c0wrk-zabbius-git
LOW
maintainer Zabbius
0 votes
scanned 2026-09-11 17:22:59.755085
Why flagged
The package builds from a pinned Git commit of a public fork and uses SKIP for the source checksum, which is suboptimal but not inherently dangerous; the build process compiles code from a known source, and no untrusted prebuilt binaries or remote code execution are involved.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Low
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from a pinned Git commit of a public fork and uses SKIP for the source checksum, which is suboptimal but not inherently dangerous; the build process compiles code from a known source, and no untrusted prebuilt binaries or remote code execution are involved.
PKGBUILD
1
# Maintainer: zabbius <https://github.com/zabbius>
2
# c0wrk CPU flavor (git build pinned to a fixed commit of the fork).
3
#
4
# Symmetric counterpart of c0wrk-zabbius-cuda-git: same binary, same layout,
5
# CPU-only ONNX Runtime (no CUDA provider libraries). Both packages provide
6
# `c0wrk` / `c0wrk-desktop` and conflict with each other, so exactly one
7
# flavor can be installed at a time.
8
#
9
# Layout rationale: the app resolves libonnxruntime.so and models/ RELATIVE to
10
# the real binary path (os.Executable() dereferences the /proc/self/exe
11
# symlink), so the executable tree lives in /opt/c0wrk and /usr/bin/c0wrk-desktop
12
# is an absolute symlink — safe by design.
13
14
pkgname=c0wrk-zabbius-git
15
pkgver=0.7.3.r73.g8689191
16
pkgrel=1
17
pkgdesc='Desktop AI coding-agent built with Wails (Go + React) — CPU flavor, git build'
18
arch=(x86_64 aarch64)
19
url='https://github.com/zabbius/c0wrk'
20
license=(MIT)
21
depends=(gtk3 webkit2gtk-4.1)
22
makedepends=(git go nodejs npm wails)
23
provides=(c0wrk c0wrk-desktop)
24
conflicts=(c0wrk c0wrk-desktop c0wrk-zabbius-cuda-git)
25
options=(!strip)
26
# Deterministic build: the source is pinned to an exact commit (#commit=) and
27
# pkgver is STATIC — there is no pkgver() function on purpose. The version
28
# encodes the pinned commit's position relative to the last tag
29
# (0.7.3.r60.g8f332bbd = tag v0.7.3 + 60 commits + short SHA g8f332bbd) and
30
# is known in advance, so it is written by hand here and only changes when
31
# the pin changes. To move to a newer commit, run ../bump-commit.sh [REF]
32
# from the sibling AUR repo root — it rewrites #commit=, pkgver=, pkgrel=
33
# here and in the CUDA package, and regenerates both .SRCINFO files.
34
# `wails` (AUR) must match the version required by go.mod: v2.15.0.
35
source=(
36
'c0wrk::git+https://github.com/zabbius/c0wrk.git#commit=8689191858ca26db71d6e6068faaef499a26d099'
37
'c0wrk.desktop'
38
)
39
sha256sums=(
40
'SKIP'
41
'817980d6896b98a304ade9b151125408e83bdc00c0e7f006eb5f6d7bb486fe62'
42
)
43
44
build() {
45
# GOTOOLCHAIN=auto lets Go fetch the toolchain pinned by go.mod when the
46
# system one is older; keeps the AUR build working across toolchain bumps.
47
export GOTOOLCHAIN=auto
48
49
# The Wails CLI comes from the `wails` makedepend (AUR); its version must
50
# match the wails/v2 library pinned in go.mod (v2.15.0).
51
cd "$srcdir/c0wrk"
52
53
# `make build` = wails build (webkit2_41 tag) + fetch-onnx (CPU flavor) +
54
# fetch-embedding-model. VERSION/GITCOMMIT are `?=` in the Makefile, so
55
# passing them here overrides the fallback and keeps the About dialog free
56
# of "dev"/"none" placeholders.
57
# NOTE: never call `fetch-onnx-gpu` here — this is the CPU package.
58
make build \
59
VERSION="$(git describe --tags --always)" \
60
GITCOMMIT="$(git rev-parse --short HEAD)"
61
}
62
63
package() {
64
cd "$srcdir/c0wrk"
65
66
# /opt/c0wrk application tree (binary + ONNX Runtime CPU lib + models,
67
# all resolved by the app relative to the real executable path).
68
install -Dm755 build/bin/c0wrk-desktop "$pkgdir/opt/c0wrk/c0wrk-desktop"
69
install -Dm755 build/bin/libonnxruntime.so "$pkgdir/opt/c0wrk/libonnxruntime.so"
70
install -Dm644 build/bin/models/jina-v2-small.onnx "$pkgdir/opt/c0wrk/models/jina-v2-small.onnx"
71
install -Dm644 build/bin/models/jina-v2-small-tokenizer.json "$pkgdir/opt/c0wrk/models/jina-v2-small-tokenizer.json"
72
73
# Absolute symlink: os.Executable() dereferences it to /opt/c0wrk, so the
74
# app still finds libonnxruntime.so and models/ next to the real binary.
75
install -d "$pkgdir/usr/bin"
76
ln -s /opt/c0wrk/c0wrk-desktop "$pkgdir/usr/bin/c0wrk-desktop"
77
78
# Desktop entry, icon and license.
79
install -Dm644 "$srcdir/c0wrk.desktop" "$pkgdir/usr/share/applications/c0wrk.desktop"
80
install -Dm644 build/appicon.png "$pkgdir/usr/share/icons/hicolor/512x512/apps/c0wrk.png"
81
install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
82
}
83
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-11 17:22:59 | Low | 2 |