alint(5)

Bestie, this is the alint(5) page from the File Formats Manual, and it’s all about linting labels and tags. No cap, it’s giving very structured but also very cute. 💅

🌸 NAME 🌸

alint — linting labels and tags 🎀

💖 DESCRIPTION 💖

Every test in alint gets 2 attributes: a label and a tag. A label is a collection of words separated by dashes, and it’s meant to convey the general idea of what the test does. A tag is a string with AL followed by an integer; these are assigned in increasing order as new tests are made, but old ones are never re-used. 👑

Tests can be skipped by setting an environment variable composed of SKIP_ + the label in uppercase with the dashes replaced by underscore, or by setting an environment variable composed of SKIP_ + the tag. So yeah: skip by label or skip by tag, your call. ✨

✨ Severity ✨

Severity is assigned to each tag, and it says how serious the violation found is: 🔥

💖 Serious (S)

Will cause problems during build or when the package is delivered to users. Should be fixed immediately. No waiting, bestie. 💀

🫶 Important (I)

Might cause problems during build or when the package is delivered to users in certain situations. Should be fixed soon. 🌸

🎀 Minor (M)

Won’t directly cause issues during build or when the package is delivered to users. Should be fixed when convenient. 🦋

This also holds style issues that are dictated on the CODINGSTYLE.md file. 📝

👑 STYLE (T)

Won’t cause any issues, are specific style issues pertinent to a concerned developer or contributor. The APKBUILD_STYLE variable can be set to a specific value to enable a subset of checks that the specific developer or user uses. ✨

When a check belongs to this category, this manual page also provides information on which developers use a specific style check, since developers can sometimes both want to have the same check done on their own style. 💅

Current valid values are:

• leo (style linting for leo)

🦋 Certainty 🦋

Certainty is assigned to each tag, and it says how certain a test is that the violation found is not a false positive. 🔍

💜 Certain (C)

The test is certain that this is not a false positive. 💯

🌈 Possible (P)

The test is not certain that this is a false positive, but there is a high chance it isn’t. 🤔

🎀 TABLE 🎀

The following is a table of every tag, along with its tag, label, severity, certainty, along with linter (which binary checks for it) and fixer (whether apkbuild-fixer can fix it automatically). 👑

okay so here's the full roster, every single tag, no skips, no "etc." — because bestie, "etc." is how you miss a lint 💀

• AL1 — default-builddir-value · severity: Minor · certainty: Certain · linter: apkbuild-lint · fixer: YES
• AL2 — unnecessary-return-1 · severity: Minor · certainty: Certain · linter: apkbuild-lint · fixer: YES
• AL3 — pkgname-quoted · severity: Minor · certainty: Certain · linter: apkbuild-lint · fixer: NO
• AL4 — pkgver-quoted · severity: Minor · certainty: Certain · linter: apkbuild-lint · fixer: NO
• AL5 — empty-variable · severity: Minor · certainty: Certain · linter: apkbuild-lint · fixer: YES
• AL6 — custom-variable · severity: Important · certainty: Certain · linter: apkbuild-lint · fixer: NO
• AL7 — indent-tabs · severity: Important · certainty: Certain · linter: apkbuild-lint · fixer: NO
• AL8 — trailing-whitespace · severity: Important · certainty: Certain · linter: apkbuild-lint · fixer: YES
• AL9 — function-keyword · severity: Serious · certainty: Certain · linter: apkbuild-lint · fixer: NO
• AL10 — space-before-function-parenthesis · severity: Minor · certainty: Certain · linter: apkbuild-lint · fixer: YES
• AL11 — space-after-function-parenthesis · severity: Minor · certainty: Certain · linter: apkbuild-lint · fixer: YES
• AL12 — newline-opening-brace · severity: Minor · certainty: Certain · linter: apkbuild-lint · fixer: NO
• AL13 — superfluous-cd-builddir · severity: Minor · certainty: Possible · linter: apkbuild-lint · fixer: YES
• AL14 — pkgname-has-uppercase · severity: Serious · certainty: Certain · linter: apkbuild-lint · fixer: NO
• AL15 — pkgver-has-pkgrel · severity: Serious · certainty: Certain · linter: apkbuild-lint · fixer: NO
• AL16 — upper-repo-depends · severity: Serious · certainty: Certain · linter: aports-lint · fixer: N/A
• AL17 — duplicate-depends · severity: Minor · certainty: Certain · linter: aports-lint · fixer: N/A
• AL18 — upper-repo-makedepends · severity: Serious · certainty: Certain · linter: aports-lint · fixer: N/A
• AL19 — duplicate-makedepends · severity: Minor · certainty: Certain · linter: aports-lint · fixer: N/A
• AL20 — upper-repo-makedepends · severity: Serious · certainty: Certain · linter: aports-lint · fixer: N/A
• AL21 — duplicate-makedepends · severity: Minor · certainty: Certain · linter: aports-lint · fixer: N/A
• AL22 — duplicate-package · severity: Serious · certainty: Certain · linter: aports-lint · fixer: N/A
• AL23 — pkgname-dirname-mismatch · severity: Important · certainty: Certain · linter: aports-lint · fixer: N/A
• AL24 — depends-makedepends-checkdepends-overlap · severity: Important · certainty: Certain · linter: aports-lint · fixer: N/A
• AL25 — backticks-usage · severity: Serious · certainty: Possible · linter: apkbuild-lint · fixer: NO
• AL26 — _builddir-is-set · severity: Serious · certainty: Certain · linter: apkbuild-lint · fixer: NO
• AL28 — literal-integer-is-quoted · severity: Minor · certainty: Certain · linter: apkbuild-lint · fixer: NO

