fcitx-vinpst-bin

maintainer rijuyuezhu · 0 votes · scanned 2026-08-18 00:03:42.021799

LOW

Why flagged The package installs a prebuilt binary from the project's own GitHub releases, which is a normal practice for AUR packages; the low severity is due to few votes and recent upload, not malicious behavior.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package installs a prebuilt binary from the project's own GitHub releases, which is a normal practice for AUR packages; the low severity is due to few votes and recent upload, not malicious behavior.

PKGBUILD

      1# Maintainer: Rijuyuezhu <rijuyuezhu@users.noreply.github.com>
    
      2pkgname=fcitx-vinpst-bin
    
      3pkgver=0.1.2
    
      4pkgrel=1
    
      5pkgdesc='Prebuilt Rust voice-input addon for Fcitx 5 with native ASR and PipeWire capture'
    
      6arch=('x86_64')
    
      7url='https://github.com/rijuyuezhu/fcitx-vinpst'
    
      8license=('GPL-3.0-or-later' 'Apache-2.0' 'MIT')
    
      9depends=(
    
      10  'coreutils'
    
      11  'fcitx5'
    
      12  'fontconfig'
    
      13  'glibc'
    
      14  'libgcc'
    
      15  'libpipewire'
    
      16  'libstdc++'
    
      17  'libx11'
    
      18  'libxkbcommon'
    
      19  'systemd'
    
      20  'systemd-libs'
    
      21  'util-linux'
    
      22  'wayland'
    
      23)
    
      24optdepends=('wireplumber: output-volume ducking through wpctl')
    
      25provides=('fcitx-vinpst')
    
      26conflicts=('fcitx-vinpst')
    
      27options=('!strip' '!debug')
    
      28install=fcitx-vinpst.install
    
      29
    
      30_release_pkg="fcitx-vinpst-${pkgver}-1-x86_64.pkg.tar.zst"
    
      31source_x86_64=("${_release_pkg}::${url}/releases/download/v${pkgver}/${_release_pkg}")
    
      32sha256sums_x86_64=('deb8433a18dbbb5b316c3db76120f9611040d0b4f8230ca09512ddcae904b893')
    
      33noextract=("${_release_pkg}")
    
      34
    
      35package() {
    
      36  bsdtar -xpf "${srcdir}/${_release_pkg}" -C "${pkgdir}" usr
    
      37}
    
      38

Changes since previous scan

--- PKGBUILD @ 2026-08-13 00:17
+++ PKGBUILD @ 2026-08-18 00:03
@@ -1,6 +1,6 @@
 # Maintainer: Rijuyuezhu <rijuyuezhu@users.noreply.github.com>
 pkgname=fcitx-vinpst-bin
-pkgver=0.1.1
+pkgver=0.1.2
 pkgrel=1
 pkgdesc='Prebuilt Rust voice-input addon for Fcitx 5 with native ASR and PipeWire capture'
 arch=('x86_64')
@@ -10,7 +10,6 @@
   'coreutils'
   'fcitx5'
   'fontconfig'
-  'glib2'
   'glibc'
   'libgcc'
   'libpipewire'
@@ -30,7 +29,7 @@
 
 _release_pkg="fcitx-vinpst-${pkgver}-1-x86_64.pkg.tar.zst"
 source_x86_64=("${_release_pkg}::${url}/releases/download/v${pkgver}/${_release_pkg}")
-sha256sums_x86_64=('b88326542ac31096f47b1b6f7d8e5511a085342fbd3951122f87d6454838afd0')
+sha256sums_x86_64=('deb8433a18dbbb5b316c3db76120f9611040d0b4f8230ca09512ddcae904b893')
 noextract=("${_release_pkg}")
 
 package() {

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	LOW	2
2026-08-17 00:18:29	LOW	2
2026-08-16 00:03:42	LOW	2
2026-08-15 00:26:13	LOW	2
2026-08-14 00:03:41	LOW	2
2026-08-13 17:26:33	LOW	2
2026-08-13 00:17:07	CLEAN	2
2026-08-12 19:24:47	LOW	1
2026-08-12 15:24:23	LOW	1