meetily-hipblas
LOW
maintainer Snoopey
0 votes
scanned 2026-10-30 17:58:32.625252
Why flagged
The non-standard host (cdn.pyke.io) serves an onnxruntime prebuilt library used at build time, but it has a pinned sha256 checksum and is the official distribution CDN for the ort-rs Rust crate; all other sources are from GitHub (project repo, adobe-fonts); the build compiles from source and the overall PKGBUILD is well-structured with no obfuscation or exfiltration.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 80%): The non-standard host (cdn.pyke.io) serves an onnxruntime prebuilt library used at build time, but it has a pinned sha256 checksum and is the official distribution CDN for the ort-rs Rust crate; all other sources are from GitHub (project repo, adobe-fonts); the build compiles from source and the overall PKGBUILD is well-structured with no obfuscation or exfiltration.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:20
'onnxruntime-1.22.0-x86_64.tgz::https://cdn.pyke.io/0/pyke:ort-rs/ms@1.22.0/x86_64-unknown-linux-gnu.tgz')
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Snoopey
2
pkgname=meetily-hipblas
3
pkgver=0.4.1
4
pkgrel=1
5
pkgdesc='Local meeting transcription and summaries (AMD ROCm HIPBLAS build)'
6
arch=('x86_64')
7
url='https://github.com/Zackriya-Solutions/meetily'
8
license=('MIT' 'OFL-1.1')
9
depends=('glibc' 'libgcc' 'libstdc++' 'libgomp' 'dbus' 'cairo' 'hicolor-icon-theme'
10
'glib2' 'gdk-pixbuf2' 'xz' 'libsoup3' 'xdg-utils' 'alsa-lib' 'ffmpeg' 'gtk3' 'libappindicator-gtk3' 'openssl' 'webkit2gtk-4.1' 'hipblas' 'rocblas' 'hip-runtime-amd')
11
makedepends=('clang' 'cmake' 'git' 'nodejs>=20' 'pnpm' 'rust' 'python' 'rocm-llvm')
12
provides=("meetily=$pkgver")
13
conflicts=('meetily')
14
optdepends=('ollama: local Ollama model provider')
15
options=('!lto' '!debug')
16
source=("meetily-$pkgver.tar.gz::$url/archive/refs/tags/v$pkgver.tar.gz"
17
'arch.patch' 'meetily.desktop' 'whisper-hipblas.patch'
18
'SourceSans3VF-Upright.ttf::https://raw.githubusercontent.com/adobe-fonts/source-sans/3.052R/VF/SourceSans3VF-Upright.ttf'
19
'source-sans-LICENSE.md::https://raw.githubusercontent.com/adobe-fonts/source-sans/3.052R/LICENSE.md'
20
'onnxruntime-1.22.0-x86_64.tgz::https://cdn.pyke.io/0/pyke:ort-rs/ms@1.22.0/x86_64-unknown-linux-gnu.tgz')
21
sha256sums=('66f06a1c4b60334d1c6d62c5f97bc5e847df33e98240ef125be01bacb7274b88'
22
'534b3dd93175a9ab06700faaddc07211f9ffdc2f2bfce53cb4004337b67ed3f4' '5e7e443ebafc9c2cdedede09c6cbe6be646358b52954151753c58ddb8e332016' '512a01ca69f1b0cc20946a23002f983f6d51468eaacbe71034f52b70993dfe24'
23
'1147db9a3f0edd4956068de77930148acce2742dd76d57f7239b2b1c687ac63f'
24
'89ad2c4f66dd29127527493e729c31e731f111cf10faf5774c3db9275ed0c22c'
25
'ed1716de95974bf47ab0223ca33734a0b5a5d09a181225d0e8ed62d070aea893')
26
_features=(--features hipblas)
27
_helper_features=(--features hipblas)
28
29
prepare() {
30
cd "meetily-$pkgver"
31
patch -Np1 -i "$srcdir/arch.patch"
32
install -Dm644 "$srcdir/SourceSans3VF-Upright.ttf" frontend/src/app/fonts/SourceSans3VF-Upright.ttf
33
export XDG_CACHE_HOME="$srcdir/.cache" npm_config_cache="$srcdir/.cache/npm"
34
export PNPM_HOME="$srcdir/.pnpm-home" CARGO_HOME="$srcdir/.cargo"
35
export XDG_RUNTIME_DIR="$srcdir/.runtime"
36
install -dm700 "$XDG_RUNTIME_DIR"
37
# pnpm 12 reads overrides from the workspace file instead of package.json.
38
python -c 'import json; p=json.load(open("frontend/package.json")); json.dump(p["pnpm"], open("frontend/pnpm-workspace.yaml", "w"))'
39
pnpm --dir frontend install --frozen-lockfile --store-dir "$srcdir/.pnpm-store"