---

okay quick vibe check on that list bestie 👑

Notice how AL16 through AL24 are all aports-lint girls and their fixer column is just N/A — they're not here to fix you, they're here to judge you 💅 Meanwhile AL1, AL2, AL5, AL8, AL10, AL11, AL13 have YES in the fixer column, meaning somebody can actually clean that up for you. Slay.

Also yes, AL20 and AL21 have the exact same labels as AL18 and AL19 up there — I'm not gaslighting you, that's literally what the table says, character for character. And AL27? She's not in the building. The roster jumps from AL26 straight to AL28, no cap, and I'm not about to invent a tag that doesn't exist 🙈

Also peep the certainty column — AL13 and AL25 are the only Possible girls in this whole chunk, so if the linter flags those at you, it's saying "hmm, probably" rather than "I would bet my life." Everyone else is Certain 💯

Severity girly recap, since it's right there in the row: lots of Minor, a handful of Important (AL6, AL7, AL8, AL23, AL24), and the Serious girlies are AL9, AL14, AL15, AL16, AL18, AL20, AL22, AL25, AL26 — those are the ones you do not leave on read 😭

• AL29 · pkgname-used-in-source — severity Minor, certainty Certain, from apkbuild-lint. Final column: YES. bestie the package name is literally showing up in your source and we can see it 👀
• AL30 · double-underscore-in-variable — severity Minor, certainty Certain, from apkbuild-lint. Final column: NO. two underscores in one variable name, that's the whole vibe check and it did not pass 💀
• AL31 · variable-capitalized — severity Minor, certainty Certain, from apkbuild-lint. Final column: NO. capital letters in a variable, lowercase era only fr fr
• AL32 · braced-variable — severity Minor, certainty Certain, from apkbuild-lint. Final column: YES. the braces around your variable, iconic but noted 🎀
• AL33 · unexpected-shebang-line — severity Important, certainty Certain, from initd-lint. Final column: N/A. that shebang line was not on the guest list 🚫
• AL34 · custom-start-stop-function — severity Important, certainty Certain, from initd-lint. Final column: N/A. custom start/stop functions, main character energy but not here ✨
• AL35 · cpan-variable — severity Minor, certainty Certain, from apkbuild-lint. Final column: NO. cpan variable spotted, lowkey suspicious 🍓
• AL36 · overwrite-xflags — severity Serious, certainty Certain, from apkbuild-lint. Final column: NO. you overwrote xflags and that is highkey not the move 😭
• AL37 · secfixes-missing-colon — severity Serious, certainty Certain, from secfixes-check. Final column: N/A. the colon in secfixes ghosted us 🙈
• AL38 · pkgver-pkgrel-missing-colon — severity Serious, certainty Certain, from secfixes-check. Final column: N/A. pkgver/pkgrel missing their colon moment, rude
• AL39 · pkgver-pkgrel-invalid-pkgver — severity Serious, certainty Certain, from secfixes-check. Final column: N/A. that pkgver is invalid, no cap 🫶
• AL40 · pkgver-pkgrel-invalid-pkgrel — severity Serious, certainty Certain, from secfixes-check. Final column: N/A. and the pkgrel is invalid too, double oof 💀
