irlume-git

LOW
maintainer archledger 0 votes scanned 2026-10-19 19:26:12.253336
View on AUR
Why flagged
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Triggered rules

Low Few votes, recently uploaded zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
PKGBUILD

      1# Maintainer: Wisbendji Fimerlus <archledger236@gmail.com>
    
      2# Generated from packaging/arch/PKGBUILD by scripts/arch-git-pkgbuild.py:
    
      3# edit that recipe, then run the script (CI checks this file is current).
    
      4# The nightly channel (docs/adr/0037-nightly-channel.md): builds main.
    
      5pkgbase=irlume-git
    
      6pkgname=(irlume-git irlume-kcm-git)
    
      7pkgver=0.15.0
    
      8pkgrel=1
    
      9pkgdesc="Face authentication for Linux: IR cameras, consent-gated, photo-spoofing resistant, TPM-sealed, password always works (nightly: builds main)"
    
      10arch=('x86_64')
    
      11url="https://github.com/archledger/irlume"
    
      12license=('GPL-3.0-or-later')
    
      13# Arch ships onnxruntime 1.24+ but SPLIT into onnxruntime-cpu / -cuda / -rocm,
    
      14# each Provides=onnxruntime. Depend on the virtual 'onnxruntime' so any variant
    
      15# the user has satisfies it (no conflict); a fresh install prompts to pick one,
    
      16# choose onnxruntime-cpu unless you want GPU execution providers.
    
      17depends=('onnxruntime' 'tpm2-tss' 'pam' 'polkit' 'dbus')
    
      18# clang: v4l2-sys-mit generates its V4L2 bindings with bindgen, which needs
    
      19# libclang at build time; without it makepkg fails on a clean system.
    
      20makedepends=('git' 'rust' 'cargo' 'gcc' 'clang' 'cmake' 'extra-cmake-modules' 'qt6-base' 'qt6-declarative' 'kcmutils' 'kcoreaddons' 'kio')
    
      21# The code comes from main over HTTPS. It is not signature-checked: commits
    
      22# on main are GitHub's squash merges, signed by GitHub's web-flow key, not
    
      23# by the release key the release recipe checks tags with (ADR-0037).
    
      24# The ONNX model weights are NOT in the
    
      25# tag; they are hosted as release assets on the version-independent `models-v1`
    
      26# release (kept out of Git LFS so builds do not consume the account's LFS
    
      27# bandwidth quota). makepkg downloads and checksum-verifies them as extra
    
      28# sources here, and prepare() stages them into the build tree.
    
      29source=("irlume::git+https://github.com/archledger/irlume.git#branch=main"
    
      "glintr100.onnx::https://github.com/archledger/irlume/releases/download/models-v1/glintr100.onnx"
    
      "face_detection_yunet_2023mar.onnx::https://github.com/archledger/irlume/releases/download/models-v1/face_detection_yunet_2023mar.onnx"
    
      "face_landmark.onnx::https://github.com/archledger/irlume/releases/download/models-v1/face_landmark.onnx"
    
      "blaze_face_short_range.onnx::https://github.com/archledger/irlume/releases/download/models-v1/blaze_face_short_range.onnx"
    
      "face_landmarks_detector.tflite::https://github.com/archledger/irlume/releases/download/models-v1/face_landmarks_detector.tflite"
    
      "liveness_vit.onnx::https://github.com/archledger/irlume/releases/download/models-v1/liveness_vit.onnx"
    
      "flir.onnx::https://github.com/archledger/irlume/releases/download/models-v1/flir.onnx"
    
      # TFLite C runtime (#295): no current Arch/AUR system package exists
    
      # (AUR libtensorflow-lite is 2.4-era), so the pinned irlume-built
    
      # artifact bundles at the daemon resolver's first probed path.
    
      "libtensorflowlite_c-v2.19.0-linux-x64.tar.gz::https://github.com/archledger/irlume/releases/download/tflite-runtime-v2.19.0/libtensorflowlite_c-v2.19.0-linux-x64.tar.gz")
    
