skwir-git
LOW
maintainer venator
0 votes
scanned 2026-10-17 07:17:15.137327
Why flagged
The package builds from a legitimate project repository and includes a prebuilt PDFium binary from a trusted GitHub release; the flagged low votes and recent upload are not indicative of malicious intent, and all downloaded components are verifiable and used as intended.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Low
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from a legitimate project repository and includes a prebuilt PDFium binary from a trusted GitHub release; the flagged low votes and recent upload are not indicative of malicious intent, and all downloaded components are verifiable and used as intended.
PKGBUILD
1
# skwir's Arch packages built from main, for the AUR (ADR-040): those
2
# ../PKGBUILD makes from a release, from the repository's last commit.
3
# Their build and package functions are that PKGBUILD's, word for word
4
# but for the folder and what they provide (release-tools-check compares
5
# them); the PDFium they carry is the one the commit pins, which prepare()
6
# checks. makepkg names the version after the commit (pkgver());
7
# `just aur-prepare <tag>` publishes it again at each release.
8
# Maintainer: venator <venator at tutamail dot com>
9
10
pkgbase=skwir-git
11
pkgname=(skwir-git skwir-mermaid-git skwir-mupdf-git)
12
pkgver=0.1.0.r51.g17cf86d
13
pkgrel=1
14
pkgdesc='An augmented file manager, for humans and agents (its last commit)'
15
arch=('x86_64' 'aarch64')
16
url='https://skwir.org'
17
_repo='https://github.com/skwir-org/skwir'
18
license=('Apache-2.0')
19
# The libraries every helper links, to build them all, and what the
20
# packages depend on (a split PKGBUILD names it here too).
21
makedepends=(
22
'git'
23
'cargo' 'clang' 'cmake' 'python'
24
'libxcb' 'libxkbcommon' 'libxkbcommon-x11' 'sqlite' 'libarchive'
25
'cairo' 'glib2' 'poppler-glib' 'djvulibre' 'gstreamer' 'gst-plugins-base-libs'
26
'fontconfig' 'vulkan-icd-loader' 'vulkan-driver'
27
)
28
# makepkg's LTO compiles the C that crates build (MuPDF) into GCC's
29
# intermediate code, which Rust's linker (lld) cannot read.
30
options=('!lto')
31
_pdfium=8086
32
source=("skwir::git+$_repo.git")
33
source_x86_64=("pdfium-linux-x64-$_pdfium.tgz::https://github.com/bblanchon/pdfium-binaries/releases/download/chromium%2F$_pdfium/pdfium-linux-x64.tgz")
34
source_aarch64=("pdfium-linux-arm64-$_pdfium.tgz::https://github.com/bblanchon/pdfium-binaries/releases/download/chromium%2F$_pdfium/pdfium-linux-arm64.tgz")
35
# PDFium's: as tools/package/pdfium.lock pins them.
36
sha256sums=('SKIP')
37
sha256sums_x86_64=('588577cf52dabc1a444988bac841920df54cc2f141801424de97ab04f4fbb935')
38
sha256sums_aarch64=('e7e2fe4686925618330103cb167950aca5a84bb00fd977a41b86be59dd1480a2')
39
40
pkgver() {
41
cd skwir
42
# The last release, the commits since and the commit: 0.1.0.r51.g17cf86d.
43
git describe --long --tags --match 'v*' | sed 's/^v//; s/\([^-]*-g\)/r\1/; s/-/./g'
44
}
45
46
prepare() {
47
cd skwir
48
if [ "$(sed -n 's/^release //p' tools/package/pdfium.lock)" != "chromium/$_pdfium" ]; then
49
echo "skwir's main pins another PDFium than this PKGBUILD's ($_pdfium):" \
50
"the AUR package waits for its update" >&2
51
return 1
52
fi
53
export RUSTUP_TOOLCHAIN=stable
54
cargo fetch --locked --target "$(rustc -vV | sed -n 's/host: //p')"
55
}
56
57
build() {
58
cd skwir
59
export RUSTUP_TOOLCHAIN=stable
60
export CARGO_TARGET_DIR=target
61
# shellcheck disable=SC2046 # one `-p name` per program
62
cargo build --frozen --profile dist $(sed 's/^/-p /' tools/package/programs)
63
}
64
65
package_skwir-git() {
66
provides=("skwir=$pkgver")
67
conflicts=('skwir')
