{{define "package.html"}} {{.R.Name}} — AUR Report Card {{template "head" .}}

AUR Report Card / {{.R.Name}}

{{.R.Grade}} {{.R.Version}}{{with .R.Maintainer}} · maintained by {{.}}{{end}} · {{.R.Votes}} votes · view on AUR · badge

{{with .R.Description}}

{{.}}

{{end}} {{with .R.Drift}}
⚠ Source drift since the previous scan: A changed artifact behind an unchanged URL, or a moved commit pin without a version bump, is how hijacked upstream releases look. It can also be an innocent re-tag — but it is exactly the kind of change worth re-reviewing.
{{end}} {{if .R.Err}}
This package could not be scanned: {{.R.Err}}
{{else if not .R.Findings}}

No findings. The PKGBUILD pins its sources, keeps the network out of the build, and has no opaque code paths that static analysis worries about.

{{else}}
{{range .R.Findings}} {{end}}
SeverityRuleLocationFinding
{{sev .Severity}} {{.RuleID}} {{with index $.Rules .RuleID}}{{template "fixpill" .FixLevel}}{{end}} {{.Path}}:{{.Line}} {{.Message}}
{{end}} {{template "footer" .}}
{{end}}