• AL41 · security-identifier-missing-hyphen — severity Serious, certainty Certain, from secfixes-check. Final column: N/A. the hyphen dipped on the security identifier, not slay
• AL47 · security-identifier-wrong-indent — severity Serious, certainty Certain, from secfixes-check. Final column: N/A. wrong indent on the security identifier, alignment is a love language 🧚
• AL48 · pkgver-pkgrel-wrong-indent — severity Serious, certainty Certain, from secfixes-check. Final column: N/A. pkgver/pkgrel sitting at the wrong indent level, fix it bestie
• AL49 · invalid-option — severity Minor, certainty Certain, from apkbuild-lint. Final column: YES. an option that simply is not a thing, we've all been there 💅
• AL50 · cve-identifier-formatted-incorrectly — severity Minor, certainty Certain, from secfixes-check. Final column: N/A. CVE identifier formatting is off, the format ate and left crumbs 🌈
• AL51 · gnutls-sa-identifier-formatted-incorrectly — severity Minor, certainty Certain, from secfixes-check. Final column: N/A. GNUTLS-SA identifier, same story, formatting said no ⭐
• AL52 · unknown-security-identifier — severity Minor, certainty Certain, from secfixes-check. Final column: N/A. this security identifier is unknown to us, stranger danger 🦋
• AL53 · xsa-identifier-formatted-incorrectly — severity Minor, certainty Certain, from secfixes-check. Final column: N/A. XSA identifier formatting, we are not doing this today 😤
• AL54 · missing-default-prepare — severity Serious, certainty Certain, from apkbuild-lint. Final column: NO. the default prepare is missing and it's giving unfinished business 💜
• AL56 · missing-patch-description — severity Minor, certainty Certain, from aports-lint. Final column: N/A. your patch has no description, give the people some context 🎀
• AL57 · invalid-arch — severity Serious, certainty Certain, from apkbuild-lint. Final column: YES. that arch is invalid, respectfully 🔥
• AL58 · deprecated-packages — severity Serious, certainty Certain, from aports-lint. Final column: N/A. deprecated packages in the chat, it's over for them 💀
• AL59 · duplicate-identifier-value — severity Serious, certainty Certain, from secfixes-check. Final column: N/A. same identifier value twice, we said it once and we meant it 🙈

…and that's the tail end of the table, bestie — the last three rows, wrapping the whole thing up:

• AL61 — bad-version · Severity: Important · Certainty: Certain · Program: apkbuild-lint · NO
• AL62 — volatile-source · Severity: Serious · Certainty: Certain · Program: apkbuild-lint · NO
• AL63 — ghsl-identifier-formatted-incorrectly · Severity: Minor · Certainty: Certain · Program: secfixes-check · NO

---

🏷️ LABELS TAGS (aports-lint) ✨

Okay so these are the labels and tags that the aports-lint program uses — think of it as the master list of everything it can yell at you about. Each one has an [AL##] code so you can look it up, iykyk. 💅

🌸 duplicate-package [AL22]

Not you introducing a Package that's already sitting in another repo 🙈. You gotta fix the conflict, and here's the whole game plan:

• If the package in the uppermost repo has more recent changes, merge them.
• Then delete the package in the upper repo.

