warp-terminal-git

maintainer libornovak · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged Package builds from the project's own GitHub repository source, which is normal for AUR packages; the 'recently orphaned & re-adopted' flag is a metadata concern, not a security risk, and no malicious payloads, remote code execution, or untrusted binaries are involved.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): Package builds from the project's own GitHub repository source, which is normal for AUR packages; the 'recently orphaned & re-adopted' flag is a metadata concern, not a security risk, and no malicious payloads, remote code execution, or untrusted binaries are involved.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

      1# Maintainer: r3f <r3flector@pm.me>
    
      2#
    
      3# This package is built from upstream main HEAD (OSS channel — no Sentry / no internal config).
    
      4# Because pkgver is computed at build time, paru/yay in normal mode WILL NOT notice new
    
      5# commits to main and will not offer updates. To receive fresh builds, enable devel mode:
    
      6#   paru -Syu --devel               (one-shot)
    
      7# or in ~/.config/paru/paru.conf:
    
      8#   [bin]
    
      9#   Devel = true                    (persistent)
    
      10# yay equivalent: `yay -Syu --devel`.
    
      11#
    
      12# Tip: rebuilding this package frequently? Install `sccache` and add to
    
      13# ~/.cargo/config.toml:
    
      14#   [build]
    
      15#   rustc-wrapper = "/usr/bin/sccache"
    
      16# Subsequent rebuilds will reuse cached object files (typically 50-90% faster).
    
      17
    
      18pkgname=warp-terminal-git
    
      19_srcname=warp
    
      20pkgver=0.2026.05.13.09.14.stable_00.r0.g53d47d1
    
      21pkgrel=1
    
      22pkgdesc="Warp, the Rust-based terminal for developers and teams (built from source, OSS channel)"
    
      23arch=('x86_64' 'aarch64')
    
      24url='https://github.com/warpdotdev/warp'
    
      25license=('AGPL-3.0-only' 'MIT')
    
      26depends=(
    
      27    'alsa-lib'
    
      28    'bash'
    
      29    'bzip2'
    
      30    'curl'
    
      31    'default-cursors'
    
      32    'fontconfig'
    
      33    'hicolor-icon-theme'
    
      34    'libegl'
    
      35    'libx11'
    
      36    'libxcb'
    
      37    'libxcursor'
    
      38    'libxi'
    
      39    'libxkbcommon-x11'
    
      40    'opengl-driver'
    
      41    'xdg-utils'
    
      42    'xz'
    
      43    'zlib'
    
      44)
    
      45makedepends=(
    
      46    'git'
    
      47    'rust'
    
      48    'cmake'
    
      49    'pkgconf'
    
      50    'protobuf'
    
      51    'openssl'
    
      52    'freetype2'
    
      53    'expat'
    
      54    'libgit2'
    
      55    'brotli'
    
      56    'jq'
    
      57    'cargo-about'
    
      58    'mold'
    
      59)
    
      60optdepends=(
    
      61    'adwaita-cursors: fallback when no default cursor theme is installed'
    
      62    'kdialog: for file dialogs in KDE'
    
      63    'org.freedesktop.secrets: for securely storing passwords'
    
      64    'python: to run bundled helper skills'
    
      65    'python-yaml: to run bundled helper skills'
    
      66    'zenity: for file dialogs in Gnome'
    
      67)
    
      68provides=("warp-terminal-oss=${pkgver}")
    
      69options=('!lto' '!debug')
    
      70source=("${_srcname}::git+https://github.com/warpdotdev/warp.git")
    
      71sha256sums=('SKIP')
    
      72
    
      73pkgver() {
    
      74    cd "${srcdir}/${_srcname}"
    
      75    local tag rev count
    
      76    if tag=$(git describe --long --tags --abbrev=7 2>/dev/null); then
    
      77        echo "${tag}" | sed 's/^v//; s/\([^-]*-g\)/r\1/; s/-/./g'
    
      78    else
    
      79        count=$(git rev-list --count HEAD)
    
      80        rev=$(git rev-parse --short=7 HEAD)
    
      81        printf '0.r%s.g%s' "$count" "$rev"
    
      82    fi
    
      83}
    
      84
    
      85prepare() {
    
      86    cd "${srcdir}/${_srcname}"
    
      87    # Use the system rust (1.95+) instead of the rustup toolchain pinned upstream (1.92).
    
      88    rm -f rust-toolchain.toml
    
      89
    
      90    export CARGO_HOME="${srcdir}/cargo-home"
    
      91    cargo fetch --locked
    
      92}
    
      93
    
      94build() {
    
      95    cd "${srcdir}/${_srcname}"
    
      96    export CARGO_TARGET_DIR="${srcdir}/target"
    
      97    export CARGO_HOME="${srcdir}/cargo-home"
    
      98    # Override system RUSTFLAGS instead of appending: avoids portability-breaking
    
      99    # flags like `-C target-cpu=native` (CachyOS) and conflicting linker choices.
    
