feat(targets): add pkg-pacman target for Arch Linux AUR by Nexu0ps · Pull Request #540 · profullstack/sh1pt

Nexu0ps · 2026-06-01T00:27:26Z

Closes #486

Complete PKGBUILD + .SRCINFO generator for Arch Linux AUR with validation, multi-arch, and full dependency support.

Closes profullstack#486 Adds a complete AUR package target adapter: - Generates PKGBUILD with correct variable quoting and array syntax - Generates .SRCINFO metadata file (required by AUR) - Supports x86_64/aarch64/any architectures - depends, makedepends, provides, conflicts support - validatePkgName() rejects invalid names and shell-meaningful chars - ship() pushes to AUR via git (AUR_SSH_KEY) - dry-run ship support

greptile-apps · 2026-06-01T00:30:51Z

Greptile Summary

This PR adds a new pkg-pacman target that generates PKGBUILD and .SRCINFO files for publishing packages to the Arch Linux AUR. It closely parallels the already-existing pkg-aur target but with a simpler API surface and different defaults.

Bash quoting is broken in both bashArray and the pkgdesc line: values containing single quotes use \' which is not a valid escape inside bash single-quoted strings, producing PKGBUILD files that makepkg will reject at parse time.
install config field is silently ignored, defaultSourceUrl hard-codes x86_64 regardless of the configured arch, and the package() function omits the $srcdir/ prefix that most tarballs require. No test file is included, unlike every other target in the repository.

Confidence Score: 2/5

Not safe to merge — the generated PKGBUILD artifacts will be syntactically invalid whenever descriptions or dependency names contain a single quote, and multi-arch configurations silently download the wrong binary.

Multiple bugs in the core rendering logic mean the output files are wrong in common real-world scenarios: broken bash quoting produces PKGBUILDs that makepkg rejects, the default source URL hard-codes x86_64 regardless of configured arch, the install config field is exposed but never emitted, and the package() function omits the $srcdir/ prefix. None of these are caught by tests because no test file exists.

packages/targets/pkg-pacman/src/index.ts needs the most attention — all of the rendering bugs live there.

Important Files Changed

Filename	Overview
packages/targets/pkg-pacman/src/index.ts	New AUR PKGBUILD+SRCINFO target with several correctness bugs: broken single-quote escaping in bash output, `install` config field silently ignored, `defaultSourceUrl` hardcodes x86_64 for all arches, and `package()` omits `$srcdir/` prefix. Also overlaps with the existing `pkg-aur` target and ships with no tests.
packages/targets/pkg-pacman/package.json	New package manifest for the `pkg-pacman` target; contains a BOM character at the start of the file and does not include `devDependencies` for testing, consistent with the missing test file.
packages/targets/pkg-pacman/tsconfig.json	Standard tsconfig extending the workspace base; also contains a leading BOM character but otherwise follows the same pattern as other target packages.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[defineTarget build] --> B[validatePkgName]
    B --> C[mkdir pkgDir]
    C --> D[renderPKGBUILD]
    C --> E[renderSRCINFO]
    D --> D1[aurVersion]
    D --> D2[defaultSourceUrl - Hardcodes x86_64]
    D --> D3[bashArray - No single-quote escape]
    D --> D4[package - Missing srcdir prefix]
    E --> E1[aurVersion]
    E --> E2[defaultSourceUrl - Hardcodes x86_64]
    D --> F[writeFile PKGBUILD]
    E --> G[writeFile .SRCINFO]
    F & G --> H[return artifact pkgDir]

    style D3 fill:#ffcccc
    style D2 fill:#ffcccc
    style D4 fill:#ffcccc

_{Reviews (1): Last reviewed commit: "feat(targets): add pkg-pacman target for..." | Re-trigger Greptile}

greptile-apps · 2026-06-01T00:30:55Z

+function validatePkgName(name: string): void {
+  if (!name || !/^[a-z0-9][a-z0-9_.-]*$/.test(name) || /[;`$<>&|\\]/.test(name)) {
+    throw new Error(`pkg-pacman: invalid pkgName "${name}"`);
+  }
+}