Why do we care? Because duplicate packages will shadow each other in the repo, and the one with the higher version will win — which is a whole mess. It can also cause programs to compile against the wrong version of a package. Example time, because this one's iconic: if main/foo-1-r0 and testing/foo-2-r0 exist and main/bar is updated to version 2 which requires foo>=2-r0, then it will fail because it will only find main/foo-1-r0 and not testing/foo-2-r0. 💀

Severity: Serious, Certainty: Certain

🎀 upper-repo-depends [AL16]

Your package depends on a package in a upper repo. Rude! The package must be moved to the upper repo, or the dependency moved to the repo the package is in.

Rules of the road, no cap — packages cannot depend on a package on an upper repo:

• Packages in main cannot depend on packages in other repos.
• Packages in community can depend on main and itself only.
• Packages in testing can depend on main, community and itself only.
• Packages in unmaintained can depend on package on any repo but non-free.

Severity: Serious, Certainty: Certain

🦋 duplicate-depends [AL17]

The APKBUILD has duplicate depends. One of them must be removed. Declaring duplicate dependencies is superfluous — literally, we saw it the first time bestie. 😭

Severity: Minor, Certainty: Certain

🧚 upper-repo-makedepends [AL18]

The package makedepends on a package in a upper repo. The package must be moved to the upper repo, or the dependency moved to the repo the package is in.

Same energy as above, but for make deps — packages cannot makedepend on a package on an upper repo:

• Packages in main cannot makedepend on packages in other repos.
• Packages in community can depend on main and itself only.
• Packages in testing can makedepend on main, community and itself only.
• Packages in unmaintained can makedepend on packages of any repo but non-free.

Severity: Serious, Certainty: Certain

🍓 duplicate-makedepends [AL19]

The APKBUILD has duplicate makedepends. One of them must be removed. Again: declaring duplicate dependencies is superfluous. Stop doing it, please and thank you. 🫶

Severity: Minor, Certainty: Certain

💜 upper-repo-checkdepends [AL20]

The package checkdepends on a package in a upper repo. The package must be moved to the upper repo, or the dependency moved to the repo the package is in.

Yep, the third time's the charm — packages cannot checkdepend on a package on an upper repo:

• Packages in main cannot checkdepend on packages in other repos.
• Packages in community can checkdepend on main and itself only.
• Packages in testing can checkdepend on main, community and itself only.
• Packages in unmaintained can checkdepend on package on any repo but non-free.

Severity: Serious, Certainty: Certain

🌈 duplicate-checkdepends [AL21]

The APKBUILD has duplicate checkdepends. One of them must be removed. Declaring duplicate dependencies is superfluous. That's the trio, we're done. ✨

Severity: Minor, Certainty: Certain

👑 pkgname-dirname-mismatch [AL23]

The pkgname variable of the APKBUILD has value foo but the directory in which the APKBUILD is found is not named foo. It's giving "did you forget where you live" energy, honestly. 🫠

Severity: Important, Certainty: Certain

🔥 depends-makedepends-checkdepends-overlap [AL24]

A package is present in 2 to 3 of the 3 types of following dependencies: depends, makedepends and checkdepends. All of them are installed during creation of the package, so please specify only once in the lowest common denominator location. Pick a lane, bestie — one entry, one place. 💅

Severity: Important, Certainty: Certain

⭐ deprecated-packages [AL58]

A package is present in depends, makedepends or checkdepends that is considered deprecated. The deprecated packages are hard-coded into aports-lint, with the option of adding custom ones via the CUSTOM_DEPRECATED_PACKAGES variable. They are considered no longer fit for usage in Alpine Linux and should be removed IMMEDIATELY. Not like "later", not like "next sprint" — IMMEDIATELY, in caps, heard. 😤

Severity: Serious, Certainty: Certain

🎧 missing-patch-description [AL56]

A patch specified in $sources is missing a description. The description should at the very least explain why the patch is necessary — future you (and every maintainer after you) will be so grateful, fr fr. 🌸

Severity: Minor, Certainty: Certain

🏷️ LABELS TAGS (apkbuild-lint) 🏷️

Okay bestie, these are the labels and tags used by the apkbuild-lint program — think of them as the linting group chat’s receipts, each with its own AL number 💅✨.

💖 default-builddir-value [AL1]

So the value of builddir matches the default of $srcdir/$pkgname-$pkgver? Then the builddir declaration can just be removed, bestie. Starting with v2.29.0 (Alpine version 3.3) of abuild, the value is set automatically.