      41sha256sums=('SKIP'
    
          'a7933ea5330113b01c9b60351d8f4c33003f145d8470ac5f0e52ee2effe25c60'
    
          '8f2383e4dd3cfbb4553ea8718107fc0423210dc964f9f4280604804ed2552fa4'
    
          '821683be088447839638f79d64268bd501bdb72e5d9e262ec981c7e252956caf'
    
          'c5453678015f6289c1d77bda88a8ba9c87574f01de1a05ba1909b9a7e08b237b'
    
          'c7d54204ce0448474c7f3fa9af494787c0965cbdd6f20fc72867e43046bd43d5'
    
          'c7f8a6f3054b11f9719f5e24d37ec227721608fff8b90373c6c3e7659864161c'
    
          'df80cea7228b92562692e56aac965d35766c77399159798c552fb3c77b410c72'
    
          'dd3abcdbc0f35a9466a682358955ac3826a9a81590cd6b8abcf98548e17bd311')
    
      50
    
      51# The last release tag, the commits since it and the commit, as the Arch VCS
    
      52# package guidelines spell it: v0.15.0-139-g3c162b83 -> 0.15.0.r139.g3c162b83,
    
      53# which vercmp puts after 0.15.0 and before 0.15.1 (ADR-0037 section 2).
    
      54pkgver() {
    
  cd "$srcdir/irlume"
    
  git describe --long --tags --match 'v[0-9]*' | sed 's/^v//;s/\([^-]*-g\)/r\1/;s/-/./g'
    
      57}
    
      58
    
      59prepare() {
    
  cd "$srcdir/irlume"
    
  # Stage the release-hosted weights (makepkg already downloaded and verified
    
  # them from the sources above) into the tree the build expects.
    
  mkdir -p models
    
  cp "$srcdir"/glintr100.onnx "$srcdir"/face_detection_yunet_2023mar.onnx \
    
     "$srcdir"/face_landmark.onnx "$srcdir"/blaze_face_short_range.onnx \
    
     "$srcdir"/face_landmarks_detector.tflite "$srcdir"/liveness_vit.onnx \
    
     "$srcdir"/flir.onnx models/
    
      68}
    
      69
    
      70build() {
    
  cd "$srcdir/irlume"
    
  cargo build --release --locked
    
  # Plasma System Settings module (split package irlume-kcm).
    
  cmake -S kcm -B kcm-build
    
  cmake --build kcm-build
    
      76}
    
      77
    
      78package_irlume-git() {
    
  provides=("irlume=${pkgver}")
    
  conflicts=('irlume')
    
  optdepends=('fprintd: fingerprint companion factor')
    
  backup=('etc/pam.d/irlume-retry-reset')
    
  # irlume's alone: set globally, the KCM package carried the hooks too, and
    
  # removing only irlume-kcm ran pre_remove, which stops and disables
    
  # irlumed while irlume stays installed.
    
  install=irlume.install
    
  cd "$srcdir/irlume"
    
  install -Dm0755 target/release/irlumed "$pkgdir/usr/bin/irlumed"
    
  install -Dm0755 target/release/irlume  "$pkgdir/usr/bin/irlume"
    
  install -Dm0644 packaging/desktop/io.github.archledger.Irlume.desktop "$pkgdir/usr/share/applications/io.github.archledger.Irlume.desktop"
    
  install -Dm0644 packaging/desktop/io.github.archledger.Irlume.svg "$pkgdir/usr/share/icons/hicolor/scalable/apps/io.github.archledger.Irlume.svg"
    
  install -Dm0644 target/release/libpam_irlume.so "$pkgdir/usr/lib/security/pam_irlume.so"
    
  install -Dm0644 target/release/libpam_irlume_view.so "$pkgdir/usr/lib/security/pam_irlume_view.so"
    
