openviking-bin
LOW
maintainer HanHaocheng
0 votes
scanned 2026-09-21 09:34:45.899251
Why flagged
The package installs a prebuilt Python wheel from PyPI (a trusted source) into a private virtualenv to resolve dependency conflicts, which is a legitimate packaging approach; the network access during build is for pip installing verified dependencies, not executing untrusted code.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Low
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package installs a prebuilt Python wheel from PyPI (a trusted source) into a private virtualenv to resolve dependency conflicts, which is a legitimate packaging approach; the network access during build is for pip installing verified dependencies, not executing untrusted code.
PKGBUILD
1
# Maintainer: HanHaocheng <1849397656@qq.com>
2
#
3
# Why this is a -bin package with a private virtualenv:
4
#
5
# Upstream (volcengine/OpenViking) declares roughly 160 Python dependencies.
6
# Six of them are exact `==` pins that cannot coexist with the versions already
7
# shipped by the official repositories / AUR:
8
#
9
# tree-sitter==0.25.2 (AUR: 0.26.0)
10
# tree-sitter-language-pack==1.13.3 (AUR: 0.13.0)
11
# tree-sitter-rust==0.24.0 (AUR: 0.24.2)
12
# tree-sitter-php==0.24.1 (AUR: 0.24.2)
13
# tree-sitter-c-sharp==0.23.1 (AUR: 0.23.5)
14
# litellm>=1.83.7,<1.91.2 (AUR: 1.102.0)
15
#
16
# and five more are packaged nowhere (openviking-sdk, firecrawl-anydoc,
17
# json-repair, volcengine, volcengine-python-sdk). A system-package based
18
# PKGBUILD is therefore impossible, so the upstream dependency set is resolved
19
# into a private virtualenv under /opt. Requires network access during build().
20
#
21
# NOTE: rebuild this package after every Python minor version upgrade.
22
23
_ovname=openviking
24
_prefix=/opt/$_ovname
25
_venv=$_prefix/venv
26
27
pkgname=openviking-bin
28
pkgver=0.4.21
29
pkgrel=1
30
pkgdesc="Self-evolving context database for AI agents (upstream wheel with a private virtualenv)"
31
arch=('x86_64' 'aarch64')
32
url="https://github.com/volcengine/OpenViking"
33
license=('AGPL-3.0-only')
34
depends=('glibc' 'gcc-libs' 'python')
35
provides=("$_ovname")
36
conflicts=("$_ovname" 'openviking-cli')
37
options=('!strip' '!debug')
38
install="$pkgname.install"
39
40
# Depends on $pkgver, so it must be expanded after it is set.
41
_wheel=$_ovname-$pkgver-cp310-abi3-manylinux_2_31_$CARCH.whl
42
43
source=("$_ovname.service"
44
"$_ovname.sysusers")
45
sha256sums=('SKIP'
46
'SKIP')
47
48
source_x86_64=("${_ovname}-${pkgver}-cp310-abi3-manylinux_2_31_x86_64.whl::https://files.pythonhosted.org/packages/a0/50/69d75daa9dcacf9a7680ddbd803b7fe3c815d0f6eeb1574f212789f7b62d/${_ovname}-${pkgver}-cp310-abi3-manylinux_2_31_x86_64.whl")
49
sha256sums_x86_64=('e223518bd33b50bbd6b1c7860e4856cd7c477eb8656afdbe7871ff59355b37a6')
50
51
source_aarch64=("${_ovname}-${pkgver}-cp310-abi3-manylinux_2_31_aarch64.whl::https://files.pythonhosted.org/packages/8a/b8/42fa99dd53cf6614f6559ce09683903fce2509c8f840794baf23cda002d3/${_ovname}-${pkgver}-cp310-abi3-manylinux_2_31_aarch64.whl")
52
sha256sums_aarch64=('2aaa5ac920f3862346012e19c48fa5d2749f41dab690200fbc1c6d84ce4c7a88')
53
54
build() {
55
python -m venv --clear "$srcdir/venv"
56
57
# Resolve the upstream dependency set into the venv. The wheel itself is
58
# checksum-verified by makepkg; its transitive dependencies come from PyPI.
59
"$srcdir/venv/bin/python" -m pip install \
60
--no-cache-dir \
61
--disable-pip-version-check \
62
--no-warn-script-location \
63
--upgrade-strategy only-if-needed \
64
"$srcdir/$_wheel"
65
}
66
67
package() {
68
install -dm755 "$pkgdir$_prefix"
69
70
cp -a "$srcdir/venv" "$pkgdir$_prefix/venv"
71
72
# The venv was created under $srcdir, so every generated console script
73
# carries a shebang (and the activate scripts a VIRTUAL_ENV) pointing into
74
# the build directory. Rewrite them to the final /opt location.
75
find "$pkgdir$_venv/bin" -type f -exec sed -i "s|$srcdir/venv|$_venv|g" {} +
76
sed -i "s|$srcdir/venv|$_venv|g" "$pkgdir$_venv/pyvenv.cfg"
77
78
# CPython adds a decorative "𝜋thon" (U+1D70B, mathematical italic small pi)
79
# symlink next to python when it creates a venv on a UTF-8 filesystem. Such
80
# a non-ASCII pathname cannot always be encoded by bsdtar under a C locale,
81
# which makes the build depend on the ambient locale. Nothing uses that
82
# alias, so drop it and keep the package contents deterministic.
83
rm -f "$pkgdir$_venv/bin/𝜋thon"
84
85
# Entry points. A wrapper rather than a plain symlink, so that a stale
86
# venv (after a Python minor upgrade) fails with an actionable message
87
# instead of a bare ModuleNotFoundError.
88
local _cmd
89
for _cmd in openviking openviking-server ov vikingbot; do
90
cat > "$srcdir/$pkgname.$_cmd" <<'EOS'
91
#!/bin/sh
92
# openviking-bin: run @CMD@ from the private virtualenv in @VENV@.
93
_venv=@VENV@
94
_pyver=$("$_venv/bin/python" -c 'import sys; print("%d.%d" % sys.version_info[:2])' 2>/dev/null)
95
if [ ! -d "$_venv/lib/python$_pyver/site-packages/openviking" ]; then
96
printf '%s\n' \
97
"openviking: the private virtualenv in $_venv does not match the running Python ${_pyver:-?}." \
98
"Rebuild openviking-bin after a Python upgrade, e.g.: paru -S openviking-bin" >&2
99
exit 1
100
fi
101
exec "$_venv/bin/@CMD@" "$@"
102
EOS
103
sed -i -e "s|@VENV@|$_venv|g" -e "s|@CMD@|$_cmd|g" "$srcdir/$pkgname.$_cmd"
104
105
install -Dm755 "$srcdir/$pkgname.$_cmd" "$pkgdir/usr/bin/$_cmd"
106
done
107
108
install -Dm644 "$srcdir/$_ovname.service" \
109
"$pkgdir/usr/lib/systemd/system/$_ovname.service"
110
install -Dm644 "$srcdir/$_ovname.sysusers" \
111
"$pkgdir/usr/lib/sysusers.d/$_ovname.conf"
112
}
113
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-21 09:34:45 | Low | 2 |