fcitx5-ainput-bin

LOW

maintainer xander.lin 0 votes scanned 2026-10-17 09:17:40.511065

View on AUR

Why flagged

The package installs prebuilt binaries from the project's official GitHub releases, which is a normal practice for binary-only packages; the source is verifiable, checksums are provided, and no untrusted or obfuscated downloads occur.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package installs prebuilt binaries from the project's official GitHub releases, which is a normal practice for binary-only packages; the source is verifiable, checksums are provided, and no untrusted or obfuscated downloads occur.

PKGBUILD

      1# Maintainer: xander-lin
    
      2
    
      3# Prebuilt package: installs the release artifact published on GitHub instead of
    
      4# compiling. The -git package stays available for people who want to build from
    
      5# source or run a commit that has no release artifact yet.
    
      6#
    
      7# The artifact is a tar.zst of the install tree (a `meson install` DESTDIR
    
      8# image), not a bare .so: the addon also needs its fcitx5 addon descriptor and
    
      9# the udev rule, and shipping the tree that was actually tested keeps the
    
      10# package honest about what was verified.
    
      11pkgname=fcitx5-ainput-bin
    
      12pkgver=0.1.0
    
      13pkgrel=1
    
      14pkgdesc="Voice input addon for fcitx5: push-to-talk ASR via CapsLock (prebuilt)"
    
      15arch=('x86_64' 'aarch64')
    
      16url="https://github.com/xander-lin/ainput"
    
      17license=('MIT')
    
      18# No cargo/meson/git: nothing is compiled here. The Rust core is linked
    
      19# statically into ainput.so, so the remaining dependencies are exactly the
    
      20# system libraries the binary links against.
    
      21depends=('fcitx5' 'libebur128' 'libpulse' 'curl' 'speexdsp' 'libsoxr')
    
      22install=PKGBUILD.install
    
      23# Both packages install the same files, so only one may be present. This is the
    
      24# mechanism that makes an install actually offer to remove the other; a
    
      25# `replaces` entry would be ignored by `pacman -U`, which is how paru installs
    
      26# AUR packages.
    
      27conflicts=('fcitx5-ainput-git')
    
      28provides=('fcitx5-ainput')
    
      29# Per-architecture sources: pacman only requires the checksum for the arch it is
    
      30# building on, so an aarch64 user never needs the x86_64 artifact.
    
      31source_x86_64=("fcitx5-ainput-$pkgver-x86_64.tar.zst::$url/releases/download/$pkgver/fcitx5-ainput-$pkgver-x86_64.tar.zst")
    
      32source_aarch64=("fcitx5-ainput-$pkgver-aarch64.tar.zst::$url/releases/download/$pkgver/fcitx5-ainput-$pkgver-aarch64.tar.zst")
    
      33sha256sums_x86_64=('a4f7c25ae7ef93bb6d004d67af7d48337a4a681a17b9999a601358050dd2e1bb')
    
      34sha256sums_aarch64=('0b3737f4f6f00c1573310b4c375e9135f0c1a891c25f4606095cfabc98404734')
    
      35
    
      36package() {
    
      37    # The archive is a DESTDIR image, so it already carries the usr/ prefix and
    
      38    # the layout pacman expects.
    
      39    cp -a "$srcdir/usr" "$pkgdir/"
    
      40}
    
      41

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 09:17:40	Low	2