picot

maintainer jinzhongjia · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from source and bundles a prebuilt binary from a non-whitelisted but project-associated GitHub release; however, the binary is not executed remotely and the source is available, limiting supply-chain risk to the bundled binary only.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from source and bundles a prebuilt binary from a non-whitelisted but project-associated GitHub release; however, the binary is not executed remotely and the source is available, limiting supply-chain risk to the bundled binary only.

PKGBUILD

      1# Maintainer: jinzhongjia <mail@nvimer.org>
    
      2
    
      3pkgname=picot
    
      4pkgver=0.3.1
    
      5pkgrel=1
    
      6_pi_ver=0.82.0
    
      7pkgdesc="Local Codex-style desktop GUI for the Pi coding agent"
    
      8arch=('x86_64' 'aarch64')
    
      9url="https://github.com/shixin-guo/picot"
    
      10license=('MIT')
    
      11depends=(
    
      12    'cairo'
    
      13    'dbus'
    
      14    'gdk-pixbuf2'
    
      15    'glib2'
    
      16    'glibc'
    
      17    'gcc-libs'
    
      18    'gtk3'
    
      19    'hicolor-icon-theme'
    
      20    'libsoup3'
    
      21    'pango'
    
      22    'webkit2gtk-4.1'
    
      23)
    
      24makedepends=(
    
      25    'bun'
    
      26    'rust'
    
      27    'cargo'
    
      28    'pkgconf'
    
      29)
    
      30# Upstream renamed the project pi-studio -> picot (GitHub repo redirect); this
    
      31# package supersedes pi-studio. replaces= migrates existing installs on -Syu.
    
      32provides=('pi-studio')
    
      33replaces=('pi-studio')
    
      34conflicts=('pi-studio' 'picot-bin')
    
      35options=('!lto' '!debug')
    
      36
    
      37_pi_relurl="https://github.com/earendil-works/pi-mono/releases/download/v${_pi_ver}"
    
      38
    
      39source=("${pkgname}-${pkgver}.tar.gz::${url}/archive/refs/tags/v${pkgver}.tar.gz")
    
      40sha256sums=('c8c2823e788d1b36404371dd99b2caba6aa1f8de434a5320a1e969160ff35b2a')
    
      41source_x86_64=("pi-linux-x64-${_pi_ver}.tar.gz::${_pi_relurl}/pi-linux-x64.tar.gz")
    
      42sha256sums_x86_64=('791abd8043bf85deb4d090b905c9ebce4eb4f5776f919b4e3d371f69a6b977d0')
    
      43source_aarch64=("pi-linux-arm64-${_pi_ver}.tar.gz::${_pi_relurl}/pi-linux-arm64.tar.gz")
    
      44sha256sums_aarch64=('a0bd25d2f41a754463bc96fb21f5e790adb3b75d1eed98bed2b19d3529022b0f')
    
      45
    
      46prepare() {
    
      47    cd "picot-${pkgver}"
    
      48
    
      49    export HOME="${srcdir}/.home"
    
      50    mkdir -p "$HOME"
    
      51
    
      52    # Place the pre-downloaded pi binary so the fetch script is skipped
    
      53    local _pidir="src-tauri/resources/pi"
    
      54    mkdir -p "${_pidir}"
    
      55    cp -a "${srcdir}/pi/". "${_pidir}/"
    
      56    printf '%s' "${_pi_ver}" > "${_pidir}/.version"
    
      57
    
      58    bun install --frozen-lockfile
    
      59
    
      60    export CARGO_HOME="${srcdir}/.cargo"
    
      61    export RUSTUP_TOOLCHAIN=stable
    
      62    (cd src-tauri && cargo fetch --target "${CARCH}-unknown-linux-gnu")
    
      63}
    
      64
    
      65build() {
    
      66    cd "picot-${pkgver}"
    
      67
    
      68    export HOME="${srcdir}/.home"
    
      69    export CARGO_HOME="${srcdir}/.cargo"
    
      70    export RUSTUP_TOOLCHAIN=stable
    
      71    export RUSTFLAGS="${RUSTFLAGS} --remap-path-prefix=${srcdir}/picot-${pkgver}=/build/${pkgname} --remap-path-prefix=${srcdir}/.cargo/registry=/cargo-registry"
    
      72
    
      73    # Build extensions
    
      74    bun run build:extensions
    
      75
    
      76    # Build Tauri app without bundling
    
      77    bun run tauri build --no-bundle
    
      78}
    
      79
    
      80package() {
    
      81    cd "picot-${pkgver}"
    
      82
    
      83    # ponytail: upstream 0.3.1 added .cargo/config.toml (target-dir = "target"),
    
      84    # moving the binary out of src-tauri/. Accept either layout.
    
