{{define "package.html"}} {{template "head" .}} {{template "topbar" .}}
Package
{{.R.Grade}}

AUR report card

{{.R.Name}}

{{/* The facts are what the repository says about the package: the AUR has maintainers and votes, an official repository a packager; both have a page for the package and a place its PKGBUILD lives. */}}

{{.R.Repo}} {{.R.Version}} {{if .R.Official}} {{with .R.Packager}}packaged by {{.}}{{end}} Arch Linux page PKGBUILD {{else}} {{with .R.Maintainer}}maintained by {{.}}{{end}} {{with .R.CoMaintainers}}co-maintained by {{join . ", "}}{{end}} {{.R.Votes}} votes AUR page {{end}} badge

{{with .R.Description}}

{{.}}

{{end}}
{{with .R.Drift}}
Drift

Source drift since the previous scan

    {{range .}}
  • {{.}}
    • {{end}}

A changed artifact behind an unchanged URL, or a commit pin that moved without a version bump, is the shape a hijacked upstream release takes. A re-tagged release looks identical — which is why it is worth re-reading this one.

{{end}}
Findings{{if .R.Findings}}n = {{len .R.Findings}}{{end}}
{{if .R.Err}}

Not scanned

pkglint reads a PKGBUILD by parsing it as bash. This one did not parse, so there is nothing to grade:

{{scanErr .R.Err}}

{{else if not .R.Findings}}

Nothing to report. Sources are pinned, the build stays off the network, and nothing runs at parse time.

{{else}} {{range .Files}}

{{.Path}}

{{range .Findings}}
line {{.Line}}
{{.RuleID}}
{{sev .Severity}} {{.Message}} {{with index $.Rules .RuleID}}{{template "fixpill" .FixLevel}}{{end}}
{{end}}
{{end}} {{end}}
{{end}}