llavon-ime-fcitx5-git
maintainer billy948787
· 0 votes
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The package builds from a legitimate project Git repository and downloads a model file from Hugging Face, a standard host for ML models; both sources are plausibly project-owned, and the model is non-executable data, so the risk is low despite unverified checksums.
Triggered rules
LOW
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The package builds from a legitimate project Git repository and downloads a model file from Hugging Face, a standard host for ML models; both sources are plausibly project-owned, and the model is non-executable data, so the risk is low despite unverified checksums.
1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:23
"${_model_file}::https://huggingface.co/tony65535/llavon-ime-llama-250m-GGUF/resolve/main/${_model_file}"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: llavon-ime contributors
2
3
_pkgname=llavon-ime-fcitx5
4
_srcname=ime-fcitx5
5
_model_file=llavon-ime-llama-250m-Q4_K_M.gguf
6
pkgname=${_pkgname}-git
7
pkgver=0.2.2.r12.ga4edbc6
8
pkgrel=1
9
pkgdesc='Fcitx5 frontend and local inference service for Llavon IME'
10
arch=('x86_64' 'aarch64')
11
url='https://github.com/llavon-ime/ime-fcitx5'
12
license=('BSD-2-Clause' 'MIT' 'Apache-2.0' 'BSL-1.0' 'CC-BY-NC-4.0')
13
depends=('fcitx5' 'glibc' 'libgcc' 'libstdc++' 'vulkan-icd-loader')
14
makedepends=('cmake' 'curl' 'git' 'ninja' 'python' 'tar' 'unzip' 'zip')
15
optdepends=(
16
'fcitx5-configtool: graphical configuration for fcitx5'
17
'vulkan-driver: Vulkan GPU acceleration'
18
)
19
provides=("${_pkgname}")
20
conflicts=("${_pkgname}")
21
source=(
22
"${_srcname}::git+https://github.com/llavon-ime/ime-fcitx5.git#branch=main"
23
"${_model_file}::https://huggingface.co/tony65535/llavon-ime-llama-250m-GGUF/resolve/main/${_model_file}"
24
)
25
sha256sums=('SKIP' 'SKIP')
26
27
pkgver() {
28
cd "${_srcname}"
29
30
local describe base_version
31
describe="$(git describe --long --tags --abbrev=7 2>/dev/null || true)"
32
if [[ -n "${describe}" ]]; then
33
printf '%s\n' "${describe}" | sed 's/^v//;s/\([^-]*-g\)/r\1/;s/-/./g'
34
return
35
fi
36
37
base_version="$(sed -n 's/^project(llavon-ime VERSION \([^ ]*\).*/\1/p' fcitx5/CMakeLists.txt)"
38
base_version="${base_version:-0.1.0}"
39
printf '%s.r%s.g%s\n' "${base_version}" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
40
}
41
42
build() {
43
git -C "${_srcname}" submodule update --init --recursive
44
"${srcdir}/${_srcname}/vcpkg/bootstrap-vcpkg.sh" -disableMetrics
45
46
cmake -S "${_srcname}/ime-unix-service" -B unix-service-build -G Ninja \
47
-DCMAKE_BUILD_TYPE=None \
48
-DCMAKE_INSTALL_PREFIX=/usr \
49
-DCMAKE_TOOLCHAIN_FILE="${srcdir}/${_srcname}/vcpkg/scripts/buildsystems/vcpkg.cmake" \
50
-DVCPKG_MANIFEST_FEATURES=llama-vulkan \
51
-DIME_UNIX_SERVICE_BUILD_TESTS=ON
52
cmake --build unix-service-build
53
ctest --test-dir unix-service-build --output-on-failure
54
55
cmake -S "${_srcname}/fcitx5" -B build -G Ninja \
56
-DCMAKE_BUILD_TYPE=None \
57
-DCMAKE_INSTALL_PREFIX=/usr \
58
-DCMAKE_TOOLCHAIN_FILE="${srcdir}/${_srcname}/vcpkg/scripts/buildsystems/vcpkg.cmake" \
59
-DIME_FCITX5_INSTALLED_MODEL_PATH="/usr/share/llavon-ime/models/${_model_file}" \
60
-DIME_FCITX5_DISPLAY_VERSION="${pkgver}" \
61
-DIME_FCITX5_BUILD_TESTS=OFF
62
cmake --build build
63
}
64
65
package() {
66
DESTDIR="${pkgdir}" cmake --install unix-service-build
67
DESTDIR="${pkgdir}" cmake --install build
68
install -Dm644 "${srcdir}/${_model_file}" \
69
"${pkgdir}/usr/share/llavon-ime/models/${_model_file}"
70
cmake \
71
-DVCPKG_INSTALLED_DIR="${srcdir}/unix-service-build/vcpkg_installed" \
72
-DDESTINATION="${pkgdir}/usr/share/licenses/${pkgname}" \
73
-DPROJECT_ROOT="${srcdir}/${_srcname}" \
74
-P "${srcdir}/${_srcname}/scripts/install-licenses.cmake"
75
}
76
Changes since previous scan
--- PKGBUILD @ 2026-08-01 01:19+++ PKGBUILD @ 2026-08-03 00:08@@ -4,7 +4,7 @@ _srcname=ime-fcitx5 _model_file=llavon-ime-llama-250m-Q4_K_M.gguf pkgname=${_pkgname}-git-pkgver=0.2.2.r10.g2a7d9dc+pkgver=0.2.2.r12.ga4edbc6 pkgrel=1 pkgdesc='Fcitx5 frontend and local inference service for Llavon IME' arch=('x86_64' 'aarch64')@@ -48,7 +48,6 @@ -DCMAKE_INSTALL_PREFIX=/usr \ -DCMAKE_TOOLCHAIN_FILE="${srcdir}/${_srcname}/vcpkg/scripts/buildsystems/vcpkg.cmake" \ -DVCPKG_MANIFEST_FEATURES=llama-vulkan \- -DIME_UNIX_SERVICE_REQUIRE_LLAMA=ON \ -DIME_UNIX_SERVICE_BUILD_TESTS=ON cmake --build unix-service-build ctest --test-dir unix-service-build --output-on-failureScan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 3 |
| 2026-08-02 00:16:08 | LOW | 3 |
| 2026-08-01 13:20:32 | MEDIUM | 2 |
| 2026-08-01 01:19:40 | MEDIUM | 2 |
| 2026-08-01 00:11:18 | LOW | 3 |
| 2026-07-31 15:18:17 | MEDIUM | 2 |
| 2026-07-31 00:14:10 | LOW | 3 |
| 2026-07-30 15:15:12 | MEDIUM | 2 |
| 2026-07-30 09:14:07 | MEDIUM | 2 |
| 2026-07-30 00:17:23 | LOW | 3 |
| 2026-07-29 13:11:48 | MEDIUM | 2 |
| 2026-07-29 00:25:53 | LOW | 3 |
| 2026-07-28 00:07:28 | LOW | 3 |
| 2026-07-27 00:24:32 | LOW | 3 |
| 2026-07-26 00:07:32 | LOW | 3 |
| 2026-07-25 03:28:44 | MEDIUM | 2 |
| 2026-07-25 01:30:03 | LOW | 3 |
| 2026-07-25 01:28:35 | MEDIUM | 2 |