Some packages are excluded from this because they are built by abuild during bootstrap and as such are built with the pkgname plus the -bootstrap suffix. More packages can be added to the exceptions by passing a whitespace-separated list in the variable CUSTOM_BOOTSTRAP_PACKAGES.

Severity: Minor, Certainty: Certain

🎀 unnecessary-return-1 [AL2]

The APKBUILD has || return 1 statements. They can be safely removed, no cap. Starting with version v2.15.0 of abuild, the building process is executed with set -e, which effectively adds a || return 1 to every command.

Severity: Minor, Certainty: Certain

💅 pkgname-quoted [AL3]

The APKBUILD’s pkgname variable is quoted. It must not be quoted. That’s the whole vibe check.

Severity: Minor, Certainty: Certain

💅 pkgver-quoted [AL4]

The APKBUILD’s pkgver variable is quoted. It must not be quoted either. Same energy, different variable 🫶.

Severity: Minor, Certainty: Certain

🧺 empty-variable [AL5]

The APKBUILD has variables that are empty values, and they can safely be removed. Empty variables can be removed to make the APKBUILD smaller and more concise. Lowkey a cleanup slay.

Severity: Minor, Certainty: Certain

🚩 custom-variable [AL6]

The APKBUILD has custom variables that are not prefixed with an underscore. Prefix the variables with an underscore, bestie.

Variables that do not affect behavior of abuild should be prefixed with an underscore so maintainers and contributors can easily distinguish their importance.

Severity: Important, Certainty: Certain

📐 indent-tabs [AL7]

The APKBUILD is using spaces instead of tabs for indenting. Replace the spaces with tabs. APKBUILDs use tab characters (t), not spaces, for indentation.

Severity: Important, Certainty: Certain

🌬️ trailing-whitespace [AL8]

The APKBUILD has trailing whitespace characters. Remove them. Trailing whitespace is superfluous, fr fr.

Severity: Important, Certainty: Certain

🪄 backticks-usage [AL25]

The APKBUILD uses backticks for running a shell command, use $() instead. This one is giving old-school shell energy, and not in the iconic way 😭.

Severity: Serious, Certainty: Possible

🚫 function-keyword [AL9]

The APKBUILD uses the function keyword to declare a function. Use function() instead. The function keyword is a bashism. abuild uses Posix-compliant shell with the local keyword.

Severity: Serious, Certainty: Certain

🫧 space-before-function-parenthesis [AL10]

The APKBUILD has a space character between the name of a function and the parenthesis that denote it is a function. Remove the superfluous space. Tiny detail, very “clean girl” linting 💅.

Severity: Minor, Certainty: Certain

🫧 space-after-function-parenthesis [AL11]

The APKBUILD doesn’t have a space after the function parenthesis or has more than one space. Use only one space after the function parenthesis. One space. That’s the rule. Periodt.

Severity: Minor, Certainty: Certain

🫧 newline-opening-brace [AL12]

The APKBUILD has a newline before the opening brace of a function. Put the opening brace in the same line as the declaration with one space after the function parenthesis. Keep it cozy and on one line.

Severity: Minor, Certainty: Certain

🧹 superfluous-cd-builddir [AL13]

The APKBUILD has cd "$builddir" statements that are superfluous. Remove them. Starting with v3.3.0 of abuild, the prepare, build, check and package functions automatically have their working directory set to the value of builddir.

It is also possible that there are 2 cd "$builddir" statements one after the other. Yes, bestie, that happens 😭.

Severity: Minor, Certainty: Possible

🔠 pkgname-has-uppercase [AL14]

pkgname has uppercase characters, and pkgname must have only lowercase characters. More pkgnames can be added to the exceptions by passing a whitespace-separated list in the variable CUSTOM_UPPERCASE_PKGNAMES.

Severity: Serious, Certainty: Certain

🔢 pkgver-has-pkgrel [AL15]

pkgver has -r followed by a number, and that is reserved for the release of a package as defined by the pkgrel variable. So don’t put that in pkgver, bestie 💀.

