xerotop-git

LOW

maintainer LXXero 0 votes scanned 2026-10-18 17:22:42.773931

View on AUR

Why flagged

The package builds from a public Git repository with a SKIP'd checksum, but it is a legitimate source for a development version; no untrusted binaries or remote code execution are involved.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from a public Git repository with a SKIP'd checksum, but it is a legitimate source for a development version; no untrusted binaries or remote code execution are involved.

PKGBUILD

      1# Maintainer: xero <xero@xeron.cc>
    
      2pkgname=xerotop-git
    
      3_pkgname=xerotop
    
      4pkgver=0.1.0.r195.g82f4ab9
    
      5pkgrel=1
    
      6pkgdesc="A gkrellm-style, battery-conscious Wayland (wlroots/layer-shell) system monitor bar in Rust + GTK4"
    
      7arch=('x86_64')
    
      8url="https://github.com/LXXero/xerotop"
    
      9license=('GPL-3.0-or-later')
    
      10depends=('gtk4' 'gtk4-layer-shell' 'ttf-firacode-nerd')
    
      11makedepends=('git' 'cargo')
    
      12optdepends=('brightnessctl: brightness panel adjustment')
    
      13provides=('xerotop')
    
      14conflicts=('xerotop')
    
      15# ring (crypto dep via the weather HTTPS fetch) ships non-LTO asm; LTO breaks
    
      16# its symbol resolution at link time. !debug: the stripped release binary has no
    
      17# debug symbols, so skip the empty -debug split package.
    
      18options=('!lto' '!debug')
    
      19source=("git+https://github.com/LXXero/xerotop.git")
    
      20sha256sums=('SKIP')
    
      21
    
      22pkgver() {
    
      23  cd "$_pkgname"
    
      24  printf "%s.r%s.g%s" \
    
      25    "$(sed -n 's/^version *= *"\(.*\)"/\1/p' Cargo.toml | head -1)" \
    
      26    "$(git rev-list --count HEAD)" \
    
      27    "$(git rev-parse --short HEAD)"
    
      28}
    
      29
    
      30prepare() {
    
      31  cd "$_pkgname"
    
      32  cargo fetch --locked --target "$(rustc -vV | sed -n 's/host: //p')"
    
      33}
    
      34
    
      35build() {
    
      36  cd "$_pkgname"
    
      37  export CARGO_TARGET_DIR=target
    
      38  cargo build --frozen --release
    
      39}
    
      40
    
      41package() {
    
      42  cd "$_pkgname"
    
      43  make install DESTDIR="$pkgdir" PREFIX=/usr
    
      44}
    
      45

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-18 17:22:42	Low	2