tuack-gui-git

maintainer Qaaxaap · 0 votes · scanned 2026-08-18 09:39:35.720982

LOW

Why flagged The package builds from a public Git repository with a SKIP'd checksum, but it is a legitimate source build using the project's own code and standard tooling; no remote code execution or malicious payloads are present.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from a public Git repository with a SKIP'd checksum, but it is a legitimate source build using the project's own code and standard tooling; no remote code execution or malicious payloads are present.

PKGBUILD

      1# Maintainer: Tuack-GUI Develop Team
    
      2
    
      3pkgname=tuack-gui-git
    
      4pkgver=1.1.0.alpha.1.14.g68fe7b3
    
      5pkgrel=1
    
      6pkgdesc="美观、跨平台的 Tuack-NG 图形化前端"
    
      7arch=("x86_64")
    
      8url="https://github.com/Qaaxaap/tuack-gui"
    
      9license=("AGPL-3.0-or-later")
    
      10depends=(
    
      11    "gtk3"
    
      12    "webkit2gtk-4.1"
    
      13    "libayatana-appindicator"
    
      14    "typst"
    
      15    "tuack-ng"
    
      16)
    
      17makedepends=(
    
      18    "cargo"
    
      19    "nodejs"
    
      20    "pnpm"
    
      21    "git"
    
      22)
    
      23options=("!lto" "!debug")
    
      24source=(
    
      25    "git+https://github.com/Qaaxaap/tuack-gui.git#branch=main"
    
      26    "tuack-gui.desktop"
    
      27)
    
      28sha256sums=(
    
      29    "SKIP"
    
      30    "cd42b230ea4da37772c2d06f991df71c03b55c9fe6700248830a8bf80f420640"
    
      31)
    
      32
    
      33pkgver() {
    
      34    cd tuack-gui
    
      35    git describe --long --tags --abbrev=7 2>/dev/null | sed 's/^v//; s/-/./g'
    
      36}
    
      37
    
      38prepare() {
    
      39    cd tuack-gui
    
      40    export RUSTUP_TOOLCHAIN=stable
    
      41    # 预取 crates.io 依赖（构建期不再联网拉 Rust 依赖）
    
      42    cargo fetch --locked --manifest-path src-tauri/Cargo.toml --target "$(rustc --print host-tuple)"
    
      43    pnpm install --frozen-lockfile
    
      44}
    
      45
    
      46build() {
    
      47    cd tuack-gui
    
      48    export RUSTUP_TOOLCHAIN=stable
    
      49    # 前端构建 + Rust release 构建；--no-bundle 跳过 deb/AppImage 打包器
    
      50    pnpm tauri build --no-bundle
    
      51}
    
      52
    
      53package() {
    
      54    cd tuack-gui
    
      55
    
      56    install -Dm755 src-tauri/target/release/tuack-gui "$pkgdir/usr/lib/tuack-gui/tuack-gui"
    
      57
    
      58    # 运行时资源：仓库内 assets 是 gitignore 的（CI 时从 tuack-ng 发布包下载），
    
      59    # 这里软链到 tuack-ng 软件包安装的资产目录（tuack-ng-git / tuack-ng-bin 均装到
    
      60    # /usr/share/tuack-ng），应用首次启动会复制到自己的数据目录
    
      61    ln -s /usr/share/tuack-ng "$pkgdir/usr/lib/tuack-gui/assets"
    
      62    ln -s /usr/bin/tuack-ng "$pkgdir/usr/lib/tuack-gui/tuack-ng"
    
      63    ln -s /usr/bin/typst "$pkgdir/usr/lib/tuack-gui/typst"
    
      64
    
      65    install -Dm644 src-tauri/icons/128x128.png "$pkgdir/usr/share/pixmaps/tuack-gui.png"
    
      66    install -Dm644 "$srcdir/tuack-gui.desktop" "$pkgdir/usr/share/applications/tuack-gui.desktop"
    
      67    install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      68}
    
      69

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 09:39:35	LOW	2