40
cargo fetch --locked
41
# Patch the locked Whisper crate locally for ROCm 7's data/compute type split.
42
install -dm755 vendor
43
cp -a "$CARGO_HOME"/registry/src/*/whisper-rs-sys-0.11.1 vendor/whisper-rs-sys
44
chmod u+w vendor/whisper-rs-sys/whisper.cpp/ggml/src/ggml-cuda/vendors/hip.h
45
patch -Np1 -d vendor/whisper-rs-sys -i "$srcdir/whisper-hipblas.patch"
46
printf '\n[patch.crates-io]\nwhisper-rs-sys = { path = "vendor/whisper-rs-sys" }\n' >> Cargo.toml
47
cargo update --offline -p whisper-rs-sys
48
# Use Arch's maintained FFmpeg instead of downloading an untracked binary.
49
install -dm755 frontend/src-tauri/binaries
50
ln -sf /usr/bin/ffmpeg frontend/src-tauri/binaries/ffmpeg-x86_64-unknown-linux-gnu
51
}
52
53
build() {
54
cd "meetily-$pkgver"
55
export XDG_CACHE_HOME="$srcdir/.cache" npm_config_cache="$srcdir/.cache/npm"
56
export PNPM_HOME="$srcdir/.pnpm-home" CARGO_HOME="$srcdir/.cargo"
57
export XDG_RUNTIME_DIR="$srcdir/.runtime"
58
export NEXT_TELEMETRY_DISABLED=1 NEXT_PUBLIC_DISABLE_UPDATER=1
59
# Use the bindings shipped with this Whisper version on newer Clang releases.
60
export WHISPER_DONT_GENERATE_BINDINGS=1
61
export CMAKE_POSITION_INDEPENDENT_CODE=ON
62
# Fetch and verify the pinned ONNX library through makepkg, before compilation.
63
export ORT_LIB_LOCATION="$srcdir/onnxruntime/lib"
64
export CARGO_TARGET_DIR="$srcdir/target"
65
if [[ -n ${AMDGPU_TARGETS:-} ]]; then
66
export CMAKE_HIP_ARCHITECTURES="$AMDGPU_TARGETS"
67
fi
68
# HIP forwards host compiler flags to GPU targets, which do not support CET.
69
export CFLAGS="$(sed -E 's/(^| )-fcf-protection(=[^ ]+)?( |$)/ /g' <<< "$CFLAGS")"
70
export CXXFLAGS="$(sed -E 's/(^| )-fcf-protection(=[^ ]+)?( |$)/ /g' <<< "$CXXFLAGS")"
71
export CMAKE_CXX_STANDARD=17
72
export ROCM_PATH=/opt/rocm HIP_PATH=/opt/rocm
73
export PATH="/opt/rocm/bin:$PATH"
74
cargo build --locked --release -p llama-helper "${_helper_features[@]}"
75
install -m755 "$CARGO_TARGET_DIR/release/llama-helper" frontend/src-tauri/binaries/llama-helper-x86_64-unknown-linux-gnu
76
cd frontend
77
pnpm exec tauri build --no-bundle "${_features[@]}" -- --locked
78
}
79
80
check() {
81
test -x "$srcdir/target/release/meetily"
82
python - "$srcdir/target/release/llama-helper" <<'PY'
83
import json
84
import subprocess
85
import sys
86
result = subprocess.run([sys.argv[1]], input='{"type":"ping"}\n{"type":"shutdown"}\n',
87
text=True, capture_output=True, timeout=30, check=True)
88
assert [json.loads(line)['type'] for line in result.stdout.splitlines()] == ['pong', 'goodbye'], result.stdout
89
PY
90
}
91
92
package() {
93
install -Dm755 "$srcdir/target/release/meetily" "$pkgdir/usr/lib/meetily/meetily"
94
install -Dm755 "$srcdir/target/release/llama-helper" "$pkgdir/usr/lib/meetily/llama-helper"
95
install -dm755 "$pkgdir/usr/bin"
96
ln -s /usr/lib/meetily/meetily "$pkgdir/usr/bin/meetily"
97
install -Dm644 meetily.desktop "$pkgdir/usr/share/applications/meetily.desktop"
98
install -Dm644 "meetily-$pkgver/frontend/src-tauri/icons/icon.png" "$pkgdir/usr/share/icons/hicolor/1024x1024/apps/meetily.png"
99
install -Dm644 "meetily-$pkgver/LICENSE.md" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
100
install -Dm644 "meetily-$pkgver/frontend/src-tauri/templates/"*.json -t "$pkgdir/usr/share/meetily/templates/"
101
install -Dm644 "$srcdir/source-sans-LICENSE.md" "$pkgdir/usr/share/licenses/$pkgname/source-sans-LICENSE.md"
102
ln -s ../../share/meetily/templates "$pkgdir/usr/lib/meetily/templates"
103
}
104
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-30 17:58:32 | Low | 3 |
| 2026-10-30 17:56:37 | Medium | 2 |