anki-plus-bin
maintainer zmr233
· 0 votes
· scanned 2026-08-03 00:08:14.047287
MEDIUM
View on AUR ↗
Why flagged
The package installs a prebuilt binary from a non-official, third-party GitHub repository with no upstream source verification beyond a git commit hash, creating a supply-chain risk if the release artifact is tampered with.
Triggered rules
LOW
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
MEDIUM
AI review of an ambiguous pattern
llm_review
The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 85%): The package installs a prebuilt binary from a non-official, third-party GitHub repository with no upstream source verification beyond a git commit hash, creating a supply-chain risk if the release artifact is tampered with.
PKGBUILD
1
# Maintainer: zmr233 <zmr_233@outlook.com>
2
# Upstream: Anki Team <https://github.com/ankitects/anki>
3
4
# 本文件由 prepare.py 从 pre-PKGBUILD 生成，不要直接编辑。
5
#
6
# anki-plus 是 Anki 的特化发行版，源码在 https://github.com/zmr-233/anki-dev
7
# 当前包含的改动：
8
# * 调度时区与设备 OS 时区解耦（collection config `schedTimezone`，IANA 名，
9
# 按被调度的时刻分别求偏移，因此 DST 正确）
10
# * 日界支持分钟精度（collection config `rolloverMinute`）
11
# 两者都是普通 config，AnkiWeb 当作不透明 JSON 原样往返，不触发全量同步。
12
#
13
# 预编译包：wheel 由 https://github.com/zmr-233/anki-workspace 的 tag 触发 CI 产出。
14
# `_rsbridge.so` 是 pyo3 abi3（cp310-abi3）扩展，sqlite / zstd 静态链入、TLS 走
15
# rustls，因此只依赖 glibc + libgcc，不随 Arch 的 python / sqlite / openssl 升级而失效。
16
17
_pkgname=anki
18
pkgname=anki-plus-bin
19
pkgver=26.05.2
20
pkgrel=1
21
22
# 本包对应的确切源码（AGPL 要求可指回，写仓库名不够）：
23
# git clone https://github.com/zmr-233/anki-dev && git checkout baf44f63312a3bf6eac28ea5572449ad45e8d9cf
24
_srcref=baf44f63312a3bf6eac28ea5572449ad45e8d9cf
25
26
# 上游 .version，用于 provides 的版本号
27
_ankiver=26.05
28
# PEP 440 归一化之后的版本，决定 wheel 的文件名（26.05 → 26.5）
29
_wheelver=26.5
30
31
pkgdesc="Anki with a pinned scheduling timezone and minute-level day rollover (prebuilt)"
32
arch=('x86_64')
33
url="https://github.com/zmr-233/anki-dev"
34
license=('AGPL-3.0-or-later')
35
36
provides=("$_pkgname=$_ankiver")
37
conflicts=("$_pkgname" 'anki-git' 'anki-snapshot')
38
39
# 运行时依赖对齐 pylib/pyproject.toml + qt/pyproject.toml。
40
# 与 extra/anki 的差异：
41
# + python-truststore / python-packaging / python-typing_extensions / python-asgiref
42
# （26.05 之后新增或此前漏掉的，flask[async] 的 extra 需要 asgiref）
43
# - python-flask-cors（上游已不再引用，全树 grep 无命中）
44
# - sqlite / zstd（本包静态链入，见文件头）
45
depends=(
46
'glibc'
47
'libgcc'
48
'python'
49
'python-asgiref'
50
'python-beautifulsoup4'
51
'python-decorator'
52
'python-distro'
53
'python-flask'
54
'python-jsonschema'
55
'python-markdown'
56
'python-orjson'
57
'python-packaging'
58
'python-protobuf'
59
'python-pyqt6'
60
'python-pyqt6-webengine'
61
'python-pysocks'
62
'python-requests'
63
'python-send2trash'
64
'python-truststore'
65
'python-typing_extensions'
66
'python-urllib3' # anki/httpclient.py 直接 import，不只是 requests 的传递依赖
67
'python-waitress'
68
'qt6-multimedia' # 录音插件，运行时加载
69
'qt6-svg' # SVG 图标插件，运行时加载
70
)
71
72
makedepends=('python-installer')
73
74
optdepends=(
75
'lame: record sound'
76
'mpv: play sound. prefered over mplayer'
77
'mplayer: play sound'
78
'texlive-most: render LaTex in cards'
79
)
80
81
# 预编译包不做 debug 分包：tarball 里没有源码，makepkg 生成的 -debug 包会指向不存在的路径
82
options=('!debug')
83
84
# 产物挂在 workspace 仓库的 release 上：只有它同时看得见 anki / 后端 / AnkiDroid
85
# 三条构建链，一个 tag 才能代表一次完整的发行
86
_releases="https://github.com/zmr-233/anki-workspace/releases/download"
87
_tarball="$pkgname-$pkgver-$CARCH.tar.zst"
88
source_x86_64=("$_tarball::$_releases/v$pkgver/$_tarball")
89
sha256sums_x86_64=('3a27eb64e51dd3596d08ae9eb863a8c5afc00604518b25ebc14b219d122b36f6')
90
91
package() {
92
cd "$srcdir/$pkgname-$pkgver-$CARCH"
93
94
# anki-<wheelver>-cp310-abi3-manylinux_2_35_x86_64.whl（含 _rsbridge.so）
95
# aqt-<wheelver>-py3-none-any.whl（纯 Python）
96
# installer 按构建机的 python 决定 site-packages 路径，所以不写死 python3.x
97
for _whl in wheels/*.whl; do
98
python -m installer --destdir="$pkgdir" "$_whl"
99
done
100
101
install -vDm644 -t "$pkgdir/usr/share/applications" share/anki.desktop
102
install -vDm644 -t "$pkgdir/usr/share/pixmaps" share/anki.png share/anki.xpm
103
install -vDm644 -t "$pkgdir/usr/share/man/man1" share/anki.1
104
install -vDm644 -t "$pkgdir/usr/share/mime/packages" share/anki.xml
105
}
106
Changes since previous scan
--- PKGBUILD @ 2026-07-27 13:35+++ PKGBUILD @ 2026-08-03 00:08@@ -16,7 +16,7 @@ _pkgname=anki pkgname=anki-plus-bin-pkgver=26.05.1+pkgver=26.05.2 pkgrel=1 # 本包对应的确切源码（AGPL 要求可指回，写仓库名不够）：@@ -86,7 +86,7 @@ _releases="https://github.com/zmr-233/anki-workspace/releases/download" _tarball="$pkgname-$pkgver-$CARCH.tar.zst" source_x86_64=("$_tarball::$_releases/v$pkgver/$_tarball")-sha256sums_x86_64=('28b030ff71b2d0347a9472311dd5d00596626b04a0fd1dc466914d14d19b82a5')+sha256sums_x86_64=('3a27eb64e51dd3596d08ae9eb863a8c5afc00604518b25ebc14b219d122b36f6') package() { cd "$srcdir/$pkgname-$pkgver-$CARCH"Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | MEDIUM | 2 |
| 2026-08-02 00:16:08 | MEDIUM | 2 |
| 2026-08-01 00:11:18 | MEDIUM | 2 |
| 2026-07-31 00:14:10 | MEDIUM | 2 |
| 2026-07-30 00:17:23 | MEDIUM | 2 |
| 2026-07-29 00:25:53 | MEDIUM | 2 |
| 2026-07-28 00:07:28 | MEDIUM | 2 |
| 2026-07-27 17:35:03 | MEDIUM | 2 |
| 2026-07-27 13:35:00 | LOW | 2 |