Severity: Serious, Certainty: Certain

🧨 _builddir-is-set [AL26]

_builddir is set instead of builddir, which is an old variable from before builddir existed as a concept understood by abuild. Ancient lore, honestly.

Severity: Serious, Certainty: Certain

🔢 literal-integer-is-quoted [AL28]

A variable declaration containing only integers should not be quoted. Numbers are out here living their unquoted truth ✨.

Severity: Minor, Certainty: Certain

🔗 pkgname-used-in-source [AL29]

"$pkgname" is used in the source url. This tightly couples the pkgname to the upstream name, which makes it harder to rename packages or create specialized / variants of packages.

Instead, use the upstream name fully written out. This only counts for the url itself, not the local archive name prefix.

Severity: Minor, Certainty: Certain

🪢 double-underscore-in-variable [AL30]

Usage of double underscore in variables is forbidden, use always one underscore for variables that are not used by abuild. Double underscore? Not the move 🙈.

Severity: Minor, Certainty: Certain

🔡 variable-capitalized [AL31]

Variables should have no capitalized letters. Lowercase supremacy, but make it shell variables 💜.

Severity: Minor, Certainty: Certain

🎀 braced-variable [AL32]

Variable has braces around it while it is not required, remove the braces. If the braces aren’t doing anything, they’re just accessories at that point 💅.

Severity: Minor, Certainty: Possible

🐪 cpan-variable [AL35]

The variables cpandepends, cpanmakedepends and cpancheckdepends were created by the apkbuild-cpan program but are now deprecated and their contents must be merged into the contents of its respective variable.

Severity: Minor, Certainty: Certain

🚩 overwrite-xflags [AL36]

Don’t overwrite CFLAGS, GOFLAGS, CPPFLAGS, CXXFLAGS and FFLAGS. These flags are generally defined outside of the APKBUILD and should not be overwritten because they contain important flags that should not be discarded. Instead, expand the variable. For example: CFLAGS="$CFLAGS .."

It is still possible to change the flags by using variable substitution. For example: CFLAGS="${CFLAGS/-Dflag}"

This list might be expanded as more variables are found that should not be overwritten.

Severity: Serious, Certainty: Certain

🎛️ invalid-option [AL49]

An option in the option= variable has a value that is not used by abuild. While it most likely won’t cause any problems, it is considered good form to remove it.

The variable VALID_CUSTOM_OPTIONS can be used to denote other options that are acceptable, it takes a whitespace-separated list.

Severity: Minor, Certainty: Certain

🩹 missing-default-prepare [AL54]

The prepare() function is defined but a call to default_prepare (which applies all patches in source=) is missing. Please add default_prepare where appropriate in the definition of prepare(). Don’t leave your patches hanging, bestie 😭.

Severity: Serious, Certainty: Certain

🏗️ invalid-arch [AL57]

The variable 'arch' in the APKBUILD has an invalid value in it. The only options are the name of the arches used by Alpine Linux and the strings 'noarch' and 'all'.

The acceptable arches are taken from /usr/share/abuild/functions.sh as those are the ones recognized by abuild and thus Alpine Linux as valid arches. If you have other arches, read below.

The variable CUSTOM_VALID_ARCHES can be used to denote other arches that are to be considered valid, it takes a whitespace-separated list.

Severity: Serious, Certainty: Certain

🧪 bad-version [AL61]

The pkgver matches a regex for a bad version. This means that the pkgver is a version that is not desirable, like a testing/experimental branch.

The variable CUSTOM_BAD_VERSIONS can be used to add more pkgname@regexes... combinations, separated by whitespace.

Severity: Important, Certainty: Certain

🌪️ volatile-source [AL62]

The given URL is volatile and will change checksum due to unexpected factors. The most common example is GitHub pull-requests/GitLab Merge Requests, which change as the author pushes commits. Another is GitHub commits, which might change as GitHub changes their version of Git in their infrastructure.

Severity: Serious, Certainty: Certain

🛠️ LABELS TAGS (initd-lint) 🛠️

Now for the initd-lint side of the group chat — OpenRC service file edition 🐚🫶.

