vgshell-git

LOW

maintainer vanillagreen 0 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

The package builds from the project's own Git repository, has no unverifiable binaries or remote code execution, and the flagged low votes/recent upload relate to popularity, not security risk.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from the project's own Git repository, has no unverifiable binaries or remote code execution, and the flagged low votes/recent upload relate to popularity, not security risk.

PKGBUILD

      1# Maintainer: VanillaGreen <brad@vanillagreen.com>
    
      2#
    
      3# The development package, built from main. docs/architecture/distribution.md
    
      4# states the rules scripts/check-packaging.js enforces on
    
      5# this file and on ../vgshell/PKGBUILD. makepkg rewrites pkgver from pkgver().
    
      6
    
      7pkgname=vgshell-git
    
      8pkgver=0.1.0
    
      9pkgrel=1
    
      10pkgdesc='Desktop shell for Hyprland, built on Quickshell (development version)'
    
      11arch=('any')
    
      12url='https://github.com/vanillagreencom/vgshell'
    
      13license=('MIT AND OFL-1.1 AND ISC AND Apache-2.0 AND CC-BY-SA-4.0')
    
      14depends=(
    
'quickshell>=0.3.1'
    
'hyprland>=0.56'
    
'bash'
    
'coreutils'
    
'util-linux'
    
'nodejs>=18'
    
'python'
    
'libxkbcommon'
    
'xkeyboard-config'
    
'git'
    
'agent-browser-bin'
    
'bubblewrap'
    
'chromium'
    
'curl'
    
'dbus'
    
'fd'
    
'ffmpeg'
    
'file'
    
'fontconfig'
    
'fzf'
    
'gawk'
    
'glib2'
    
'gpu-screen-recorder'
    
'grim'
    
'gum'
    
'hyprpicker'
    
'imagemagick'
    
'iproute2'
    
'less'
    
'libnotify'
    
'power-profiles-daemon'
    
'libpulse'
    
'libsecret'
    
'mise'
    
'networkmanager'
    
'pacman-contrib'
    
'pipewire'
    
'pipewire-audio'
    
'playerctl'
    
'qrencode'
    
'rclone'
    
'sed'
    
'slurp'
    
'systemd'
    
'tesseract'
    
'tesseract-data-eng'
    
'uv'
    
'vsys'
    
'wireplumber'
    
'wl-clipboard'
    
'wlrctl'
    
'wtype'
    
'xdg-desktop-portal-gnome'
    
'xdg-desktop-portal-gtk'
    
'xdg-desktop-portal-hyprland'
    
'xdg-terminal-exec'
    
'xdg-utils'
    
      72)
    
      73optdepends=(
    
'ttfx: animates the Screensaver text art'
    
'bandwhich: See all network traffic in the Network Traffic plugin'
    
'libcap: check and allow traffic capture in the Network Traffic plugin'
    
'btop: all processes and system readings from the System monitor panel'
    
'claude-code: sign in to Claude Code and use its account as the Jarvis AI model'
    
'openai-codex: sign in to Codex and use its account as the Jarvis AI model'
    
'voxtype-bin: Voice dictation engine'
    
'tmux: several Jarvis coding tasks at once'
    
'kendex-bin: the mail tool Jarvis hands a request for your agent fleet with'
    
'ydotool: Jarvis pointer fallback with an already running input service'
    
'bluez-utils: bluetoothctl, the Bluetooth pairing agent that answers pairing prompts'
    
'snapper: a snapshot before the update pipeline changes packages'
    
'timeshift: a snapshot before the update pipeline changes packages, without snapper'
    
'sudo: package installs and the browser policy writer in floating TUIs'
    
'nvidia-utils: verifies a selected Jarvis CUDA local voice tier'
    
'ddcutil: brightness of external displays in the Displays plugin'
    
'brightnessctl: brightness of a laptop built-in display in the Displays plugin'
    
'cronie: crontab, which schedules automations where no systemd user manager answers'
    
'greetd: the login screen at boot'
    
'uwsm: the Hyprland (uwsm-managed) session the login screen starts first'
    
'xorg-xinit: startx, for X11 sessions on the login screen'
    
'glibc: getent, the accounts on the login screen'
    
'polkit: pkexec, so applications can ask for administrator access'
    
'tailscale: the Tailscale connection in the VPN plugin'
    
'cups: lpstat and ipptool, which list your printers and their changes in the Printers plugin'
    
'cups-pk-helper: adds, removes and sets the default printer in the Printers plugin'
    
'system-config-printer: Print Settings, for drivers, paper size and quality in the Printers plugin'
    
'imv: opens a saved screenshot from its Capture notification'
    
'satty: edits a saved screenshot from its Capture notification'
    
'mpv: plays a saved recording from its Capture notification'
    
'google-chrome: opens a calendar day in a Google Chrome profile'
    
'brave-bin: opens a calendar day in a Brave profile'
    
'vivaldi: opens a calendar day in a Vivaldi profile'
    
'microsoft-edge-stable-bin: opens a calendar day in a Microsoft Edge profile'
    
      108)
    
      109makedepends=('git')
    
      110install=vgshell-git.install
    
      111
    
      112# No git+ source: makepkg clones one as a mirror of every ref the remote
    
      113# advertises, and GitHub's refs/pull/* still reach the history main no
    
      114# longer holds. This clone takes main alone, with every commit and tree but
    
      115# only the file contents its checkout needs, so pkgver() counts the commits
    
      116# a full clone counts. Tags pointing into main come with it, for the
    
      117# release version pkgver() names.
    
      118prepare() {
    
rm -rf -- "$srcdir/vgshell"
    
git clone --filter=blob:none --single-branch --branch main -- "$url.git" "$srcdir/vgshell"
    
      121}
    
      122
    
      123# The tree's own version judge names the version, so the package and
    
      124# `vgshell --version` in the checkout print the same X.Y.Z.r<N>.g<hash>.
    
      125pkgver() {
    
local out
    
cd "$srcdir/vgshell"
    
out="$(./bin/vgshell --version)" || return 1
    
out="${out#vgshell }"
    
if [[ ! $out =~ ^[0-9]+\.[0-9]+\.[0-9]+\.r[0-9]+\.g[0-9a-f]+$ ]]; then
    
  printf 'vgshell-git: refused: pkgver=%s\n' "$out" >&2
    
  return 1
    
fi
    
printf '%s\n' "$out"
    
      135}
    
      136
    
      137package() {
    
cd "$srcdir/vgshell"
    
DESTDIR="$pkgdir" PREFIX=/usr SYSCONFDIR=/etc ./packaging/install-system.sh
    
      140}
    
      141

Changes since previous scan

--- PKGBUILD @ 2026-10-14 05:19
+++ PKGBUILD @ 2026-10-17 00:21
@@ -58,7 +58,6 @@
   'systemd'
   'tesseract'
   'tesseract-data-eng'
-  'ttfx'
   'uv'
   'vsys'
   'wireplumber'
@@ -72,6 +71,7 @@
   'xdg-utils'
 )
 optdepends=(
+  'ttfx: animates the Screensaver text art'
   'bandwhich: See all network traffic in the Network Traffic plugin'
   'libcap: check and allow traffic capture in the Network Traffic plugin'
   'btop: all processes and system readings from the System monitor panel'

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 13:20:15	Low	2
2026-10-14 05:19:21	Low	1
2026-10-06 00:13:36	Clean	2
2026-10-05 23:40:58	Low	1