concat-bin
LOW
maintainer Felitendo
1 votes
scanned 2026-09-19 23:31:49.152818
Why flagged
The package installs a prebuilt binary from the project's official GitHub releases, which is a normal distribution method for some projects; while the binary is not built from source, it comes from a trusted project host and there is no evidence of malicious behavior or supply-chain redirection.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Low
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package installs a prebuilt binary from the project's official GitHub releases, which is a normal distribution method for some projects; while the binary is not built from source, it comes from a trusted project host and there is no evidence of malicious behavior or supply-chain redirection.
PKGBUILD
1
# Maintainer: Felitendo
2
# This PKGBUILD is updated automatically:
3
# https://github.com/Felitendo/PKGBUILDS
4
5
pkgname=concat-bin
6
pkgver=0.2.3
7
pkgrel=1
8
pkgdesc="Free and open-source CapCut replacement, a video editor with a Rust engine (upstream binary)"
9
arch=('x86_64' 'aarch64')
10
url="https://github.com/jub0t/Concat"
11
# The binary is Concat under the AGPL; the FFmpeg libraries it ships beside
12
# itself are a GPL build. Both licence texts land in the package: the
13
# repository's LICENSE, and upstream's notices file, which is what names the
14
# terms of everything linked in - FFmpeg, Slint under its GPL option,
15
# whisper.cpp, sherpa-onnx.
16
license=('AGPL-3.0-or-later' 'GPL-3.0-or-later')
17
# Nothing is spawned at run time: FFmpeg is linked, whisper.cpp and
18
# sherpa-onnx are compiled in, and ONNX Runtime ships in the same lib/
19
# directory. What is left is what the binary loads by name - the ALSA backend
20
# of cpal, fontconfig and freetype for text, and the windowing libraries
21
# winit and the renderer open: EGL, Wayland, X11 and xkbcommon. dbus is the
22
# XDG portal, which is how the file dialogs and "reveal in file manager" work
23
# without a toolkit.
24
depends=('alsa-lib' 'fontconfig' 'freetype2' 'libglvnd' 'libxkbcommon'
25
'libxkbcommon-x11' 'libx11' 'libxcursor' 'libxi' 'libxrender'
26
'wayland' 'dbus' 'gcc-libs' 'glibc' 'hicolor-icon-theme')
27
provides=('concat')
28
conflicts=('concat')
29
# !strip: upstream's binary is already stripped, and the FFmpeg and ONNX
30
# Runtime libraries beside it are theirs to ship as they are.
31
options=('!strip' '!debug')
32
# Upstream's Linux packages carry one self-contained folder: the binary and
33
# the libraries it was linked against - FFmpeg 8 (Arch is on 9) and ONNX
34
# Runtime, the cutout models' runtime. They go to /opt/concat, where the
35
# binary's own rpath ($ORIGIN/lib) finds them, which is also where upstream's
36
# .deb puts them and what its desktop entry points at.
37
#
38
# Of the three Linux artifacts - .deb, .rpm and AppImage - the .deb is the
39
# plain one: an ar archive around that folder, with no runtime wrapped around
40
# it and nothing to mount.
41
#
42
# The asset name carries the workspace's version, not the tag (a prerelease of
43
# 0.2.4 ships Concat-0.2.4-linux-x86_64.deb whatever its tag says), so both
44
# the tag and that version are resolved through the release manifest and
45
# synced here along with the checksums; see pkg.sh.
46
_tag="v0.2.3"
47
_relver="0.2.3"
48
source_x86_64=("${pkgname}-${pkgver}-x86_64.deb::https://github.com/jub0t/Concat/releases/download/${_tag}/Concat-${_relver}-linux-x86_64.deb")
49
source_aarch64=("${pkgname}-${pkgver}-aarch64.deb::https://github.com/jub0t/Concat/releases/download/${_tag}/Concat-${_relver}-linux-aarch64.deb")
50
noextract=("${pkgname}-${pkgver}-x86_64.deb" "${pkgname}-${pkgver}-aarch64.deb")
51
sha256sums_x86_64=('01d2fb58521038a426429f1543ab2ec2359aa428a9dfd1b8948ce97b7d79c6c3')
52
sha256sums_aarch64=('3bd3f6bcfb165141b50b1ca2d3ab1b070f7e5a0e9f86a3c9ec121c4b5085a220')
53
54
package() {
55
# -p: lib/ is the usual set of soname symlinks beside the real files, and
56
# only an extraction that preserves them keeps the rpath working.
57
bsdtar -xOf "$srcdir/${pkgname}-${pkgver}-${CARCH}.deb" 'data.tar.*' \
58
| bsdtar -xpf - -C "$pkgdir" ./opt ./usr
59
60
# upstream ships them as documentation; on Arch they belong here
61
install -d "$pkgdir/usr/share/licenses"
62
mv "$pkgdir/usr/share/doc/concat" "$pkgdir/usr/share/licenses/$pkgname"
63
rmdir "$pkgdir/usr/share/doc"
64
}
65
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-19 23:31:49 | Low | 2 |