xara (CLEAN) - AURWatch

Triggered rules

Clean AI review downgraded a static finding llm_review

The static rules flagged this LOW, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it CLEAN (confidence 95%): The package builds from a verifiable source tarball hosted on the project's official GitHub repository, with a matching checksum; no untrusted or obfuscated downloads are performed.

1 higher static finding superseded - not the current verdict (shown for transparency)

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

PKGBUILD

      1# Maintainer: Ante Laurijssen <va2bbw@gmail.com>
    
      2pkgname=xara
    
      3pkgver=0.1.1
    
      4pkgrel=2
    
      5pkgdesc="A VARA-compatible HF/FM sound modem for Linux with a web UI"
    
      6arch=('x86_64' 'aarch64')
    
      7url="https://github.com/x0rro/xara"
    
      8license=('MIT')
    
      9depends=('alsa-lib' 'libpulse')
    
      10makedepends=('alsa-lib' 'cargo' 'pkgconf')
    
      11
    
      12source=("$pkgname-$pkgver.tar.gz::https://github.com/x0rro/xara/archive/refs/tags/v$pkgver.tar.gz")
    
      13
    
      14prepare() {
    
      15    cd "$pkgname-$pkgver"
    
      16
    
      17    export RUSTUP_TOOLCHAIN=stable
    
      18    cargo fetch --locked
    
      19}
    
      20
    
      21build() {
    
      22    cd "$pkgname-$pkgver"
    
      23
    
      24    export RUSTUP_TOOLCHAIN=stable
    
      25    cargo build --frozen --release --workspace
    
      26}
    
      27
    
      28package() {
    
      29    cd "$pkgname-$pkgver"
    
      30
    
      31    install -Dm755 target/release/xara \
    
      32        "$pkgdir/usr/bin/xara"
    
      33
    
      34    install -Dm755 target/release/xara-monitor \
    
      35        "$pkgdir/usr/bin/xara-monitor"
    
      36
    
      37    install -Dm644 LICENSE \
    
      38        "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      39
    
      40    install -Dm644 README.md \
    
      41        "$pkgdir/usr/share/doc/$pkgname/README.md"
    
      42}
    
      43sha256sums=('26a52ce2a7f5107ed63ea956432c6d4009965a5603cf47ee76c9a33bbc3a96d2')
    
      44

Changes since previous scan

--- PKGBUILD @ 2026-10-28 00:06
+++ PKGBUILD @ 2026-10-30 00:29
@@ -1,34 +1,32 @@
 # Maintainer: Ante Laurijssen <va2bbw@gmail.com>
-
 pkgname=xara
 pkgver=0.1.1
-pkgrel=1
+pkgrel=2
 pkgdesc="A VARA-compatible HF/FM sound modem for Linux with a web UI"
 arch=('x86_64' 'aarch64')
 url="https://github.com/x0rro/xara"
 license=('MIT')
-depends=('alsa-lib' 'glibc' 'libpulse')
-makedepends=('cargo' 'git')
-source=("$pkgname::git+https://github.com/x0rro/xara.git#tag=v$pkgver")
+depends=('alsa-lib' 'libpulse')
+makedepends=('alsa-lib' 'cargo' 'pkgconf')
+
+source=("$pkgname-$pkgver.tar.gz::https://github.com/x0rro/xara/archive/refs/tags/v$pkgver.tar.gz")
 
 prepare() {
-    cd "$pkgname"
+    cd "$pkgname-$pkgver"
 
     export RUSTUP_TOOLCHAIN=stable
     cargo fetch --locked
 }
 
 build() {
-    cd "$pkgname"
+    cd "$pkgname-$pkgver"
 
     export RUSTUP_TOOLCHAIN=stable
-    export CARGO_TARGET_DIR=target
-
     cargo build --frozen --release --workspace
 }
 
 package() {
-    cd "$pkgname"
+    cd "$pkgname-$pkgver"
 
     install -Dm755 target/release/xara \
         "$pkgdir/usr/bin/xara"
@@ -38,6 +36,9 @@
 
     install -Dm644 LICENSE \
         "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
+
+    install -Dm644 README.md \
+        "$pkgdir/usr/share/doc/$pkgname/README.md"
 }
-sha256sums=('f91b3de833cfa89e1bd544c87c713fc7c5903efa108b1f388fb0361890adc6d1')
+sha256sums=('26a52ce2a7f5107ed63ea956432c6d4009965a5603cf47ee76c9a33bbc3a96d2')
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-30 00:29:30	Clean	2
2026-10-29 23:54:04	Low	1
2026-10-28 00:06:54	Clean	2
2026-10-27 23:48:54	Low	1
2026-10-27 00:23:28	Clean	2
2026-10-26 23:46:04	Low	1