meetily

LOW

maintainer Snoopey 0 votes scanned 2026-10-30 17:58:32.625252

View on AUR

Why flagged

The non-standard host cdn.pyke.io serves an ONNX Runtime library tarball used as a build dependency; it has a pinned sha256 checksum, is fetched before compilation, and the package otherwise builds from official GitHub source with locked dependencies — the main concern is that cdn.pyke.io is not the official Microsoft ONNX Runtime release infrastructure, making it a mildly unverifiable but checksummed prebuilt library rather than a clearly malicious payload.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): The non-standard host cdn.pyke.io serves an ONNX Runtime library tarball used as a build dependency; it has a pinned sha256 checksum, is fetched before compilation, and the package otherwise builds from official GitHub source with locked dependencies — the main concern is that cdn.pyke.io is not the official Microsoft ONNX Runtime release infrastructure, making it a mildly unverifiable but checksummed prebuilt library rather than a clearly malicious payload.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:19 'onnxruntime-1.22.0-x86_64.tgz::https://cdn.pyke.io/0/pyke:ort-rs/ms@1.22.0/x86_64-unknown-linux-gnu.tgz')

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Snoopey
    
      2pkgname=meetily
    
      3pkgver=0.4.1
    
      4pkgrel=1
    
      5pkgdesc='Local meeting transcription and summaries (CPU build)'
    
      6arch=('x86_64')
    
      7url='https://github.com/Zackriya-Solutions/meetily'
    
      8license=('MIT' 'OFL-1.1')
    
      9depends=('glibc' 'libgcc' 'libstdc++' 'libgomp' 'dbus' 'cairo' 'hicolor-icon-theme'
    
      10         'glib2' 'gdk-pixbuf2' 'xz' 'libsoup3' 'xdg-utils' 'alsa-lib' 'ffmpeg' 'gtk3' 'libappindicator-gtk3' 'openssl' 'webkit2gtk-4.1')
    
      11makedepends=('clang' 'cmake' 'git' 'nodejs>=20' 'pnpm' 'rust' 'python')
    
      12conflicts=('meetily-cuda' 'meetily-vulkan' 'meetily-hipblas' 'meetily-openblas' 'meetily-openmp' 'meetily-bin' 'meetily-git')
    
      13optdepends=('ollama: local Ollama model provider')
    
      14options=('!lto' '!debug')
    
      15source=("meetily-$pkgver.tar.gz::$url/archive/refs/tags/v$pkgver.tar.gz"
    
      16        'arch.patch' 'meetily.desktop'
    
      17        'SourceSans3VF-Upright.ttf::https://raw.githubusercontent.com/adobe-fonts/source-sans/3.052R/VF/SourceSans3VF-Upright.ttf'
    
      18        'source-sans-LICENSE.md::https://raw.githubusercontent.com/adobe-fonts/source-sans/3.052R/LICENSE.md'
    
      19        'onnxruntime-1.22.0-x86_64.tgz::https://cdn.pyke.io/0/pyke:ort-rs/ms@1.22.0/x86_64-unknown-linux-gnu.tgz')
    
      20sha256sums=('66f06a1c4b60334d1c6d62c5f97bc5e847df33e98240ef125be01bacb7274b88'
    
      21            '47f7a3f53dcb7b6380871c319d9db7de74642108f082469affe5fbbf0c887f63' '5e7e443ebafc9c2cdedede09c6cbe6be646358b52954151753c58ddb8e332016'
    
      22            '1147db9a3f0edd4956068de77930148acce2742dd76d57f7239b2b1c687ac63f'
    
      23            '89ad2c4f66dd29127527493e729c31e731f111cf10faf5774c3db9275ed0c22c'
    
      24            'ed1716de95974bf47ab0223ca33734a0b5a5d09a181225d0e8ed62d070aea893')
    
      25_features=()
    
      26_helper_features=()
    
      27
    
      28prepare() {
    
      29  cd "meetily-$pkgver"
    
      30  patch -Np1 -i "$srcdir/arch.patch"
    
      31  install -Dm644 "$srcdir/SourceSans3VF-Upright.ttf" frontend/src/app/fonts/SourceSans3VF-Upright.ttf
    
      32  export XDG_CACHE_HOME="$srcdir/.cache" npm_config_cache="$srcdir/.cache/npm"
    
      33  export PNPM_HOME="$srcdir/.pnpm-home" CARGO_HOME="$srcdir/.cargo"
    
      34  export XDG_RUNTIME_DIR="$srcdir/.runtime"
    
      35  install -dm700 "$XDG_RUNTIME_DIR"
    
      36  # pnpm 12 reads overrides from the workspace file instead of package.json.
    
