity is due to few votes and recent upload, not malicious behavior.

PKGBUILD

      1# Maintainer: Agil Mammadov <mammadovagil@proton.me>
    
      2
    
      3_pkgname=tidra
    
      4pkgname=tidra-git
    
      5pkgver=0.1.6.r0.g606f55d
    
      6pkgrel=1
    
      7pkgdesc="Keep every project you maintain up to date from one desktop app (development)"
    
      8arch=('x86_64' 'aarch64')
    
      9url="https://github.com/yusifaliyevpro/tidra-app"
    
      10license=('AGPL-3.0-or-later')
    
      11depends=(
    
      12    cairo
    
      13    dbus
    
      14    gdk-pixbuf2
    
      15    git
    
      16    glib2
    
      17    glibc
    
      18    gtk3
    
      19    hicolor-icon-theme
    
      20    libappindicator
    
      21    libgcc
    
      22    libsoup3
    
      23    libx11
    
      24    libxi
    
      25    sh
    
      26    util-linux
    
      27    'webkit2gtk-4.1'
    
      28)
    
      29makedepends=(cargo nodejs pnpm)
    
      30optdepends=(
    
      31    'org.freedesktop.secrets: store tokens in the desktop keyring'
    
      32    'nodejs: manage Node.js projects'
    
      33    'npm: manage npm projects'
    
      34    'pnpm: manage pnpm projects'
    
      35    'yarn: manage Yarn projects'
    
      36    'bun: manage Bun projects'
    
      37    'github-cli: import an existing GitHub CLI authentication token'
    
      38)
    
      39provides=("tidra=$pkgver")
    
      40conflicts=('tidra')
    
      41source=("$_pkgname::git+$url.git#branch=main")
    
      42sha256sums=('SKIP')
    
      43# Use upstream's Rust LTO settings instead of makepkg's compiler flags.
    
      44options=('!lto')
    
      45
    
      46pkgver() {
    
      47    cd "$_pkgname"
    
      48    git describe --long --tags --match 'v[0-9]*' | \
    
      49        sed 's/^v//;s/\([^-]*-g\)/r\1/;s/-/./g'
    
      50}
    
      51
    
      52prepare() {
    
      53    cd "$_pkgname"
    
      54
    
      55    # Updates are managed by pacman rather than upstream's installer.
    
      56    node --input-type=module <<'EOF'
    
      57import fs from 'node:fs';
    
      58const file = 'src-tauri/tauri.conf.json';
    
      59const config = JSON.parse(fs.readFileSync(file, 'utf8'));
    
      60config.bundle.createUpdaterArtifacts = false;
    
      61config.plugins.updater.endpoints = [];
    
      62fs.writeFileSync(file, JSON.stringify(config, null, 2) + '\n');
    
      63EOF
    
      64
    
      65    pnpm install --frozen-lockfile
    
      66    cargo fetch --locked --manifest-path src-tauri/Cargo.toml \
    
      67        --target "$(rustc -vV | sed -n 's/host: //p')"
    
      68}
    
      69
    
      70build() {
    
      71    cd "$_pkgname"
    
      72
    
      73    export CARGO_TARGET_DIR="$srcdir/target"
    
      74    export CARGO_PROFILE_RELEASE_STRIP=false
    
      75
    
      76    # Invoke Tauri directly: upstream's build script requires a signing .env.local.
    
      77    pnpm exec tauri build --no-bundle -- --frozen
    
      78}
    
      79
    
      80package() {
    
      81    cd "$_pkgname"
    
      82
    
      83    install -Dm755 "$srcdir/target/release/$_pkgname" "$pkgdir/usr/bin/$_pkgname"
    
      84    install -Dm644 README.md -t "$pkgdir/usr/share/doc/$pkgname/"
    
      85
    
      86    local size
    
      87    for size in 32 64 128; do
    
      88        install -Dm644 "src-tauri/icons/${size}x${size}.png" \
    
      89            "$pkgdir/usr/share/icons/hicolor/${size}x${size}/apps/$_pkgname.png"
    
      90    done
    
      91    install -Dm644 src-tauri/icons/128x128@2x.png \
    
      92        "$pkgdir/usr/share/icons/hicolor/256x256/apps/$_pkgname.png"
    
      93
    
      94    install -dm755 "$pkgdir/usr/share/applications"
    
      95    cat > "$pkgdir/usr/share/applications/$_pkgname.desktop" <<'EOF'
    
      96[Desktop Entry]
    
      97Type=Application
    
      98Name=Tidra
    
      99Comment=Keep every project you maintain up to date
    
      100Exec=tidra
    
      101Icon=tidra
    
      102Terminal=false
    
      103Categories=Development;
    
      104StartupWMClass=tidra
    
      105EOF
    
      106}
    
      107

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-06 12:12:41	Low	2