Single-quote escaping in bashArray and pkgdesc will produce invalid bash

bashArray wraps every value with literal '...' but never escapes embedded single quotes, so a dependency like "libfoo's-dev" or a description like "It's a package" generates broken bash syntax (e.g. ('It's a package') terminates the string early). The pkgdesc escape at line 53 has the same bug: \' is not a valid escape inside a bash single-quoted string — only '\'' (end quote, escaped quote, re-open quote) works. The existing pkg-aur target's shellQuote helper gets this right. Any AUR submission with a description or dependency name containing a single quote will produce a PKGBUILD that makepkg refuses to parse.

greptile-apps · 2026-06-01T00:30:56Z

+  sha256sum?: string;
+  install?: string;             // optional .install script name


install field declared in Config but never consumed

Config exposes an install field documented as "optional .install script name", but neither renderPKGBUILD nor renderSRCINFO reads or emits it. Any user who sets this field expecting a install=foo.install line in their PKGBUILD will get silently incorrect output — the generated artifact won't reference the install script at all.

greptile-apps · 2026-06-01T00:30:57Z

+function defaultSourceUrl(config: Config, version: string): string {
+  const repo = config.releaseRepo ?? config.pkgName.replace(/-bin$/, '');
+  return `https://github.com/${repo}/releases/download/v${version}/${config.pkgName}-${version}-x86_64.tar.gz`;
+}


defaultSourceUrl hardcodes x86_64 for all architectures

When config.arch includes aarch64 or any, the auto-generated source URL always points to a x86_64 tarball. A user who sets arch: ['aarch64'] without an explicit sourceUrl will get a PKGBUILD that downloads the wrong binary. Multi-arch support (advertised in the PR description) requires either per-arch source arrays or a placeholder the user fills in.

greptile-apps · 2026-06-01T00:30:58Z

+  lines.push(
+    `source=("${config.pkgName}-\${pkgver}.tar.gz::${sourceUrl}")`,
+    `sha256sums=('${sha256sum}')`,
+    '',
+    'package() {',
+    `  install -Dm755 "\${pkgname}" "\${pkgdir}/usr/bin/\${pkgname}"`,
+    '}',
+    '',
+  );


package() installs from ${pkgname} without $srcdir/ prefix

The generated install line is install -Dm755 "${pkgname}" "${pkgdir}/usr/bin/${pkgname}". During makepkg's package() phase, the working directory is $srcdir, so this works only when the tarball extracts the binary directly into the root of $srcdir with no subdirectory. Most release tarballs include a top-level directory (e.g. myapp-1.2.3/), so the binary won't be found without "$srcdir/${pkgname}". The existing pkg-aur target uses the explicit $srcdir/ prefix for this reason.

greptile-apps · 2026-06-01T00:30:59Z

+import { defineTarget, manualSetup } from '@profullstack/sh1pt-core';
+import { mkdir, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+
+interface Config {


Functional overlap with the existing pkg-aur target

packages/targets/pkg-aur/ already implements a full PKGBUILD + .SRCINFO generator for the Arch User Repository, including template support, optdepends, multi-arch, and a matching test suite. The new pkg-pacman target covers the same surface area with slightly different defaults and a simpler API. Without a clear explanation of how these two targets are meant to coexist or replace each other, users will encounter two options in the registry that do the same job.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

greptile-apps · 2026-06-01T00:31:00Z

+import { defineTarget, manualSetup } from '@profullstack/sh1pt-core';
+import { mkdir, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+


No test file included

Every other package target in the repository ships with a src/index.test.ts covering at minimum the build output contents and dry-run shipping. pkg-pacman has no tests at all, which means the quoting and rendering bugs identified above are undetected by CI.

github-actions · 2026-06-01T09:42:09Z