  # KDE wallet handoff helper. Not in /usr/bin: it is not a command a user
    
  # runs, it takes a secret on stdin, and it is only meaningful inside a PAM
    
  # transaction.
    
  install -Dm0755 target/release/irlume-kwallet-init "$pkgdir/usr/libexec/irlume/irlume-kwallet-init"
    
  install -Dm0755 target/release/irlume-gkr-unlock "$pkgdir/usr/libexec/irlume/irlume-gkr-unlock"
    
  install -Dm0755 target/release/irlume-password-verify "$pkgdir/usr/libexec/irlume-password-verify"
    
  install -Dm0644 packaging/pam/irlume-retry-reset "$pkgdir/etc/pam.d/irlume-retry-reset"
    
  # One line per model, deliberately not a loop over basenames. The loop that
    
  # used to be here was keyed on ".onnx", so the mesh model could not join it
    
  # and was simply forgotten: the unit pointed IRLUME_MESH_MODEL at a file
    
  # this package never shipped (#360). Being absent is silent, because
    
  # Engine::with_mesh treats a missing path as a no-op and returns Ok, so the
    
  # daemon starts but BlazeFace rescue alignment stops working. Spelled out,
    
  # each model is one line to add and
    
  # check-packaging-parity.sh can see every name.
    
  install -Dm0644 models/glintr100.onnx \
    
      "$pkgdir/usr/share/irlume/models/glintr100.onnx"
    
  install -Dm0644 models/face_detection_yunet_2023mar.onnx \
    
      "$pkgdir/usr/share/irlume/models/face_detection_yunet_2023mar.onnx"
    
  install -Dm0644 models/face_landmark.onnx \
    
      "$pkgdir/usr/share/irlume/models/face_landmark.onnx"
    
  install -Dm0644 models/blaze_face_short_range.onnx \
    
      "$pkgdir/usr/share/irlume/models/blaze_face_short_range.onnx"
    
  install -Dm0644 models/face_landmarks_detector.tflite \
    
      "$pkgdir/usr/share/irlume/models/face_landmarks_detector.tflite"
    
  install -Dm0644 models/liveness_vit.onnx \
    
      "$pkgdir/usr/share/irlume/models/liveness_vit.onnx"
    
  install -Dm0644 models/flir.onnx \
    
      "$pkgdir/usr/share/irlume/models/flir.onnx"
    
  install -Dm0755 "$srcdir/libtensorflowlite_c-v2.19.0-linux-x64/lib/libtensorflowlite_c.so" \
    
      "$pkgdir/usr/share/irlume/tflite/libtensorflowlite_c.so"
    
  install -Dm0644 "$srcdir/libtensorflowlite_c-v2.19.0-linux-x64/LICENSE.tensorflow" \
    
      "$pkgdir/usr/share/irlume/tflite/LICENSE.tensorflow"
    
  install -Dm0644 "$srcdir/libtensorflowlite_c-v2.19.0-linux-x64/PROVENANCE" \
    
      "$pkgdir/usr/share/irlume/tflite/PROVENANCE"
    
  install -Dm0644 "$srcdir/irlume/packaging/licenses/THIRD-PARTY-NOTICES.tflite" \
    
      "$pkgdir/usr/share/irlume/tflite/THIRD-PARTY-NOTICES"
    
  install -Dm0644 packaging/polkit/org.irlume.enroll.policy "$pkgdir/usr/share/polkit-1/actions/org.irlume.enroll.policy"
    
  install -Dm0644 packaging/polkit/org.irlume.recovery-manage.policy "$pkgdir/usr/share/polkit-1/actions/org.irlume.recovery-manage.policy"
    
  install -Dm0644 packaging/systemd/irlumed.service "$pkgdir/usr/lib/systemd/system/irlumed.service"
    
  install -Dm0644 packaging/systemd/irlumed.socket "$pkgdir/usr/lib/systemd/system/irlumed.socket"
    
