ente-duckling-bin
maintainer nojo
· 0 votes
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The package installs a prebuilt binary from the project's official GitHub releases, which is normal for bundled executables; the source is trustworthy and checksummed, and the wrapper script is transparent and security-conscious, posing no remote code execution or supply-chain risk.
Triggered rules
LOW
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
LOW
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package installs a prebuilt binary from the project's official GitHub releases, which is normal for bundled executables; the source is trustworthy and checksummed, and the wrapper script is transparent and security-conscious, posing no remote code execution or supply-chain risk.
PKGBUILD
1
# Maintainer: Nikolay Bryskin <nbryskin@gmail.com>
2
pkgname=ente-duckling-bin
3
_pkgname=duckling
4
pkgver=0.2.1
5
pkgrel=1
6
pkgdesc='Headless ente client — runs ente desktop'\''s audited upload/auth/crypto code as a single binary, no Electron'
7
arch=('x86_64' 'aarch64')
8
url='https://github.com/dustindoan/duckling'
9
license=('AGPL-3.0-only')
10
depends=('glibc')
11
optdepends=('ffmpeg: video thumbnails and metadata extraction during upload')
12
# Upstream name "duckling" collides on the AUR with an unrelated project
13
# (l1xnan's DB viewer), so the package is named ente-duckling-bin. The binary
14
# and command stay "duckling" (upstream UX); provides/conflicts track the
15
# would-be source package ente-duckling, not the ambiguous bare "duckling".
16
provides=("ente-duckling=$pkgver")
17
conflicts=("ente-duckling")
18
# Prebuilt bun --compile binary: the JS bundle is appended to the ELF, so
19
# stripping would corrupt it. No debug info to package either.
20
options=('!strip' '!debug')
21
install="$pkgname.install"
22
source=("$_pkgname-$pkgver.LICENSE::https://raw.githubusercontent.com/dustindoan/$_pkgname/v$pkgver/LICENSE")
23
source_x86_64=("$_pkgname-$pkgver-linux-x64.zip::$url/releases/download/v$pkgver/$_pkgname-v$pkgver-linux-x64.zip")
24
source_aarch64=("$_pkgname-$pkgver-linux-arm64.zip::$url/releases/download/v$pkgver/$_pkgname-v$pkgver-linux-arm64.zip")
25
sha256sums=('0d96a4ff68ad6d4b6f1f30f713b18d5184912ba8dd389f86aa7710db079abcb0')
26
sha256sums_x86_64=('69774b53dc1272e047aa5bfcc28c17724ee96042f62cba33ad5afa60301e14eb')
27
sha256sums_aarch64=('54ad3b08e4af5257a205da19b13279efebabbc69b37c85a325e005c027a97b74')
28
29
package() {
30
local _bin
31
case "$CARCH" in
32
x86_64) _bin="$_pkgname-linux-x64" ;;
33
aarch64) _bin="$_pkgname-linux-arm64" ;;
34
esac
35
36
# Real upstream binary in a private libdir. /usr/bin/duckling is the wrapper
37
# below. DUCKLING_FFMPEG_PATH's "sibling of binary, then PATH" lookup still
38
# resolves /usr/bin/ffmpeg through the PATH fallback.
39
install -Dm755 "$_bin" "$pkgdir/usr/lib/$pkgname/duckling"
40
41
# Upstream duckling has no config file — it reads its DUCKLING_* settings
42
# only from the environment. This wrapper sources an XDG config file so
43
# settings like DUCKLING_ENDPOINT can be set persistently, and defaults
44
# session/token storage to the XDG state dir (XDG_STATE_HOME) instead of
45
# ~/.duckling. The binary creates the state dir itself, recursively, 0700.
46
install -d "$pkgdir/usr/bin"
47
cat > "$pkgdir/usr/bin/$_pkgname" <<'WRAPPER'
48
#!/bin/sh
49
# Persistent settings: a POSIX shell fragment sourced on every run, e.g.
50
# export DUCKLING_ENDPOINT=https://your-museum.example.org
51
_cfg="${XDG_CONFIG_HOME:-$HOME/.config}/duckling/env"
52
[ -r "$_cfg" ] && . "$_cfg"
53
54
# Session/token storage. Honour an explicit DUCKLING_STATE_DIR (from the env or
55
# the config file above); else keep a pre-existing ~/.duckling so old logins
56
# survive; else default to the XDG state dir.
57
if [ -z "${DUCKLING_STATE_DIR:-}" ]; then
58
if [ -d "$HOME/.duckling" ]; then
59
DUCKLING_STATE_DIR="$HOME/.duckling"
60
else
61
DUCKLING_STATE_DIR="${XDG_STATE_HOME:-$HOME/.local/state}/duckling"
62
fi
63
export DUCKLING_STATE_DIR
64
fi
65
66
exec /usr/lib/ente-duckling-bin/duckling "$@"
67
WRAPPER
68
chmod 755 "$pkgdir/usr/bin/$_pkgname"
69
70
install -Dm644 "$_pkgname-$pkgver.LICENSE" \
71
"$pkgdir/usr/share/licenses/$pkgname/LICENSE"
72
73
# Template for the config file the wrapper sources.
74
install -d "$pkgdir/usr/share/doc/$pkgname"
75
cat > "$pkgdir/usr/share/doc/$pkgname/env.example" <<'ENVEXAMPLE'
76
# duckling settings — a POSIX shell fragment sourced by /usr/bin/duckling.
77
# Copy to "${XDG_CONFIG_HOME:-$HOME/.config}/duckling/env" and edit.
78
79
# Museum API endpoint (default https://api.ente.io):
80
#export DUCKLING_ENDPOINT=https://your-museum.example.org
81
82
# Session/token storage (default ~/.local/state/duckling, or a pre-existing
83
# ~/.duckling):
84
#export DUCKLING_STATE_DIR="$HOME/.local/state/duckling"
85
86
# ffmpeg binary for video thumbnails/metadata (default: found on PATH):
87
#export DUCKLING_FFMPEG_PATH=/usr/bin/ffmpeg
88
ENVEXAMPLE
89
}
90
91
# vim: ts=4 sw=4 et:
92
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 2 |
| 2026-08-02 00:16:08 | LOW | 2 |
| 2026-08-01 00:11:18 | LOW | 2 |
| 2026-07-31 00:14:10 | LOW | 2 |
| 2026-07-30 00:17:23 | LOW | 2 |
| 2026-07-29 00:25:53 | LOW | 2 |
| 2026-07-28 00:07:28 | LOW | 2 |
| 2026-07-27 00:24:32 | LOW | 2 |
| 2026-07-26 00:07:32 | LOW | 2 |
| 2026-07-25 00:13:44 | LOW | 2 |
| 2026-07-24 00:02:28 | LOW | 2 |
| 2026-07-23 00:14:47 | LOW | 2 |
| 2026-07-22 00:29:32 | LOW | 2 |
| 2026-07-21 00:24:15 | LOW | 2 |
| 2026-07-20 17:14:35 | LOW | 2 |