      37  python -c 'import json; p=json.load(open("frontend/package.json")); json.dump(p["pnpm"], open("frontend/pnpm-workspace.yaml", "w"))'
    
      38  pnpm --dir frontend install --frozen-lockfile --store-dir "$srcdir/.pnpm-store"
    
      39  cargo fetch --locked
    
      40  # Use Arch's maintained FFmpeg instead of downloading an untracked binary.
    
      41  install -dm755 frontend/src-tauri/binaries
    
      42  ln -sf /usr/bin/ffmpeg frontend/src-tauri/binaries/ffmpeg-x86_64-unknown-linux-gnu
    
      43}
    
      44
    
      45build() {
    
      46  cd "meetily-$pkgver"
    
      47  export XDG_CACHE_HOME="$srcdir/.cache" npm_config_cache="$srcdir/.cache/npm"
    
      48  export PNPM_HOME="$srcdir/.pnpm-home" CARGO_HOME="$srcdir/.cargo"
    
      49  export XDG_RUNTIME_DIR="$srcdir/.runtime"
    
      50  export NEXT_TELEMETRY_DISABLED=1 NEXT_PUBLIC_DISABLE_UPDATER=1
    
      51  # Use the bindings shipped with this Whisper version on newer Clang releases.
    
      52  export WHISPER_DONT_GENERATE_BINDINGS=1
    
      53  export CMAKE_POSITION_INDEPENDENT_CODE=ON
    
      54  # Fetch and verify the pinned ONNX library through makepkg, before compilation.
    
      55  export ORT_LIB_LOCATION="$srcdir/onnxruntime/lib"
    
      56  export CARGO_TARGET_DIR="$srcdir/target"
    
      57  cargo build --locked --release -p llama-helper "${_helper_features[@]}"
    
      58  install -m755 "$CARGO_TARGET_DIR/release/llama-helper" frontend/src-tauri/binaries/llama-helper-x86_64-unknown-linux-gnu
    
      59  cd frontend
    
      60  pnpm exec tauri build --no-bundle "${_features[@]}" -- --locked
    
      61}
    
      62
    
      63check() {
    
      64  test -x "$srcdir/target/release/meetily"
    
      65  python - "$srcdir/target/release/llama-helper" <<'PY'
    
      66import json
    
      67import subprocess
    
      68import sys
    
      69result = subprocess.run([sys.argv[1]], input='{"type":"ping"}\n{"type":"shutdown"}\n',
    
      70                        text=True, capture_output=True, timeout=30, check=True)
    
      71assert [json.loads(line)['type'] for line in result.stdout.splitlines()] == ['pong', 'goodbye'], result.stdout
    
      72PY
    
      73}
    
      74
    
      75package() {
    
      76  install -Dm755 "$srcdir/target/release/meetily" "$pkgdir/usr/lib/meetily/meetily"
    
      77  install -Dm755 "$srcdir/target/release/llama-helper" "$pkgdir/usr/lib/meetily/llama-helper"
    
      78  install -dm755 "$pkgdir/usr/bin"
    
      79  ln -s /usr/lib/meetily/meetily "$pkgdir/usr/bin/meetily"
    
      80  install -Dm644 meetily.desktop "$pkgdir/usr/share/applications/meetily.desktop"
    
      81  install -Dm644 "meetily-$pkgver/frontend/src-tauri/icons/icon.png" "$pkgdir/usr/share/icons/hicolor/1024x1024/apps/meetily.png"
    
      82  install -Dm644 "meetily-$pkgver/LICENSE.md" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      83  install -Dm644 "meetily-$pkgver/frontend/src-tauri/templates/"*.json -t "$pkgdir/usr/share/meetily/templates/"
    
      84  install -Dm644 "$srcdir/source-sans-LICENSE.md" "$pkgdir/usr/share/licenses/$pkgname/source-sans-LICENSE.md"
    
      85  ln -s ../../share/meetily/templates "$pkgdir/usr/lib/meetily/templates"
    
      86}
    
      87

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-30 17:58:32	Low	3
2026-10-30 17:56:37	Medium	3