concat-git
LOW
maintainer Felitendo
0 votes
scanned 2026-08-31 13:45:31.809418
Why flagged
The package builds from the project's own git repository, has no obfuscated code or remote execution, and depends only on standard build tools and declared dependencies; the low severity is due to few votes and recent upload, not inherent risk.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Low
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from the project's own git repository, has no obfuscated code or remote execution, and depends only on standard build tools and declared dependencies; the low severity is due to few votes and recent upload, not inherent risk.
PKGBUILD
1
# Maintainer: Felitendo
2
# This PKGBUILD is updated automatically:
3
# https://github.com/Felitendo/PKGBUILDS
4
5
pkgname=concat-git
6
pkgver=0.2.0.alpha.16.r0.g8938ec3
7
pkgrel=1
8
pkgdesc="Free and open-source CapCut replacement, a Tauri video editor with a Rust engine (git)"
9
arch=('x86_64')
10
url="https://github.com/jub0t/Concat"
11
license=('MPL-2.0')
12
# glib-networking is what gives the webview a TLS backend; alsa-lib is the
13
# engine's cpal playback backend; every media operation spawns the ffmpeg
14
# pair - see the WOLFCUT_SYSTEM_TOOLS note below. The model downloads carry
15
# their own TLS (rustls), so nothing here links openssl.
16
depends=('webkit2gtk-4.1' 'gtk3' 'glib2' 'libsoup3' 'gdk-pixbuf2' 'cairo'
17
'dbus' 'glib-networking' 'alsa-lib' 'ffmpeg' 'gcc-libs' 'glibc'
18
'hicolor-icon-theme')
19
makedepends=('rust' 'npm' 'pkgconf' 'git')
20
# wgpu picks its backend at run time: Vulkan first, GL as the fallback. Both
21
# loaders come from the driver stack every desktop already has, so neither is
22
# a hard dependency of the editor.
23
optdepends=('whisper-cpp: on-device auto-captions and transcription'
24
'vulkan-icd-loader: Vulkan compositor backend'
25
'libglvnd: OpenGL compositor backend')
26
provides=('concat')
27
conflicts=('concat')
28
# !debug: the release profile already sets strip = true, so there is nothing
29
# left to split into a debug package.
30
# !lto: makepkg's lto puts -flto=auto into CFLAGS, and ring - the crypto
31
# behind the model downloads' TLS - compiles hand-written assembly through
32
# cc, which comes out as bitcode and links to nothing. Rust's own LTO is set
33
# in the release profile and is unaffected.
34
options=('!debug' '!lto')
35
source=("${pkgname}::git+https://github.com/jub0t/Concat.git")
36
sha256sums=('SKIP')
37
38
pkgver() {
39
cd "$pkgname"
40
git describe --long --abbrev=7 --tags --match 'v[0-9]*' \
41
| sed 's/^v//; s/\([^-]*-g\)/r\1/; s/-/./g'
42
}
43
44
prepare() {
45
cd "$pkgname/desktop"
46
47
# the frontend toolchain (vite, tsc, tailwind) and the crate registry
48
npm ci --cache "$srcdir/npm-cache"
49
50
export RUSTUP_TOOLCHAIN=stable
51
cd src-tauri
52
cargo fetch --locked --target "$(rustc -vV | sed -n 's/^host: //p')"
53
}
54
55
build() {
56
cd "$pkgname/desktop"
57
58
export RUSTUP_TOOLCHAIN=stable
59
export CARGO_TARGET_DIR=target
60
61
# build.rs refuses a release build without a staged ffmpeg/whisper-cli,
62
# because a bundle that ships without them is broken when launched from a
63
# desktop file with no PATH to fall back on. A distribution package is the
64
# documented exception: the lookups fall back to PATH, and ffmpeg and
65
# whisper-cpp are packaged for Arch already.
66
export WOLFCUT_SYSTEM_TOOLS=1
67
68
# vite build -> desktop/dist, which tauri-build embeds into the binary
69
npm run build
70
71
cd src-tauri
72
# sherpa-onnx-sys, the text-to-speech backend, ships no C++ build: its build
73
# script downloads a prebuilt static-lib archive from its own release page.
74
# concat pins that archive as a checksummed source; here the version moves
75
# with main, so the build script fetches it - build() needs the network.
76
cargo build --release --frozen
77
}
78
79
package() {
80
cd "$pkgname"
81
82
# same paths the upstream .deb installs: the project is mid-rename and its
83
# executable, desktop entry and icons all still carry the old name
84
install -Dm755 "desktop/src-tauri/target/release/wolfcut-desktop" \
85
"$pkgdir/usr/bin/wolfcut-desktop"
86
87
# the AUR package is named after the project, the executable after what the
88
# project used to be called - keep it reachable under both
89
ln -s wolfcut-desktop "$pkgdir/usr/bin/concat"
90
91
# tauri only writes a desktop entry when it bundles, and the one it puts in
92
# the .deb has an empty Categories=. This is that entry with the categories
93
# upstream's Nix build sets.
94
install -Dm644 /dev/stdin "$pkgdir/usr/share/applications/WolfCut.desktop" <<'EOF'
95
[Desktop Entry]
96
Type=Application
97
Name=WolfCut
98
Comment=Free and open source video editor
99
Exec=wolfcut-desktop
100
Icon=wolfcut-desktop
101
Terminal=false
102
Categories=AudioVideo;AudioVideoEditing;
103
StartupWMClass=wolfcut-desktop
104
EOF
105
106
install -Dm644 "desktop/src-tauri/icons/32x32.png" \
107
"$pkgdir/usr/share/icons/hicolor/32x32/apps/wolfcut-desktop.png"
108
install -Dm644 "desktop/src-tauri/icons/128x128.png" \
109
"$pkgdir/usr/share/icons/hicolor/128x128/apps/wolfcut-desktop.png"
110
install -Dm644 "desktop/src-tauri/icons/128x128@2x.png" \
111
"$pkgdir/usr/share/icons/hicolor/256x256@2/apps/wolfcut-desktop.png"
112
113
install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
114
}
115
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-31 13:45:31 | Low | 2 |