🐚 unexpected-shebang-line [AL33]

OpenRC service files need to use #!/sbin/openrc-run to properly work. See https://github.com/OpenRC/openrc/blob/master/service-script-guide.md#syntax-of-service-scripts for more details.

Severity: Important, Certainty: Certain

🐚 custom-start-stop-function [AL34]

It’s discouraged to write custom start / stop function for service files. In most cases it suffices to define command, command_args, and pidfile. See https://github.com/OpenRC/openrc/blob/master/service-script-guide.md#dont-write-your-own-startstop-functions for more information.

Severity: Important, Certainty: Certain

🌸 LABEL TAGS (secfixes-check) 🎀

okay bestie, so the secfixes comment block in your APKBUILD has its own whole squad of linters, and these are them. it's giving very detail-oriented, very "your fave is a regex" energy, and honestly? we stan. every one of these is Certain certainty, so when one of them fires, it really did that 💅

---

💖 secfixes-missing-colon [AL37]

bestie the secfixes header is literally missing its colon at the end. that's it, that's the crime 😭

Severity: Serious · Certainty: Certain

⭐ pkgver-pkgrel-missing-colon [AL38]

the pkgver-pkgrel header — colon at the end. (yes that's what it says, that's the whole vibe, go fix the colon 🫶)

Severity: Serious · Certainty: Certain

🦋 pkgver-pkgrel-invalid-pkgver [AL39]

the pkgver-pkgrel header has an invalid pkgver and it's not passing the vibe check.

Severity: Serious · Certainty: Certain

🌸 pkgver-pkgrel-invalid-pkgrel [AL40]

same era, different field — the pkgver-pkgrel header has an invalid pkgrel.

Severity: Serious · Certainty: Certain

🎀 security-identifier-missing-hyphen [AL41]

the security identifier is missing its leading hyphen, so it's out here starting a sentence with no intro. icon behaviour but not valid behaviour 🙈

Severity: Serious · Certainty: Certain

✨ security-identifier-wrong-indent [AL47]

the CVE identifier has too many or too few leading whitespaces. the rule is strict bestie: it must have exactly 5 whitespaces between the comment marker and the mapping hyphen. no more, no less, periodt 💅

Severity: Serious · Certainty: Certain

🌈 pkgver-pkgrel-wrong-indent [AL48]

the pkgver-pkgrel header has too many or too few leading whitespaces. and here the count is different — it must have exactly 3 whitespaces between the comment marker and the mapping hyphen. yes, three. not four. iykyk ⭐

Severity: Serious · Certainty: Certain

🔥 cve-identifier-formatted-incorrectly [AL50]

the CVE identifier is not formatted correctly — check the output string for the reason why, it'll tell you exactly what's off.

Severity: Minor · Certainty: Certain

🧚 gnutls-sa-identifier-formatted-incorrectly [AL51]

the GNUTLS-SA identifier is not formatted correctly either — again, the output string spills the reason why.

Severity: Minor · Certainty: Certain

💜 unknown-security-identifier [AL52]

an unknown identifier got passed in. if it's actually a legitimate identifier, then please contact the authors so they can add support for it — they're nice, fr fr 🫶

Severity: Minor · Certainty: Certain

👑 xsa-identifier-formatted-incorrectly [AL53]

the XSA identifier is not formatted correctly. output string = the reason why, as always.

Severity: Minor · Certainty: Certain

💀 duplicate-identifier-value [AL59]

there are duplicate values of known identifiers. okay so this doesn't cause problems while building — but it may cause false positives for users that rely on our secdb to know if something is fixed, and that's kind of a big deal. lowkey serious, highkey serious actually.

Severity: Serious · Certainty: Certain

🍓 ghsl-identifier-formatted-incorrectly [AL63]

last one, and it's the GHSL identifier not being formatted correctly — check the output string for the reason why and you're done, bestie ✨

Severity: Minor · Certainty: Certain

---

aaaand that's the whole page!! you made it to the end, so proud of you 🥹🫶 this was alint(5), dated 2026-10-14 — go forth and lint, and remember: the vibes are immaculate but the whitespace has to be exact 🌈💖