  # Self-heal: re-applies irlume's greeter PAM lines if a distro update strips
    
  # them. No-op until `irlume login enable` writes its marker.
    
  install -Dm0644 packaging/systemd/irlume-reconcile.path "$pkgdir/usr/lib/systemd/system/irlume-reconcile.path"
    
  install -Dm0644 packaging/systemd/irlume-reconcile.service "$pkgdir/usr/lib/systemd/system/irlume-reconcile.service"
    
  install -Dm0644 packaging/systemd/irlume-reconcile.timer "$pkgdir/usr/lib/systemd/system/irlume-reconcile.timer"
    
  install -Dm0644 packaging/systemd/irlume-lightdm-prepare.service "$pkgdir/usr/lib/systemd/system/irlume-lightdm-prepare.service"
    
  install -Dm0644 packaging/systemd/irlume-lightdm-refresh.service "$pkgdir/usr/lib/systemd/system/irlume-lightdm-refresh.service"
    
  install -Dm0644 packaging/systemd/irlume-lightdm-refresh.path "$pkgdir/usr/lib/systemd/system/irlume-lightdm-refresh.path"
    
  install -Dm0644 packaging/systemd/irlume-lightdm-refresh.timer "$pkgdir/usr/lib/systemd/system/irlume-lightdm-refresh.timer"
    
  install -Dm0644 packaging/lightdm/50-irlume-pam.conf "$pkgdir/usr/lib/systemd/system/lightdm.service.d/50-irlume-pam.conf"
    
  # tmpfiles.d: the setgid root:video lock directory for the IR-emitter
    
  # exclusion locks (#542). The daemon's bounding set has no CAP_CHOWN, so
    
  # the group must be inherited at creation, not corrected in-process.
    
  # irlume.install applies it before any daemon start.
    
  install -Dm0644 packaging/tmpfiles.d/irlume.conf "$pkgdir/usr/lib/tmpfiles.d/irlume.conf"
    
  # udev: descriptor-attested YUYV IR nodes without illumination records lose
    
  # the seat-user uaccess tag (#1069, ADR-0031 section 4); applies at the
    
  # next plug or boot.
    
  install -Dm0644 packaging/udev/72-irlume-ir-nodes.rules "$pkgdir/usr/lib/udev/rules.d/72-irlume-ir-nodes.rules"
    
  # AppArmor profile for the daemon. Arch does not run AppArmor by default, so
    
  # it sits inert unless the user boots with `lsm=...,apparmor`; irlume.install
    
  # loads it only when apparmor_parser is present. The profile confines the
    
  # /usr/bin/irlumed binary (same path Arch installs to) and already covers the
    
  # system onnxruntime under /usr/lib, so no Arch-specific variant is needed.
    
  install -Dm0644 packaging/apparmor/usr.bin.irlumed "$pkgdir/etc/apparmor.d/usr.bin.irlumed"
    
  install -Dm0644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
  install -Dm0644 README.md "$pkgdir/usr/share/doc/$pkgname/README.md"
    
  # The machine-API contract, beside the engine that implements it: a consumer
    
  # validating our JSON should never have to guess which schema this build speaks.
    
  install -Dm0644 schemas/machine-api-v1.schema.json "$pkgdir/usr/share/irlume/schemas/machine-api-v1.schema.json"
    
  install -Dm0644 docs/MACHINE-API.md "$pkgdir/usr/share/doc/$pkgname/MACHINE-API.md"
    
  install -Dm0644 docs/INTEGRATION.md "$pkgdir/usr/share/doc/$pkgname/INTEGRATION.md"
    
      167}
    
      168
    
      169package_irlume-kcm-git() {
    
  pkgdesc="Plasma System Settings module for irlume: read-only status, health and launch actions (nightly: builds main)"
    
  depends=("irlume-git=${pkgver}" 'qt6-declarative' 'kcmutils' 'kio' 'kirigami')
    
  provides=("irlume-kcm=${pkgver}")
    
  conflicts=('irlume-kcm')
    
  cd "$srcdir/irlume"
    
  DESTDIR="$pkgdir" cmake --install kcm-build
    
      176}
    
      177
Scan history

Scanned at (UTC)	Severity	Rules
2026-10-19 19:26:12	Low	1