vosulay-git

LOW

maintainer k4zoku 0 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

The package builds from a public git repository with a SKIP'd checksum, but it is a standard AUR practice for git sources; the build process uses rustup and cargo with locked dependencies, and no untrusted remote code execution is involved.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from a public git repository with a SKIP'd checksum, but it is a standard AUR practice for git sources; the build process uses rustup and cargo with locked dependencies, and no untrusted remote code execution is involved.

PKGBUILD

      1# Maintainer: Kazoku <k4zoku@pm.me>
    
      2# Contributor: sxlvia <qt715 at proton dot me>
    
      3
    
      4_pkgbase=vosulay
    
      5pkgname=${_pkgbase}-git
    
      6pkgver=1.2.1.r2.gfe36000
    
      7pkgrel=1
    
      8pkgdesc='In-game overlay for vosu and tosu-compatible counters (git version)'
    
      9arch=('x86_64')
    
      10url='https://github.com/shiruviaa/vosulay'
    
      11license=('MIT' 'BSD-3-Clause' 'CC-BY-4.0')
    
      12depends=(
    
      13    'alsa-lib'
    
      14    'at-spi2-core'
    
      15    'cairo'
    
      16    'dbus'
    
      17    'expat'
    
      18    'glib2'
    
      19    'libcups'
    
      20    'libx11'
    
      21    'libxcb'
    
      22    'libxcomposite'
    
      23    'libxdamage'
    
      24    'libxext'
    
      25    'libxfixes'
    
      26    'libxkbcommon'
    
      27    'libxrandr'
    
      28    'mesa'
    
      29    'nspr'
    
      30    'nss'
    
      31    'pango'
    
      32    'systemd-libs'
    
      33    'wayland'
    
      34    'hicolor-icon-theme'
    
      35)
    
      36makedepends=('git' 'cargo')
    
      37provides=("${_pkgbase}")
    
      38conflicts=("${_pkgbase}")
    
      39options=('!lto' '!strip' '!debug')
    
      40source=("${_pkgbase}::git+${url}.git#branch=main")
    
      41sha256sums=('SKIP')
    
      42
    
      43_toolchain() {
    
      44    sed -n 's/^channel *= *"\(.*\)"/\1/p' "${srcdir}/${_pkgbase}/rust-toolchain.toml"
    
      45}
    
      46
    
      47pkgver() {
    
      48    cd "${_pkgbase}"
    
      49    git describe --long --tags --abbrev=7 --always --match 'v[0-9]*' \
    
      50        | sed 's/^v//;s/\([^-]*-g\)/r\1/;s/-/./g'
    
      51}
    
      52
    
      53prepare() {
    
      54    cd "${_pkgbase}"
    
      55    RUSTUP_TOOLCHAIN="$(_toolchain)"
    
      56    export RUSTUP_TOOLCHAIN
    
      57    if command -v rustup >/dev/null; then
    
      58        rustup toolchain install "$RUSTUP_TOOLCHAIN" --profile minimal
    
      59    fi
    
      60    cargo fetch --locked --target "$CARCH-unknown-linux-gnu"
    
      61}
    
      62
    
      63build() {
    
      64    cd "${_pkgbase}"
    
      65    export XDG_CACHE_HOME="${srcdir}/cache"
    
      66    RUSTUP_TOOLCHAIN="$(_toolchain)"
    
      67    export RUSTUP_TOOLCHAIN
    
      68    export CARGO_TARGET_DIR=target
    
      69    export VOSULAY_PACKAGE_BUILD=1
    
      70    cargo build --frozen --release -p vosulay
    
      71    cargo build --frozen --release -p vosulay-overlay -p vosulay-lookup
    
      72    local cef
    
      73    cef="$(cargo run --frozen --quiet --release -p vosulay-cef-tools \
    
      74        -- acquire --platform "linux-${CARCH}")"
    
      75    rm -rf "${srcdir}/stage"
    
      76    cargo run --frozen --quiet --release -p vosulay-cef-tools \
    
      77        -- package --platform "linux-${CARCH}" \
    
      78        --cef-path "$cef" --output "${srcdir}/stage" \
    
      79        --exe target/release/vosulay \
    
      80        --overlay target/release/libvosulay_overlay.so \
    
      81        --overlay target/release/libvosulay_lookup.so \
    
      82        --overlay crates/overlay-linux/VkLayer_vosulay_overlay.json
    
      83}
    
      84
    
      85package() {
    
      86    cd "${_pkgbase}"
    
      87    install -d "${pkgdir}/usr/lib/${_pkgbase}" "${pkgdir}/usr/bin"
    
      88    cp -a "${srcdir}/stage/." "${pkgdir}/usr/lib/${_pkgbase}/"
    
      89    chmod 4755 "${pkgdir}/usr/lib/${_pkgbase}/chrome-sandbox"
    
      90    ln -s "/usr/lib/${_pkgbase}/vosulay" "${pkgdir}/usr/bin/vosulay"
    
      91    install -Dm644 packaging/linux/com.vosu.vosulay.desktop \
    
      92        "${pkgdir}/usr/share/applications/com.vosu.vosulay.desktop"
    
      93    install -Dm644 assets/branding/vosulay-app-icon.svg \
    
      94        "${pkgdir}/usr/share/icons/hicolor/scalable/apps/com.vosu.vosulay.svg"
    
      95    install -Dm644 LICENSE \
    
      96        "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      97    install -Dm644 assets/branding/LICENSE.md \
    
      98        "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE-branding.md"
    
      99    ln -s "/usr/lib/${_pkgbase}/LICENSE.txt" \
    
      100        "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE-CEF.txt"
    
      101    ln -s "/usr/lib/${_pkgbase}/THIRD_PARTY_NOTICES.md" \
    
      102        "${pkgdir}/usr/share/licenses/${pkgname}/THIRD_PARTY_NOTICES.md"
    
      103}
    
      104

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2
2026-10-13 00:23:45	Low	2
2026-10-12 19:14:29	Low	2