68
# What its programs link, and what skwir opens at run time (the Vulkan
69
# loader and a driver for it, fontconfig).
70
depends=(
71
'libgcc' 'glibc' 'libxcb' 'libxkbcommon' 'libxkbcommon-x11' 'sqlite'
72
'fontconfig' 'vulkan-icd-loader' 'vulkan-driver' 'libarchive'
73
)
74
optdepends=(
75
'gstreamer: audio and video playback'
76
'gst-plugins-base-libs: audio and video playback'
77
'gst-plugins-base: audio and video playback'
78
'gst-plugins-good: more audio and video formats'
79
'gst-plugins-bad: more audio and video formats'
80
'gst-plugins-ugly: more audio and video formats'
81
'gst-libav: more audio and video formats'
82
'poppler-glib: PDFs through Poppler, beside the PDFium skwir carries'
83
'djvulibre: DjVu through DjVuLibre, beside the djvu-rs reader skwir carries'
84
'skwir-mermaid: Mermaid diagrams drawn in Markdown previews'
85
'skwir-mupdf: the MuPDF engine, PDFs and books laid out into pages'
86
'bubblewrap: LibreOffice, ImageMagick and thumbnailers run isolated'
87
'libreoffice-fresh: office documents shown as pages'
88
'pandoc-cli: text documents read by Pandoc'
89
'imagemagick: pictures no thumbnailer draws'
90
'ffmpeg: still frames of films'
91
'perl-image-exiftool: writing and removing pictures locations'
92
'plocate: instant name searches over whole disks'
93
'udisks2: unmounting volumes from the sidebar'
94
)
95
# skwir's own, PDFium's, and the Poppler and DjVuLibre readers': a
96
# program linking Poppler (GPL v2 or v3) or DjVuLibre (GPL v2 or later)
97
# with code under Apache-2.0 is under the GPL v3 (ADR-042, ADR-061).
98
license=('Apache-2.0' 'BSD-3-Clause' 'GPL-3.0-only')
99
cd skwir
100
install -Dm755 target/dist/skwir "$pkgdir/usr/bin/skwir"
101
while read -r program; do
102
case "$program" in
103
skwir | skwir-mermaid-worker | skwir-mupdf-worker) ;;
104
*) install -Dm755 "target/dist/$program" -t "$pkgdir/usr/lib/skwir/" ;;
105
esac
106
done < tools/package/programs
107
install -Dm755 "$srcdir/lib/libpdfium.so" -t "$pkgdir/usr/lib/skwir/"
108
# skwir's folders, which it looks in for its licences
109
# (crates/platform/src/about.rs) whichever package holds it.
110
install -Dm644 "$srcdir/LICENSE" "$srcdir"/licenses/* -t "$pkgdir/usr/share/licenses/skwir/pdfium/"
111
install -Dm644 tools/package/linux/org.skwir.skwir.desktop -t "$pkgdir/usr/share/applications/"
112
install -Dm644 tools/package/linux/org.skwir.skwir.metainfo.xml -t "$pkgdir/usr/share/metainfo/"
113
install -Dm644 crates/ui/assets/org.skwir.skwir.svg -t "$pkgdir/usr/share/icons/hicolor/scalable/apps/"
114
install -Dm644 README.md -t "$pkgdir/usr/share/doc/skwir/"
115
install -Dm644 LICENSE -t "$pkgdir/usr/share/licenses/skwir/"
116
# The notices of what its programs link, the source's (ADR-063): Arch's
117
# skwir holds helpers Debian's ships apart.
118
install -Dm644 tools/package/notices/arch/skwir/THIRD-PARTY-NOTICES -t "$pkgdir/usr/share/licenses/skwir/"
119
}
120
121
package_skwir-mermaid-git() {
122
provides=("skwir-mermaid=$pkgver")
123
conflicts=('skwir-mermaid')
124
pkgdesc="Mermaid diagrams drawn in skwir's Markdown previews"
125
depends=('skwir-git' 'libgcc' 'glibc')
126
cd skwir
127
install -Dm755 target/dist/skwir-mermaid-worker -t "$pkgdir/usr/lib/skwir/"
128
install -Dm644 LICENSE -t "$pkgdir/usr/share/licenses/skwir-mermaid/"
129
install -Dm644 tools/package/notices/skwir-mermaid/THIRD-PARTY-NOTICES -t "$pkgdir/usr/share/licenses/skwir-mermaid/"
130
}
131
132
package_skwir-mupdf-git() {
133
provides=("skwir-mupdf=$pkgver")
134
conflicts=('skwir-mupdf')
135
pkgdesc="skwir's MuPDF engine: PDFs, and books laid out into pages"
136
depends=('skwir-git' 'libgcc' 'glibc')
137
# skwir's code, linking MuPDF (ADR-014).
138
license=('AGPL-3.0-or-later')
139
cd skwir
140
install -Dm755 target/dist/skwir-mupdf-worker -t "$pkgdir/usr/lib/skwir/"
141
install -Dm644 tools/package/notices/skwir-mupdf/THIRD-PARTY-NOTICES -t "$pkgdir/usr/share/licenses/skwir-mupdf/"
142
}
143
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-17 07:17:15 | Low | 2 |