fcitx5-areca-git
The package builds from source using git repositories with locked commits, including a submodule from a trusted project; SKIP'd checksums are common for git sources and do not imply remote code execution; the flagged low votes and recent upload are metadata concerns, not security issues.
Triggered rules
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from source using git repositories with locked commits, including a submodule from a trusted project; SKIP'd checksums are common for git sources and do not imply remote code execution; the flagged low votes and recent upload are metadata concerns, not security issues.
PKGBUILD
pkgname=fcitx5-areca-git
_pkgname=fcitx5-areca
_reponame=ArecaIME
pkgver=r211.c2c5a78
pkgrel=1
pkgdesc='Areca Vietnamese input method for Fcitx5 using the Bamboo engine'
arch=('x86_64')
url='https://github.com/xhkzeroone/ArecaIME'
license=('MIT')
depends=(
'fcitx5'
'libinput'
'libei'
'libportal'
'systemd-libs'
'sdl3'
'fontconfig'
'libx11'
'libxtst'
)
makedepends=(
'cmake'
'extra-cmake-modules'
'git'
'go'
'ninja'
'pkgconf'
'dbus'
'sdl3'
'fontconfig'
'libx11'
'libxtst'
)
optdepends=('fcitx5-configtool: graphical configuration tool')
_bamboo_commit='b2e49a2b48c7d3772a3673142a7747eccd9d5f79'
source=(
"${_pkgname}::git+${url}"
"bamboo-core::git+https://github.com/BambooEngine/bamboo-core.git#commit=${_bamboo_commit}"
)
provides=("$_pkgname")
conflicts=("$_pkgname" "$_pkgname-bin")
sha256sums=('SKIP' 'SKIP')
options=(!debug !strip)
pkgver() {
cd "${srcdir}/${_pkgname}"
printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
}
prepare() {
git -C "${srcdir}/${_pkgname}" submodule init
git -C "${srcdir}/${_pkgname}" config \
submodule.bamboo/bamboo-core.url "${srcdir}/bamboo-core"
git -C "${srcdir}/${_pkgname}" -c protocol.file.allow=always \
submodule update
}
build() {
export CXXFLAGS+=" -ffile-prefix-map=${srcdir}=."
export GOFLAGS="${GOFLAGS:-} -trimpath"
cmake -S "${srcdir}/${_pkgname}" -B build -G Ninja \
-DCMAKE_BUILD_TYPE=Release \
-DCMAKE_INSTALL_PREFIX=/usr \
-DBUILD_TESTING=ON
cmake --build build --parallel
}
check() {
ctest --test-dir build --output-on-failure
}
package() {
DESTDIR="${pkgdir}" cmake --install build --strip
install -Dm644 "${srcdir}/${_pkgname}/LICENSE" \
"${pkgdir}/usr/share/licenses/${_pkgname}/LICENSE"
install -Dm644 "${srcdir}/${_pkgname}/bamboo/bamboo-core/LICENSE" \
"${pkgdir}/usr/share/licenses/${_pkgname}/LICENSE.bamboo-core"
}
Changes since previous scan
--- PKGBUILD @ 2026-10-17 00:21+++ PKGBUILD @ 2026-10-17 01:16@@ -1,7 +1,7 @@ pkgname=fcitx5-areca-git _pkgname=fcitx5-areca _reponame=ArecaIME-pkgver=r203.a2f7c88+pkgver=r211.c2c5a78 pkgrel=1 pkgdesc='Areca Vietnamese input method for Fcitx5 using the Bamboo engine' arch=('x86_64')Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-17 01:16:24 | Low | 2 |
| 2026-10-17 00:21:55 | Clean | 2 |
| 2026-10-16 09:15:55 | Low | 1 |
| 2026-10-16 05:14:45 | Low | 1 |
| 2026-10-16 01:13:57 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 09:11:05 | Low | 2 |
| 2026-10-12 00:18:51 | Clean | 2 |
| 2026-10-11 05:10:24 | Low | 1 |