concat
LOW
maintainer Felitendo
0 votes
scanned 2026-09-19 23:31:49.152818
Why flagged
The package builds from source hosted on GitHub and includes a prebuilt static library from a trusted upstream release; no remote code execution or malicious behavior is present, and dependencies are standard for the application.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Low
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from source hosted on GitHub and includes a prebuilt static library from a trusted upstream release; no remote code execution or malicious behavior is present, and dependencies are standard for the application.
PKGBUILD
1
# Maintainer: Felitendo
2
# This PKGBUILD is updated automatically:
3
# https://github.com/Felitendo/PKGBUILDS
4
5
pkgname=concat
6
pkgver=0.2.3
7
pkgrel=1
8
pkgdesc="Free and open-source CapCut replacement, a video editor with a Rust engine"
9
arch=('x86_64')
10
url="https://github.com/jub0t/Concat"
11
license=('AGPL-3.0-or-later')
12
# Nothing is spawned at run time: FFmpeg is linked, whisper.cpp and
13
# sherpa-onnx are compiled in. alsa-lib is cpal's playback backend;
14
# fontconfig and freetype are the font side of the renderer; libglvnd and
15
# vulkan-icd-loader are the two backends wgpu picks between, and the rest is
16
# what winit opens by name for whichever session the user is in. dbus is the
17
# XDG portal, which is how the file dialogs and "reveal in file manager"
18
# work without a toolkit. onnxruntime runs the cutout models and is linked
19
# dynamically, see ORT_LIB_LOCATION in build().
20
depends=('ffmpeg' 'onnxruntime' 'alsa-lib' 'fontconfig' 'freetype2'
21
'libglvnd' 'vulkan-icd-loader' 'libxkbcommon' 'libxkbcommon-x11'
22
'libx11' 'libxcursor' 'libxi' 'libxrender' 'wayland' 'dbus'
23
'gcc-libs' 'glibc' 'hicolor-icon-theme')
24
# clang: bindgen (FFmpeg headers, whisper.cpp) needs libclang.
25
# cmake: whisper.cpp is compiled in, by its own CMake build.
26
makedepends=('rust' 'cmake' 'clang' 'pkgconf')
27
# !debug: the app profile strips symbols itself, so there is nothing left to
28
# split into a debug package.
29
# !lto: makepkg's lto puts -flto=auto into CFLAGS, and ring - the crypto
30
# behind the model downloads' TLS - compiles hand-written assembly through
31
# cc, which comes out as bitcode and links to nothing. Rust's own LTO is set
32
# in the app profile and is unaffected.
33
options=('!debug' '!lto')
34
# Only tags that start with a version are packaged, and pkgver drops their
35
# hyphens (v0.2.2-alpha.1 -> 0.2.2alpha.1), which pacman sorts older than a
36
# later plain 0.2.2, so no epoch is needed. See pkg.sh.
37
_tag="v0.2.3"
38
# sherpa-onnx-sys (the text-to-speech backend) does not build its C++ side:
39
# it downloads a prebuilt static-lib archive from its own release page unless
40
# it is handed one. Handing it one keeps that binary under makepkg's
41
# checksums instead of arriving unverified from a build script. The version
42
# follows upstream's Cargo.lock and is synced by pkg.sh.
43
_sherpa="1.13.7"
44
source=("${pkgname}-${pkgver}.tar.gz::https://github.com/jub0t/Concat/archive/refs/tags/${_tag}.tar.gz"
45
"https://github.com/k2-fsa/sherpa-onnx/releases/download/v${_sherpa}/sherpa-onnx-v${_sherpa}-linux-x64-static-lib.tar.bz2")
46
noextract=("sherpa-onnx-v${_sherpa}-linux-x64-static-lib.tar.bz2")
47
sha256sums=('bfb8a2fdcb1c1b7900efdf0bfc67c5e310a23a1c7a1535f85470e070c0486f52' 'd1be7a69ac2b30120058d8302e624239a3064085383cfa47994a14fdc44c32d6')
48
49
_srcname="Concat-${_tag#v}"
50
51
prepare() {
52
cd "$_srcname/src"
53
54
export RUSTUP_TOOLCHAIN=stable
55
cargo fetch --locked --target "$(rustc -vV | sed -n 's/^host: //p')"
56
}
57
58
build() {
59
cd "$_srcname/src"
60
61
export RUSTUP_TOOLCHAIN=stable
62
export CARGO_TARGET_DIR=target
63
# the checksummed archive from source[1], instead of a download in build()
64
export SHERPA_ONNX_ARCHIVE_DIR="$srcdir"
65
# ort, the ONNX Runtime binding behind the cutout models, downloads a
66
# prebuilt runtime from its build script unless it is pointed at one. Arch
67
# has the library, so it is linked against that instead - dynamically, so
68
# the package follows onnxruntime's updates rather than freezing a copy.
69
# Upstream's flake.nix does the same with nixpkgs' onnxruntime.
70
export ORT_LIB_LOCATION=/usr/lib
71
export ORT_PREFER_DYNAMIC_LINK=1
72
# and if that ever stops being picked up, fail the build instead of
73
# quietly falling back to the download
74
export ORT_SKIP_DOWNLOAD=1
75
# ggml (whisper.cpp's kernels) tunes itself to the machine it is compiled
76
# on unless told otherwise. A package is not always built on the machine it
77
# runs on, and a binary that faults on a CPU without AVX-512 is a bad trade
78
# for kernels nobody measured. Off, it compiles to the portable baseline.
79
export GGML_NATIVE=OFF
80
81
# --features wgpu: FemtoVG over wgpu instead of the default Skia renderer.
82
# skia-bindings downloads prebuilt binaries from its build script, which a
83
# package cannot do; the wgpu renderer is pure Rust. This is the same
84
# choice, for the same reason, that upstream's flake.nix makes.
85
#
86
# --profile app: upstream's shipping profile - fat LTO, panic=abort,
87
# stripped. See src/Cargo.toml for what each knob is for.
88
cargo build --profile app -p concat --frozen \
89
--no-default-features --features wgpu
90
}
91
92
package() {
93
cd "$_srcname"
94
95
install -Dm755 "src/target/app/concat" "$pkgdir/usr/bin/concat"
96
97
# The desktop entry upstream's release workflow writes into its Linux
98
# packages; there is none in the tree, because the Nix build generates its
99
# own. Reproduced here, with the Exec line pointing at this package's
100
# binary rather than at the /opt folder upstream's .deb installs.
101
install -Dm644 /dev/stdin "$pkgdir/usr/share/applications/concat.desktop" <<'EOF'
102
[Desktop Entry]
103
Type=Application
104
Name=Concat
105
Comment=Video editor
106
Exec=concat %U
107
Icon=concat
108
Categories=AudioVideo;Video;
109
Terminal=false
110
EOF
111
112
install -Dm644 "assets/icons/concat_logo_256.png" \
113
"$pkgdir/usr/share/icons/hicolor/256x256/apps/concat.png"
114
install -Dm644 "assets/concat_logo_512.png" \
115
"$pkgdir/usr/share/icons/hicolor/512x512/apps/concat.png"
116
117
install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
118
install -Dm644 LICENSE-EXCEPTIONS.md \
119
"$pkgdir/usr/share/licenses/$pkgname/LICENSE-EXCEPTIONS.md"
120
install -Dm644 THIRD_PARTY_NOTICES.md \
121
"$pkgdir/usr/share/licenses/$pkgname/THIRD_PARTY_NOTICES.md"
122
}
123
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-19 23:31:49 | Low | 2 |