Hi,

Here's how I would have wrote it (see commented changes at the bottom):

# Maintainer: Minecraftchest1 <minecraftchest1 at outlook dot com>

pkgname=file-sharing-tool
pkgver=0.2.0
pkgrel=1
pkgdesc="A tool to help setup file sharing using ssh."
arch=('any')
url="https://gitlab.com/minecraftchest1/steamdeck-file-share-tool"
license=('GPL3')
depends=('openssh' 'zenity')
makedepends=('git')
source=("git+${url}#tag=${pkgver}")
sha256sums=('SKIP')

package() {
        cd "${srcdir}"
        install -Dm 755 "bin/${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
}

Changes:

- Deleted every empty/not used variables to make the PKGBUILD more readable.
- Deleted 'sed' and 'bash' from the "depends" array. Indeed, they belong to the "base" group package [1], which contains the set of packages that define a basic Arch Linux installation. Base group's members don't necessarily have to be listed as dependencies since you expect people to have them installed anyway.
- Deleted 'coreutils' from the "makedepends" array for the same reason as above. By the way, the same rules apply for "base devel" metapackage's members [2], as far as AUR package are concerns [3].
- Added 'git' to "makedepends". Indeed, since you're not relying on a release archive but rather of a "git cloned" repo in the "source" array, "git" is needed to download and install your package.
- Populated the use of variables in the "source" array and in the "package" function instead of re-typing raw metadata (url, package name, source directory, etc...). Obviously you don't have to, but that's more elegant I guess.
- Deleted the "validgpgkey" array since it doesn't appear to be used.
- Modified the "install" command in the "package" function to install the package with proper permissions and with a proper name (without ".sh").

I wrote that on the go, I didn't test the PKGBUILD myself so make sure it works correctly on your side :)
I would eventually suggest making a release of your package on GitLab so you could rely on a release's archive in the "source" array instead of "git cloning" the repo from a specific tag. That would allow you to check the integrity of the download source instead of skipping it ("sha256sums=('SKIP')"), which is a more trusty in my opinion.
Also, as "Fabio Loli" wrote in his answer, you should eventually add a license file/indication in the GitLab repo.

I let anyone else add more details/thoughts if needed.

[1] https://archlinux.org/packages/core/any/base/
[2] https://archlinux.org/groups/x86_64/base-devel/
[3] https://wiki.archlinux.org/title/Arch_User_Repository#Prerequisites

Regards,
Antiz (Robin C.)

Il 12/12/22 19:03, Wyatt C Jackson ha scritto:

I recently put together a PKGBUILD file for a tool I made and want to put on the AUR. While I believe it should be fine, I would like to have it reviewed before I upload it.

---
```
# Maintainer: Minecraftchest1 <minecraftchest1 at outlook dot com>
pkgname=file-sharing-tool
pkgver=0.2.0
pkgrel=1
epoch=
pkgdesc="A tool to help setup file sharing using ssh."
arch=('any')
url="https://gitlab.com/minecraftchest1/steamdeck-file-share-tool"
license=('GPL3')
groups=()
depends=('openssh' 'zenity' 'sed' 'bash')
makedepends=('coreutils')
checkdepends=()
optdepends=()
provides=()
conflicts=()
replaces=()
backup=()
options=()
install=
changelog=
source=("git+https://gitlab.com/minecraftchest1/steamdeck-file-share-tool#tag=$pkgver")
noextract=()
md5sums=()
validpgpkeys=('B136A3601568A8CE2493')
sha256sums=('SKIP')

package() {
         cd steamdeck-file-share-tool
         install -D -v bin/file-sharing-tool.sh -t $pkgdir/usr/bin
}
```

Hello,

missing git as makedepends
makedepends on coreutils not needed
there is validpgpkeys but is not checked in source=()
there isn't a license or a license indication in your source repo
please remove unused fields
please install the script as file-sharing-tool (without .sh)

--
Regards,
Antiz (Robin C.)