      85    install -Dm755 "$(ls target/release/picot src-tauri/target/release/picot 2>/dev/null | head -1)" \
    
      86        "${pkgdir}/usr/bin/${pkgname}"
    
      87
    
      88    # Frontend resources
    
      89    local _libdir="${pkgdir}/usr/lib/Picot"
    
      90    install -d "${_libdir}"
    
      91    cp -a public "${_libdir}/public"
    
      92
    
      93    # Bundled pi runtime
    
      94    cp -a src-tauri/resources/pi "${_libdir}/pi"
    
      95
    
      96    # Bundled extensions
    
      97    install -d "${_libdir}/extensions"
    
      98    install -Dm644 extensions/dist/*.mjs "${_libdir}/extensions/"
    
      99
    
      100    # Icons
    
      101    local _icondir="${pkgdir}/usr/share/icons/hicolor"
    
      102    install -Dm644 "src-tauri/icons/32x32.png" "${_icondir}/32x32/apps/${pkgname}.png"
    
      103    install -Dm644 "src-tauri/icons/128x128.png" "${_icondir}/128x128/apps/${pkgname}.png"
    
      104    install -Dm644 "src-tauri/icons/128x128@2x.png" "${_icondir}/256x256/apps/${pkgname}.png"
    
      105
    
      106    # Desktop entry
    
      107    install -Dm644 /dev/stdin "${pkgdir}/usr/share/applications/${pkgname}.desktop" <<'EOF'
    
      108[Desktop Entry]
    
      109Type=Application
    
      110Name=Picot
    
      111Comment=Local Codex-style desktop GUI for the Pi coding agent
    
      112Exec=picot
    
      113Icon=picot
    
      114Terminal=false
    
      115Categories=Development;
    
      116StartupWMClass=picot
    
      117EOF
    
      118
    
      119    # Upstream declares MIT in package.json but ships no LICENSE file
    
      120    install -d "${pkgdir}/usr/share/licenses/${pkgname}"
    
      121}
    
      122

Changes since previous scan

--- PKGBUILD @ 2026-07-31 00:14
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,9 +1,9 @@
 # Maintainer: jinzhongjia <mail@nvimer.org>
 
 pkgname=picot
-pkgver=0.3.0
+pkgver=0.3.1
 pkgrel=1
-_pi_ver=0.80.10
+_pi_ver=0.82.0
 pkgdesc="Local Codex-style desktop GUI for the Pi coding agent"
 arch=('x86_64' 'aarch64')
 url="https://github.com/shixin-guo/picot"
@@ -37,11 +37,11 @@
 _pi_relurl="https://github.com/earendil-works/pi-mono/releases/download/v${_pi_ver}"
 
 source=("${pkgname}-${pkgver}.tar.gz::${url}/archive/refs/tags/v${pkgver}.tar.gz")
-sha256sums=('362e6f9bb0a9f56b0b63d6a372e1867d523adaf771c2e6ba650f4e66ac5e0d20')
+sha256sums=('c8c2823e788d1b36404371dd99b2caba6aa1f8de434a5320a1e969160ff35b2a')
 source_x86_64=("pi-linux-x64-${_pi_ver}.tar.gz::${_pi_relurl}/pi-linux-x64.tar.gz")
-sha256sums_x86_64=('ab6604f6c3f3d050783e7abbbdd1f79b775b20f3969833ce9721740685d01e13')
+sha256sums_x86_64=('791abd8043bf85deb4d090b905c9ebce4eb4f5776f919b4e3d371f69a6b977d0')
 source_aarch64=("pi-linux-arm64-${_pi_ver}.tar.gz::${_pi_relurl}/pi-linux-arm64.tar.gz")
-sha256sums_aarch64=('dfe4340063dfe27406fa64aac99d904726fac079197c4579b9e8155175d05272')
+sha256sums_aarch64=('a0bd25d2f41a754463bc96fb21f5e790adb3b75d1eed98bed2b19d3529022b0f')
 
 prepare() {
     cd "picot-${pkgver}"
@@ -80,7 +80,9 @@
 package() {
     cd "picot-${pkgver}"
 
-    install -Dm755 "src-tauri/target/release/picot" \
+    # ponytail: upstream 0.3.1 added .cargo/config.toml (target-dir = "target"),
+    # moving the binary out of src-tauri/. Accept either layout.
+    install -Dm755 "$(ls target/release/picot src-tauri/target/release/picot 2>/dev/null | head -1)" \
         "${pkgdir}/usr/bin/${pkgname}"
 
     # Frontend resources

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 03:17:12	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 19:25:44	LOW	2