tuicode-bin

LOW

maintainer lucasion 0 votes scanned 2026-10-17 21:19:24.858333

View on AUR

Why flagged

The package installs a prebuilt .pkg.tar.zst from the project's own GitHub releases, which is normal for AUR binary packages; the source is verifiable via checksum and GitHub's infrastructure, posing minimal supply-chain risk.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package installs a prebuilt .pkg.tar.zst from the project's own GitHub releases, which is normal for AUR binary packages; the source is verifiable via checksum and GitHub's infrastructure, posing minimal supply-chain risk.

PKGBUILD

      1# Maintainer: Lucasion <ion@ionnet.dev>
    
      2# Installs the pacman package attached to tuicode's GitHub release.
    
      3pkgname=tuicode-bin
    
      4_pkgname=tuicode
    
      5pkgver=0.2.0
    
      6pkgrel=1
    
      7pkgdesc="A Visual Studio Code style code editor for the terminal, with LSP, git, debugging and an integrated terminal"
    
      8arch=('x86_64' 'aarch64')
    
      9url="https://github.com/LucasionGS/tuicode"
    
      10license=('MIT')
    
      11depends=('glibc')
    
      12optdepends=(
    
      13  'git: source control'
    
      14  'ripgrep: faster find in files'
    
      15  'wl-clipboard: clipboard on Wayland'
    
      16  'xclip: clipboard on X11'
    
      17  'delve: debugging Go'
    
      18  'gdb: debugging C, C++ and Rust'
    
      19  'gopls: Go language server'
    
      20  'typescript-language-server: TypeScript and JavaScript language server'
    
      21)
    
      22provides=("$_pkgname")
    
      23conflicts=("$_pkgname")
    
      24options=('!debug' '!strip')
    
      25source_x86_64=("$_pkgname-$pkgver-x86_64.pkg.tar.zst::$url/releases/download/v$pkgver/$_pkgname-$pkgver-1-x86_64.pkg.tar.zst")
    
      26source_aarch64=("$_pkgname-$pkgver-aarch64.pkg.tar.zst::$url/releases/download/v$pkgver/$_pkgname-$pkgver-1-aarch64.pkg.tar.zst")
    
      27sha256sums_x86_64=('e892b1aec24e3a2441581d4f18f933a0c30023c739f87b61fe57fe009678e8b4')
    
      28sha256sums_aarch64=('777e9636a138fe0b43e66704d923930f478da415361fb574039788e98903a3ab')
    
      29
    
      30package() {
    
      31  # makepkg extracted the release package into $srcdir; take its files, not its pacman metadata
    
      32  cp -a "$srcdir/usr" "$pkgdir/"
    
      33}
    
      34

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 21:19:24	Low	2