zshell

LOW
maintainer zachistaken 0 votes scanned 2026-08-30 21:44:16.144172
View on AUR
Why flagged

The package builds from a publicly accessible Git repository with no obfuscated downloads or remote code execution; the low severity is due to few votes and recent upload, not inherent risk.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 90%): The package builds from a publicly accessible Git repository with no obfuscated downloads or remote code execution; the low severity is due to few votes and recent upload, not inherent risk.

PKGBUILD

1pkgname='zshell'
2pkgver=0.4.0
3pkgrel=1
4pkgdesc='ZShell desktop shell'
5arch=('any')
6url='https://git.zach-dev.cc/zach/z-bar-qt'
7license=('GPL-3.0-only')
8depends=('python' 'python-pillow' 'python-materialyoucolor' 'libnotify' 'swappy' 'dart-sass'
9 'app2unit' 'wl-clipboard' 'dconf' 'cliphist' 'python-typer' 'qt6-canvaspainter')
10makedepends=('python-build' 'python-installer' 'python-hatch' 'python-hatch-vcs' 'cargo' 'rust' 'cmake' 'ninja' 'nuitka')
11source=("$pkgname::git+$url.git#branch=main")
12options=('!lto')
13sha256sums=('SKIP')
14
15pkgver() {
16 cd "${srcdir}/${pkgname}"
17 git describe --long --tags --abbrev=7 --exclude='*[a-zA-Z][a-zA-Z]*' |
18 sed -E 's/^[^0-9]*//;s/([^-]*-g)/r\1/;s/-/./g'
19}
20
21build() {
22 cd "${srcdir}/${pkgname}/zshell-img-tools"
23 cargo build --release
24
25 cd "${srcdir}/${pkgname}"
26 cmake -B build -G Ninja -DCMAKE_BUILD_TYPE=RelWithDebInfo -DCMAKE_INSTALL_PREFIX=/
27 cmake --build build
28}
29
30package() {
31 cd "${srcdir}/${pkgname}"
32 DESTDIR="$pkgdir" cmake --install build
33
34 install -Dm755 \
35 "${srcdir}/${pkgname}/zshell-img-tools/target/release/zshell-img-tools" \
36 "${pkgdir}/usr/bin/zshell-img-tools"
37}
38

Scan history

Scanned at (UTC)SeverityRules
2026-08-30 21:44:16 Low 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion