vosulay

LOW

maintainer k4zoku 0 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

The package builds from source via git using a tagged release, has legitimate build dependencies, and installs only compiled artifacts and static assets; the low severity is due to SKIP'd checksum and few votes, but no evidence of malicious behavior.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from source via git using a tagged release, has legitimate build dependencies, and installs only compiled artifacts and static assets; the low severity is due to SKIP'd checksum and few votes, but no evidence of malicious behavior.

PKGBUILD

      1# Maintainer: Kazoku <k4zoku@pm.me>
    
      2# Contributor: sxlvia <qt715 at proton dot me>
    
      3
    
      4_pkgbase=vosulay
    
      5pkgname=${_pkgbase}
    
      6pkgver=1.2.1
    
      7pkgrel=1
    
      8pkgdesc='In-game overlay for vosu and tosu-compatible counters'
    
      9arch=('x86_64')
    
      10url='https://github.com/shiruviaa/vosulay'
    
      11license=('MIT' 'BSD-3-Clause' 'CC-BY-4.0')
    
      12depends=(
    
      13    'alsa-lib'
    
      14    'at-spi2-core'
    
      15    'cairo'
    
      16    'dbus'
    
      17    'expat'
    
      18    'glib2'
    
      19    'libcups'
    
      20    'libx11'
    
      21    'libxcb'
    
      22    'libxcomposite'
    
      23    'libxdamage'
    
      24    'libxext'
    
      25    'libxfixes'
    
      26    'libxkbcommon'
    
      27    'libxrandr'
    
      28    'mesa'
    
      29    'nspr'
    
      30    'nss'
    
      31    'pango'
    
      32    'systemd-libs'
    
      33    'wayland'
    
      34    'hicolor-icon-theme'
    
      35)
    
      36makedepends=('git' 'cargo')
    
      37options=('!lto' '!strip' '!debug')
    
      38source=("${_pkgbase}::git+${url}.git#tag=v${pkgver}")
    
      39sha256sums=('SKIP')
    
      40
    
      41_toolchain() {
    
      42    sed -n 's/^channel *= *"\(.*\)"/\1/p' "${srcdir}/${_pkgbase}/rust-toolchain.toml"
    
      43}
    
      44
    
      45prepare() {
    
      46    cd "${_pkgbase}"
    
      47    RUSTUP_TOOLCHAIN="$(_toolchain)"
    
      48    export RUSTUP_TOOLCHAIN
    
      49    if command -v rustup >/dev/null; then
    
      50        rustup toolchain install "$RUSTUP_TOOLCHAIN" --profile minimal
    
      51    fi
    
      52    cargo fetch --locked --target "$CARCH-unknown-linux-gnu"
    
      53}
    
      54
    
      55build() {
    
      56    cd "${_pkgbase}"
    
      57    export XDG_CACHE_HOME="${srcdir}/cache"
    
      58    RUSTUP_TOOLCHAIN="$(_toolchain)"
    
      59    export RUSTUP_TOOLCHAIN
    
      60    export CARGO_TARGET_DIR=target
    
      61    export VOSULAY_PACKAGE_BUILD=1
    
      62    cargo build --frozen --release -p vosulay
    
      63    cargo build --frozen --release -p vosulay-overlay -p vosulay-lookup
    
      64    local cef
    
      65    cef="$(cargo run --frozen --quiet --release -p vosulay-cef-tools \
    
      66        -- acquire --platform "linux-${CARCH}")"
    
      67    rm -rf "${srcdir}/stage"
    
      68    cargo run --frozen --quiet --release -p vosulay-cef-tools \
    
      69        -- package --platform "linux-${CARCH}" \
    
      70        --cef-path "$cef" --output "${srcdir}/stage" \
    
      71        --exe target/release/vosulay \
    
      72        --overlay target/release/libvosulay_overlay.so \
    
      73        --overlay target/release/libvosulay_lookup.so \
    
      74        --overlay crates/overlay-linux/VkLayer_vosulay_overlay.json
    
      75}
    
      76
    
      77package() {
    
      78    cd "${_pkgbase}"
    
      79    install -d "${pkgdir}/usr/lib/${_pkgbase}" "${pkgdir}/usr/bin"
    
      80    cp -a "${srcdir}/stage/." "${pkgdir}/usr/lib/${_pkgbase}/"
    
      81    chmod 4755 "${pkgdir}/usr/lib/${_pkgbase}/chrome-sandbox"
    
      82    ln -s "/usr/lib/${_pkgbase}/vosulay" "${pkgdir}/usr/bin/vosulay"
    
      83    install -Dm644 packaging/linux/com.vosu.vosulay.desktop \
    
      84        "${pkgdir}/usr/share/applications/com.vosu.vosulay.desktop"
    
      85    install -Dm644 assets/branding/vosulay-app-icon.svg \
    
      86        "${pkgdir}/usr/share/icons/hicolor/scalable/apps/com.vosu.vosulay.svg"
    
      87    install -Dm644 LICENSE \
    
      88        "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      89    install -Dm644 assets/branding/LICENSE.md \
    
      90        "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE-branding.md"
    
      91    ln -s "/usr/lib/${_pkgbase}/LICENSE.txt" \
    
      92        "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE-CEF.txt"
    
      93    ln -s "/usr/lib/${_pkgbase}/THIRD_PARTY_NOTICES.md" \
    
      94        "${pkgdir}/usr/share/licenses/${pkgname}/THIRD_PARTY_NOTICES.md"
    
      95}
    
      96

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2
2026-10-13 00:23:45	Low	2
2026-10-12 19:14:29	Low	2