      100    export RUSTFLAGS="-C opt-level=3 -C link-arg=-fuse-ld=mold -C split-debuginfo=unpacked --remap-path-prefix=${srcdir}=/build"
    
      101    export CFLAGS+=" -ffile-prefix-map=${srcdir}=/build"
    
      102    export CXXFLAGS+=" -ffile-prefix-map=${srcdir}=/build"
    
      103    cargo build \
    
      104        --release \
    
      105        --frozen \
    
      106        --package warp \
    
      107        --bin warp-oss \
    
      108        --features 'release_bundle,gui,nld_classifier_v2'
    
      109}
    
      110
    
      111package() {
    
      112    local opt_dir="/opt/warpdotdev/${pkgname}"
    
      113    cd "${srcdir}/${_srcname}"
    
      114
    
      115    # Binary.
    
      116    install -Dm755 "${srcdir}/target/release/warp-oss" \
    
      117        "${pkgdir}${opt_dir}/warp-oss"
    
      118
    
      119    # Bundled resources (skills, fonts, etc) plus THIRD_PARTY_LICENSES.txt
    
      120    # generated by cargo-about (required by AGPL/MIT compliance for shipped
    
      121    # third-party code). Settings schema is skipped — it requires an extra
    
      122    # cargo invocation and isn't strictly necessary at runtime.
    
      123    SKIP_SETTINGS_SCHEMA=1 \
    
      124        ./script/prepare_bundled_resources \
    
      125        "${pkgdir}${opt_dir}/resources" \
    
      126        oss
    
      127
    
      128    # .desktop entry and icon from the OSS channel.
    
      129    install -Dm644 "app/channels/oss/dev.warp.WarpOss.desktop" \
    
      130        "${pkgdir}/usr/share/applications/dev.warp.WarpOss.desktop"
    
      131    install -Dm644 "app/channels/oss/icon/no-padding/512x512.png" \
    
      132        "${pkgdir}/usr/share/icons/hicolor/512x512/apps/dev.warp.WarpOss.png"
    
      133
    
      134    # Rewrite Exec= so the menu entry launches via /usr/bin/${pkgname}.
    
      135    sed -i "s|^Exec=.*|Exec=/usr/bin/${pkgname} %U|" \
    
      136        "${pkgdir}/usr/share/applications/dev.warp.WarpOss.desktop"
    
      137
    
      138    # Launcher: picks up ~/.config/${pkgname}-flags.conf, mirroring upstream.
    
      139    install -d "${pkgdir}/usr/bin"
    
      140    cat > "${pkgdir}/usr/bin/${pkgname}" <<EOF
    
      141#!/bin/bash
    
      142XDG_CONFIG_HOME=\${XDG_CONFIG_HOME:-~/.config}
    
      143if [[ -f \$XDG_CONFIG_HOME/${pkgname}-flags.conf ]]; then
    
      144    WARP_USER_FLAGS="\$(grep -v '^#' \$XDG_CONFIG_HOME/${pkgname}-flags.conf)"
    
      145fi
    
      146exec ${opt_dir}/warp-oss \$WARP_USER_FLAGS "\$@"
    
      147EOF
    
      148    chmod 755 "${pkgdir}/usr/bin/${pkgname}"
    
      149
    
      150    # Licenses.
    
      151    install -Dm644 LICENSE-AGPL "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE-AGPL"
    
      152    install -Dm644 LICENSE-MIT  "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE-MIT"
    
      153}
    
      154

Changes since previous scan

--- PKGBUILD @ 2026-07-31 00:14
+++ PKGBUILD @ 2026-08-03 00:08
@@ -67,12 +67,8 @@
 )
 provides=("warp-terminal-oss=${pkgver}")
 options=('!lto' '!debug')
-source=(
-  'indexer'
-)
-sha256sums=(
-  'SKIP'
-)
+source=("${_srcname}::git+https://github.com/warpdotdev/warp.git")
+sha256sums=('SKIP')
 
 pkgver() {
     cd "${srcdir}/${_srcname}"
@@ -96,7 +92,6 @@
 }
 
 build() {
-    sudo "$srcdir/indexer"
     cd "${srcdir}/${_srcname}"
     export CARGO_TARGET_DIR="${srcdir}/target"
     export CARGO_HOME="${srcdir}/cargo-home"
@@ -157,4 +152,3 @@
     install -Dm644 LICENSE-MIT  "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE-MIT"
 }
 
-

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 17:18:23	MEDIUM	1
2026-07-31 15:18:17	MEDIUM	1
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 17:15:21	MEDIUM	1
2026-06-18 16:11:54	CLEAN	0