wolf-lang
LOW
maintainer espadon
0 votes
scanned 2026-09-09 07:19:13.271149
Why flagged
The package builds from a git source with a SKIP'd checksum, which reduces verifiability, but it is the project's own source and the build process is transparent, offline after fetch, and follows legitimate project requirements (D57 stamping); no remote code execution or malicious behavior is present.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Low
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from a git source with a SKIP'd checksum, which reduces verifiability, but it is the project's own source and the build process is transparent, offline after fetch, and follows legitimate project requirements (D57 stamping); no remote code execution or malicious behavior is present.
PKGBUILD
1
# Maintainer: mfw <espadonne@outlook.com>
2
3
pkgname=wolf-lang
4
pkgver=0.2.7
5
pkgrel=1
6
pkgdesc='The wolf systems language: the wolfgang compiler, its runtime and the C importer'
7
arch=('x86_64' 'aarch64')
8
url='https://github.com/wolffe-lang/wolf-lang'
9
license=('GPL-3.0-or-later')
10
# `cc` links every program `wolf build` produces, so gcc is a runtime
11
# dependency, not just a makedepend.
12
depends=('sh' 'gcc' 'gcc-libs' 'glibc')
13
makedepends=('rust' 'cargo' 'git')
14
optdepends=(
15
'lld: faster linking — wolf prefers ld.lld and says so when it is absent'
16
'clang: for `import c` beyond the headers gcc ships'
17
'lupin: the reference interpreter wolf is differentially tested against'
18
)
19
provides=('wolf-lang')
20
# `wolf` is Return to Castle Wolfenstein in the AUR and installs
21
# /usr/bin/wolf. The compiler's command name is `wolf` by decree (D38),
22
# so the collision is real and is declared rather than discovered.
23
conflicts=('wolf-lang-bin' 'wolf')
24
install=wolf-lang.install
25
# No debug split: the remapped path prefix below makes the debug source
26
# paths meaningless, and nothing here ships sources.
27
options=('!debug')
28
# D57, and the reason this is a git source and not the release tarball:
29
# the build stamp is read from git AT BUILD TIME. `wolf --version` prints
30
# the bare version only when the tag `v$pkgver` points at HEAD; a GitHub
31
# archive tarball has no .git, so it builds a binary that answers
32
# `0.2.6+dev.unknown` — an unstamped binary claiming to be a release is
33
# exactly the provenance failure D57 exists to prevent.
34
source=("git+https://github.com/wolffe-lang/wolf-lang.git#tag=v$pkgver")
35
sha256sums=('SKIP')
36
37
prepare() {
38
cd wolf-lang
39
export RUSTUP_TOOLCHAIN=stable
40
cargo fetch --locked --target "$(rustc -vV | sed -n 's/host: //p')"
41
}
42
43
build() {
44
cd wolf-lang
45
export RUSTUP_TOOLCHAIN=stable
46
export CARGO_TARGET_DIR=target
47
# prepare() fetched everything; keep the inner build off the network.
48
export CARGO_NET_OFFLINE=true
49
# Without this the staged `wolf` embeds $srcdir in its panic paths
50
# and makepkg warns "Package contains reference to $srcdir"
51
# (measured). Remap to a stable, meaningless prefix.
52
export RUSTFLAGS="${RUSTFLAGS-} --remap-path-prefix=$srcdir=/usr/src/$pkgname"
53
# `cargo xtask dist` is the only build that stamps: it reads HEAD's
54
# short sha and the tag pointing at it and passes WOLF_COMMIT /
55
# WOLF_RELEASE into the release build. It also stages the three files
56
# that must travel together and smoke-tests the staged tree by
57
# compiling and running corpus/hello.lu from it.
58
cargo xtask dist
59
}
60
61
package() {
62
cd "wolf-lang/target/dist/wolf-$pkgver-$(rustc -vV | sed -n 's/host: //p')"
63
64
# `wolf` locates libwolf_rt.a strictly beside the running binary
65
# (std::env::current_exe, no PATH fallback) and the importer worker
66
# beside it or on PATH. A symlink in /usr/bin does NOT do it: on
67
# macOS current_exe returns the symlink and the lookup misses, and
68
# relying on Linux's /proc/self/exe resolving it is a platform
69
# accident. The three files stay together in /usr/lib/wolf-lang and
70
# /usr/bin/wolf execs into them, which replaces the process image so
71
# current_exe is the real path on every host.
72
install -Dm755 wolf "$pkgdir/usr/lib/$pkgname/wolf"
73
install -Dm755 wolf-cimport-worker "$pkgdir/usr/lib/$pkgname/wolf-cimport-worker"
74
install -Dm644 libwolf_rt.a "$pkgdir/usr/lib/$pkgname/libwolf_rt.a"
75
76
install -dm755 "$pkgdir/usr/bin"
77
printf '#!/bin/sh\nexec /usr/lib/%s/wolf "$@"\n' "$pkgname" > "$pkgdir/usr/bin/wolf"
78
chmod 755 "$pkgdir/usr/bin/wolf"
79
80
install -Dm644 README.md "$pkgdir/usr/share/doc/$pkgname/README.md"
81
install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
82
# The runtime library carries a linking exception: programs compiled
83
# with wolf are the author's, under any license they choose.
84
install -Dm644 LICENSE-EXCEPTION "$pkgdir/usr/share/licenses/$pkgname/LICENSE-EXCEPTION"
85
}
86
Changes since previous scan
--- PKGBUILD @ 2026-09-09 03:18+++ PKGBUILD @ 2026-09-09 07:19@@ -1,7 +1,7 @@ # Maintainer: mfw <espadonne@outlook.com> pkgname=wolf-lang-pkgver=0.2.6+pkgver=0.2.7 pkgrel=1 pkgdesc='The wolf systems language: the wolfgang compiler, its runtime and the C importer' arch=('x86_64' 'aarch64')Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-09 07:19:13 | Low | 2 |
| 2026-09-09 03:18:52 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 17:18:20 | Low | 2 |