Arch Linux User Repository

Addressed some of the reported issues.

• Pinned tree-sitter-haskell fork to specific commit
• Specified RUSTUP_HOME and CARGO_HOME to directory within "$srcdir", this would help avoid mutating state of builder's home directory

https://github.com/manticore-projects/aurscan/ reports:

[ SUSP ] oh-my-pi (confidence 86%)
  The bun invocation is a normal, lockfile-controlled build step for this Bun project, and SKIP is standard for a VCS source. However, build()
  conditionally downloads and installs a Rust toolchain into the builder's home directory, creating an unpinned build-time network and
  execution path outside makepkg sources.
  [warning] PKGBUILD: Downloads and installs executable compiler components during build instead of declaring a fixed toolchain
  dependency/source; it also modifies the builder's Rust home.
  [info] PKGBUILD: This appears directly related to building the Bun-based upstream project and uses its frozen lockfile; it does not match
  the unrelated-package campaign signature.
  [info] PKGBUILD: The skipped checksum applies to the Git VCS source, which is conventional for makepkg VCS sources; both local patches are
  checksum-pinned.
  [warning] tree-sitter-haskell-new-repo.patch: The patch replaces a checksummed registry crate with a Git branch dependency. Cargo.lock pins
  commit 98aedbd, but the supplied files cannot independently establish that this repository is
  the legitimate upstream.
!! Build blocked: 1 package(s) flagged SUSPICIOUS.

And in slightly different words:

  [warning] PKGBUILD: Performs an unpinned network download during build and modifies the builder's rustup state outside $srcdir/$pkgdir.
  [warning] PKGBUILD: Confirms reliance on tooling installed in the builder's home directory, making the build non-hermetic and causing
  out-of-tree state changes.
  [info] PKGBUILD: This matches the project's Bun build workflow and is not evidently an unrelated Atomic Arch-style dependency installation.
  [info] PKGBUILD: SKIP applies only to the Git VCS source, which is normal makepkg practice; both local patches have fixed SHA-256 checksums.
  [warning] tree-sitter-haskell-new-repo.patch: The patch changes a registry dependency to a moving Git branch. Cargo.lock currently pins a
  commit, but provenance and reproducibility are weaker than a released, checksummed crate.

The main issue here is not setting $GOPATH` and thus making changes outside of the build directory.

Analogously: https://doc.rust-lang.org/cargo/guide/cargo-home.html

SUGGESTION: Can the required rust be swapped out for rustup in makedepends()?

It could save a bit of disk space, and also speed up the install... nightly changes nightly :)

I updated this package to track upstream git tag directly, this will resolve the incorrect hash issue.

Upstream might force push a new release tag in case previous tagged commit have failed CI job, so it's possible that hash of a tagged tarball changed later.

Looks like the hash is wrong for some reason.