unsloth-desktop-bin

maintainer satoki · 0 votes · scanned 2026-08-18 00:03:42.021799

LOW

Why flagged The package installs a prebuilt binary from the project's official GitHub release, which is a normal practice for AUR bin packages; the only risk is trusting the upstream build, but no malicious behavior or unverifiable sources are present.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package installs a prebuilt binary from the project's official GitHub release, which is a normal practice for AUR bin packages; the only risk is trusting the upstream build, but no malicious behavior or unverifiable sources are present.

PKGBUILD

      1# Maintainer: Sato Ki <satoki at em dot advant dot click>
    
      2
    
      3# Unsloth Desktop: the Tauri/WebKitGTK shell for Unsloth Studio, repackaged from
    
      4# the upstream Ubuntu .deb. Distinct from the AUR `unsloth` package, which builds
    
      5# the Python studio + web UI from source; the two share no files and may be
    
      6# installed together.
    
      7#
    
      8# On first launch the app bootstraps a per-user Python environment under
    
      9# ~/.unsloth/studio (PyTorch, llama.cpp, ...) by running the install.sh it ships
    
      10# in /usr/lib/Unsloth. Nothing is written outside $HOME and no root is needed;
    
      11# the script's apt/sudo paths are gated behind `command -v apt-get` and are dead
    
      12# on Arch. It does hard-require a download transport, hence curl in depends.
    
      13
    
      14pkgname=unsloth-desktop-bin
    
      15pkgver=0.1.800.beta
    
      16pkgrel=1
    
      17pkgdesc='Unsloth Desktop - train and run open models locally (prebuilt)'
    
      18arch=('x86_64')
    
      19url='https://unsloth.ai/'
    
      20license=('AGPL-3.0-only')
    
      21# From the binary's DT_NEEDED entries, not the .deb control file: the deb declares
    
      22# libappindicator3-1 but nothing links against it.
    
      23depends=(
    
      24	'webkit2gtk-4.1'
    
      25	'gtk3'
    
      26	'libsoup3'
    
      27	'dbus'
    
      28	'cairo'
    
      29	'gdk-pixbuf2'
    
      30	'glib2'
    
      31	'curl'
    
      32)
    
      33optdepends=(
    
      34	'git: fetches the triton_kernels training speedup during setup'
    
      35	'cmake: build llama.cpp from source instead of using the prebuilt'
    
      36	'gcc: build llama.cpp from source instead of using the prebuilt'
    
      37	'rocminfo: AMD GPU gfx arch detection; without it setup guesses from PCI IDs'
    
      38	'amdsmi: AMD GPU gfx arch detection; without it setup guesses from PCI IDs'
    
      39)
    
      40options=('!strip')
    
      41
    
      42_debver="${pkgver//./_}"
    
      43_tag="v${pkgver/.beta/-beta}"
    
      44source=("https://github.com/unslothai/unsloth/releases/download/${_tag}/Unsloth-Desktop-${_debver}-Ubuntu.deb")
    
      45sha256sums=('a8b2224b4dc4e463ee5cdff7ac38f4a1178cab5138b77b3141aeb9f6237160a0')
    
      46
    
      47package() {
    
      48	bsdtar -xf data.tar.gz -C "$pkgdir"
    
      49
    
      50	# Upstream ships an empty Categories= line, which desktop-file-validate
    
      51	# rejects and some menu implementations choke on.
    
      52	sed -i 's/^Categories=$/Categories=Development;Science;/' \
    
      53		"$pkgdir/usr/share/applications/Unsloth.desktop"
    
      54}
    
      55

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	LOW	2
2026-08-17 03:35:16	LOW	2