c0wrk-zabbius-cuda-git
LOW
maintainer Zabbius
0 votes
scanned 2026-09-11 17:22:59.755085
Why flagged
The package builds from a pinned Git commit of a public fork and replaces the CPU ONNX library with a GPU version via `make fetch-onnx-gpu`, which is part of the same project's build process; the only concerns are unverified sources (SKIP'd checksum) and low popularity, but no remote code execution or malicious behavior is present.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Low
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from a pinned Git commit of a public fork and replaces the CPU ONNX library with a GPU version via `make fetch-onnx-gpu`, which is part of the same project's build process; the only concerns are unverified sources (SKIP'd checksum) and low popularity, but no remote code execution or malicious behavior is present.
PKGBUILD
1
# Maintainer: zabbius <https://github.com/zabbius>
2
# c0wrk CUDA flavor (git build pinned to a fixed commit of the fork).
3
#
4
# Symmetric counterpart of c0wrk-zabbius-git: same binary, same layout, plus
5
# the CUDA Execution Provider libraries of ONNX Runtime (the CPU library that
6
# `make build` installs is replaced by the GPU build). Both packages provide
7
# `c0wrk` / `c0wrk-desktop` and conflict with each other, so exactly one
8
# flavor can be installed at a time.
9
#
10
# Layout rationale: the app resolves libonnxruntime.so and models/ RELATIVE to
11
# the real binary path (os.Executable() dereferences the /proc/self/exe
12
# symlink), so the executable tree lives in /opt/c0wrk and /usr/bin/c0wrk-desktop
13
# is an absolute symlink — safe by design.
14
15
pkgname=c0wrk-zabbius-cuda-git
16
pkgver=0.7.3.r73.g8689191
17
pkgrel=1
18
pkgdesc='Desktop AI coding-agent built with Wails (Go + React) — CUDA flavor, git build'
19
arch=(x86_64)
20
url='https://github.com/zabbius/c0wrk'
21
license=(MIT)
22
depends=(gtk3 webkit2gtk-4.1 'cuda>=13' 'cuda<14' nvidia-utils)
23
makedepends=(git go nodejs npm wails)
24
provides=(c0wrk c0wrk-desktop)
25
conflicts=(c0wrk c0wrk-desktop c0wrk-zabbius-git)
26
options=(!strip)
27
# Deterministic build: the source is pinned to an exact commit (#commit=) and
28
# pkgver is STATIC — there is no pkgver() function on purpose. The version
29
# encodes the pinned commit's position relative to the last tag
30
# (0.7.3.r60.g8f332bbd = tag v0.7.3 + 60 commits + short SHA g8f332bbd) and
31
# is known in advance, so it is written by hand here and only changes when
32
# the pin changes. To move to a newer commit, run ../bump-commit.sh [REF]
33
# from the sibling AUR repo root — it rewrites #commit=, pkgver=, pkgrel=
34
# here and in the CPU package, and regenerates both .SRCINFO files.
35
# `wails` (AUR) must match the version required by go.mod: v2.15.0.
36
source=(
37
'c0wrk::git+https://github.com/zabbius/c0wrk.git#commit=8689191858ca26db71d6e6068faaef499a26d099'
38
'c0wrk.desktop'
39
)
40
sha256sums=(
41
'SKIP'
42
'817980d6896b98a304ade9b151125408e83bdc00c0e7f006eb5f6d7bb486fe62'
43
)
44
45
build() {
46
# GOTOOLCHAIN=auto lets Go fetch the toolchain pinned by go.mod when the
47
# system one is older; keeps the AUR build working across toolchain bumps.
48
export GOTOOLCHAIN=auto
49
50
# The Wails CLI comes from the `wails` makedepend (AUR); its version must
51
# match the wails/v2 library pinned in go.mod (v2.15.0).
52
cd "$srcdir/c0wrk"
53
54
# `make build` = wails build (webkit2_41 tag) + fetch-onnx (CPU flavor) +
55
# fetch-embedding-model. VERSION/GITCOMMIT are `?=` in the Makefile, so
56
# passing them here overrides the fallback and keeps the About dialog free
57
# of "dev"/"none" placeholders.
58
make build \
59
VERSION="$(git describe --tags --always)" \
60
GITCOMMIT="$(git rev-parse --short HEAD)"
61
62
# CUDA flavor: swap in the GPU build of ONNX Runtime 1.28.1 (cuda13) on top
63
# of the CPU one `make build` just installed — it replaces libonnxruntime.so
64
# and adds the CUDA/shared provider libraries. Order matters: this MUST run
65
# after `make build`, never before.
66
make fetch-onnx-gpu
67
}
68
69
package() {
70
cd "$srcdir/c0wrk"
71
72
# /opt/c0wrk application tree (binary + ONNX Runtime GPU libs + models,
73
# all resolved by the app relative to the real executable path).
74
install -Dm755 build/bin/c0wrk-desktop "$pkgdir/opt/c0wrk/c0wrk-desktop"
75
install -Dm755 build/bin/libonnxruntime.so "$pkgdir/opt/c0wrk/libonnxruntime.so"
76
install -Dm755 build/bin/libonnxruntime_providers_cuda.so "$pkgdir/opt/c0wrk/libonnxruntime_providers_cuda.so"
77
install -Dm755 build/bin/libonnxruntime_providers_shared.so "$pkgdir/opt/c0wrk/libonnxruntime_providers_shared.so"
78
install -Dm644 build/bin/models/jina-v2-small.onnx "$pkgdir/opt/c0wrk/models/jina-v2-small.onnx"
79
install -Dm644 build/bin/models/jina-v2-small-tokenizer.json "$pkgdir/opt/c0wrk/models/jina-v2-small-tokenizer.json"
80
81
# Absolute symlink: os.Executable() dereferences it to /opt/c0wrk, so the
82
# app still finds libonnxruntime.so and models/ next to the real binary.
83
install -d "$pkgdir/usr/bin"
84
ln -s /opt/c0wrk/c0wrk-desktop "$pkgdir/usr/bin/c0wrk-desktop"
85
86
# Desktop entry, icon and license.
87
install -Dm644 "$srcdir/c0wrk.desktop" "$pkgdir/usr/share/applications/c0wrk.desktop"
88
install -Dm644 build/appicon.png "$pkgdir/usr/share/icons/hicolor/512x512/apps/c0wrk.png"
89
install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
90
}
91
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-11 17:22:59 | Low | 2 |