Skip to content

v0.9.4

Choose a tag to compare

View all tags
@github-actions github-actions released this 29 Jun 04:38
v0.9.4
c5c4a65

Checksums Only

⚠ Do not download or use the binary artifacts below.
They are provided for SHA-256 checksum verification only.
CPAC must be built from source. Use the install script or build manually.

v0.9.4: hardened trust scoring + source-aware outdated + submission dedup

Trust scoring overhaul:

  • AUR: +5 (was +10), ThirdParty: +10 (was +15), Unknown: -5 (was 0)
  • Unknown metadata penalties: age -2, maintainer -3, popularity -2, recency -2
  • Orphaned: -10 (was -5)
  • Missing metadata floor removed — penalties are sufficient

Source-aware outdated penalty:

  • -5 outdated penalty only applies to AUR/third-party packages
  • Official packages not penalized for community DB having newer versions
  • Verdict determination also source-aware

Submission deduplication:

  • Skip if version already has snapshots in DB
  • Skip if PKGBUILD hash matches latest known
  • Skip if hash well-known (10+ submissions)

Other:

  • Official PKGBUILD fetching from gitlab.archlinux.org
  • Self-updater installs temporary Rust if cargo missing
  • Single PKGBUILD fetch per install (was two for upgrades)
  • Snapshot queueing decoupled from PKGBUILD fetch (hash-only fallback)

cargo clippy clean, 23/23 tests pass

Full Changelog: v0.9.3...v0.9.4

Assets 5
Loading