llavon-ime-fcitx5-preview-git

maintainer billy948787 · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from the project's own GitHub source and downloads a GGUF model file from HuggingFace (a plausible official model host for this project); both have SKIP'd checksums which is sloppy but the model is installed as a data file (not executed directly), and the build process uses the project's own vcpkg/cmake infrastructure without any obfuscated payloads or exfiltration.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): The package builds from the project's own GitHub source and downloads a GGUF model file from HuggingFace (a plausible official model host for this project); both have SKIP'd checksums which is sloppy but the model is installed as a data file (not executed directly), and the build process uses the project's own vcpkg/cmake infrastructure without any obfuscated payloads or exfiltration.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:23 "${_model_file}::https://huggingface.co/tony65535/llavon-ime-llama-250m-GGUF/resolve/main/${_model_file}"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: llavon-ime contributors
    
      2
    
      3_pkgname=llavon-ime-fcitx5
    
      4_srcname=ime-fcitx5
    
      5_model_file=llavon-ime-llama-250m-Q4_K_M.gguf
    
      6pkgname=${_pkgname}-preview-git
    
      7pkgver=0.2.2.r15.g7ee1e51
    
      8pkgrel=1
    
      9pkgdesc='Preview branch of the Fcitx5 frontend and local inference service for Llavon IME'
    
      10arch=('x86_64' 'aarch64')
    
      11url='https://github.com/llavon-ime/ime-fcitx5/tree/preview'
    
      12license=('BSD-2-Clause' 'MIT' 'Apache-2.0' 'BSL-1.0' 'CC-BY-NC-4.0')
    
      13depends=('fcitx5' 'glibc' 'libgcc' 'libstdc++' 'vulkan-icd-loader')
    
      14makedepends=('cmake' 'curl' 'git' 'ninja' 'python' 'tar' 'unzip' 'zip')
    
      15optdepends=(
    
      16    'fcitx5-configtool: graphical configuration for fcitx5'
    
      17    'vulkan-driver: Vulkan GPU acceleration'
    
      18)
    
      19provides=("${_pkgname}")
    
      20conflicts=("${_pkgname}" "${_pkgname}-git")
    
      21source=(
    
      22    "${_srcname}::git+https://github.com/llavon-ime/ime-fcitx5.git#branch=preview"
    
      23    "${_model_file}::https://huggingface.co/tony65535/llavon-ime-llama-250m-GGUF/resolve/main/${_model_file}"
    
      24)
    
      25sha256sums=('SKIP' 'SKIP')
    
      26
    
      27pkgver() {
    
      28    cd "${_srcname}"
    
      29
    
      30    local describe base_version
    
      31    describe="$(git describe --long --tags --abbrev=7 2>/dev/null || true)"
    
      32    if [[ -n "${describe}" ]]; then
    
      33        printf '%s\n' "${describe}" | sed 's/^v//;s/\([^-]*-g\)/r\1/;s/-/./g'
    
      34        return
    
      35    fi
    
      36
    
      37    base_version="$(sed -n 's/^project(llavon-ime VERSION \([^ ]*\).*/\1/p' fcitx5/CMakeLists.txt)"
    
      38    base_version="${base_version:-0.1.0}"
    
      39    printf '%s.r%s.g%s\n' "${base_version}" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
    
      40}
    
      41
    
      42build() {
    
      43    git -C "${_srcname}" submodule update --init --recursive
    
      44    "${srcdir}/${_srcname}/vcpkg/bootstrap-vcpkg.sh" -disableMetrics
    
      45
    
      46    cmake -S "${_srcname}/ime-unix-service" -B unix-service-build -G Ninja \
    
      47        -DCMAKE_BUILD_TYPE=None \
    
      48        -DCMAKE_INSTALL_PREFIX=/usr \
    
      49        -DCMAKE_TOOLCHAIN_FILE="${srcdir}/${_srcname}/vcpkg/scripts/buildsystems/vcpkg.cmake" \
    
      50        -DVCPKG_MANIFEST_FEATURES=llama-vulkan \
    
      51        -DIME_UNIX_SERVICE_BUILD_TESTS=ON
    
      52    cmake --build unix-service-build
    
      53    ctest --test-dir unix-service-build --output-on-failure
    
      54
    
      55    cmake -S "${_srcname}/fcitx5" -B build -G Ninja \
    
      56        -DCMAKE_BUILD_TYPE=None \
    
      57        -DCMAKE_INSTALL_PREFIX=/usr \
    
      58        -DCMAKE_TOOLCHAIN_FILE="${srcdir}/${_srcname}/vcpkg/scripts/buildsystems/vcpkg.cmake" \
    
      59        -DIME_FCITX5_INSTALLED_MODEL_PATH="/usr/share/llavon-ime/models/${_model_file}" \
    
      60        -DIME_FCITX5_DISPLAY_VERSION="${pkgver}" \
    
      61        -DIME_FCITX5_BUILD_TESTS=ON
    
      62    cmake --build build
    
      63    ctest --test-dir build --output-on-failure
    
      64}
    
      65
    
      66package() {
    
      67    DESTDIR="${pkgdir}" cmake --install unix-service-build
    
      68    DESTDIR="${pkgdir}" cmake --install build
    
      69    install -Dm644 "${srcdir}/${_model_file}" \
    
      70        "${pkgdir}/usr/share/llavon-ime/models/${_model_file}"
    
      71    cmake \
    
      72        -DVCPKG_INSTALLED_DIR="${srcdir}/unix-service-build/vcpkg_installed" \
    
      73        -DDESTINATION="${pkgdir}/usr/share/licenses/${pkgname}" \
    
      74        -DPROJECT_ROOT="${srcdir}/${_srcname}" \
    
      75        -P "${srcdir}/${_srcname}/scripts/install-licenses.cmake"
    
      76}
    
      77

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	3
2026-08-02 00:16:08	LOW	3
2026-08-01 13:20:32	MEDIUM	2
2026-08-01 11:24:03	LOW	3
2026-08-01 11:20:22	MEDIUM	2