viewport-chromium-git

maintainer codebam · 0 votes · scanned 2026-08-18 00:03:42.021799

LOW

Why flagged Package builds from a git source of the project's own repository, has SKIP'd checksum which is common for git packages, and installs a Wayland compositor with Chromium integration; no evidence of malicious behavior or untrusted remote code execution.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 90%): Package builds from a git source of the project's own repository, has SKIP'd checksum which is common for git packages, and installs a Wayland compositor with Chromium integration; no evidence of malicious behavior or untrusted remote code execution.

PKGBUILD

      1# Maintainer: Sean Behan <codebam@riseup.net>
    
      2#
    
      3# The shell drawn by Chromium, started as a child process and driven over the
    
      4# DevTools protocol. This links no engine at all: the browser is a runtime
    
      5# dependency, and which Chromium it runs can change without a rebuild.
    
      6#
    
      7# The development version: this one follows `main` rather than a tag, so what
    
      8# it builds is whatever was pushed. `viewport-chromium` is the same recipe cut
    
      9# from the last release, and `viewport-chromium-bin` is that release already
    
      10# built — a system takes one of the three, and one engine.
    
      11#
    
      12# `pkgver()` reports the last tag, how many commits past it the checkout is,
    
      13# and which commit — `0.1.5.r12.gdeadbee` — so an installed snapshot sorts
    
      14# above the release it came after and says on sight what it is.
    
      15
    
      16pkgname=viewport-chromium-git
    
      17pkgver=0.1.6.r3.g4f93524
    
      18pkgrel=1
    
      19pkgdesc='Wayland compositor whose shell is a web page — Chromium, driven as a child process (git)'
    
      20arch=('x86_64' 'aarch64')
    
      21url='https://github.com/codebam/viewport'
    
      22license=('GPL-3.0-or-later')
    
      23
    
      24depends=(
    
      25  'wayland'
    
      26  'libxkbcommon'
    
      27  'pixman'
    
      28  'libdrm'
    
      29  'libinput'
    
      30  'seatd'
    
      31  'systemd-libs'
    
      32  'mesa'
    
      33  'libglvnd'
    
      34  'vulkan-icd-loader'
    
      35  'pipewire'
    
      36  'libxcb'
    
      37  'xcb-util-wm'
    
      38  'chromium'
    
      39)
    
      40
    
      41optdepends=(
    
      42  'xorg-xwayland: X11 clients'
    
      43  'xdg-desktop-portal-gtk: the portal interfaces the compositor does not answer itself'
    
      44  # Vulkan is the renderer wherever a Vulkan device owns the display; without
    
      45  # one the compositor draws with OpenGL instead, so these are what decide
    
      46  # which of the two a machine gets rather than whether it starts at all.
    
      47  'vulkan-radeon: AMD hardware'
    
      48  'vulkan-intel: Intel hardware'
    
      49  'nvidia-utils: NVIDIA hardware, and hardware video decode with it'
    
      50  # In a virtual machine: Venus passes Vulkan through to the host's GPU, and
    
      51  # needs the host to offer it — QEMU wants
    
      52  # `-device virtio-gpu-gl-pci,venus=on,blob=on,hostmem=2G`. Without it the
    
      53  # only device that loads is lavapipe, which owns no DRM node, cannot drive
    
      54  # a display, and turns every shell-frame copy into a copy on the CPU.
    
      55  'vulkan-virtio: a virtual machine with 3D acceleration'
    
      56  'vulkan-swrast: software Vulkan, for tests rather than a session'
    
      57  'libva-mesa-driver: hardware video decode, for zero-copy video'
    
      58  # The bar's icons are Material Design glyphs from a Nerd Font patch, and the
    
      59  # family names in data/shell/shell.css are the ones fontconfig reports:
    
      60  # "FiraCode Nerd Font" first, "Symbols Nerd Font" as the fallback that
    
      61  # carries the glyphs without the monospace face. With neither installed the
    
      62  # bar still lays out and every icon in it is a replacement box.
    
      63  'ttf-firacode-nerd: the icons in the bar, and the font the shell names first'
    
      64  'ttf-nerd-fonts-symbols: the icons in the bar, without the patched monospace family'
    
      65)
    
      66
    
      67makedepends=(
    
      68  # cargo comes with it: Arch has no separate cargo package, and naming
    
      69  # one fails dependency resolution before a line is compiled.
    
      70  'rust'
    
      71  'git'
    
      72  'pkgconf'
    
      73  'clang'
    
      74  'vulkan-headers'
    
      75  'wayland-protocols'
    
      76
    
      77)
    
      78
    
      79provides=("viewport=$pkgver" "viewport-chromium=$pkgver")
    
      80conflicts=('viewport'
    
      81           'viewport-webkitgtk'
    
      82           'viewport-wpe'
    
      83           'viewport-chromium')
    
      84options=('!lto')
    
      85
    
      86source=("viewport::git+https://github.com/codebam/viewport.git")
    
      87sha256sums=('SKIP')
    
      88
    
      89# The version, read off the checkout rather than written here: the last tag,
    
      90# the distance from it, and the commit.
    
      91#
    
      92# makepkg runs this after fetching and rewrites the `pkgver=` above with what
    
      93# it returns, so the number in the recipe is whatever the last person to build
    
      94# it saw — one commit behind by construction, which is what every VCS package
    
      95# in the AUR carries. It is a marker, not a claim: what gets installed is
    
      96# always what `main` says at build time.
    
      97pkgver() {
    
      98  cd "$srcdir/viewport"
    
      99  git describe --long --tags --abbrev=7 \
    
      100    | sed 's/^v//;s/\([^-]*-g\)/r\1/;s/-/./g'
    
      101}
    
      102
    
      103prepare() {
    
      104  cd "$srcdir/viewport"
    
      105  # A git dependency (the smithay fork, for the tearing-control patch) has to
    
      106  # be fetched here rather than during build(), so build() is the only step
    
      107  # that has to work offline.
    
      108  export RUSTUP_TOOLCHAIN=stable
    
      109  cargo fetch --locked --target "$(rustc -vV | sed -n 's/host: //p')"
    
      110}
    
      111
    
      112build() {
    
      113  cd "$srcdir/viewport"
    
      114  export RUSTUP_TOOLCHAIN=stable
    
      115  export CARGO_TARGET_DIR=target
    
      116  cargo build --frozen --release -p viewport -p viewport-shell-chromium
    
      117}
    
      118
    
      119package() {
    
      120  cd "$srcdir/viewport"
    
      121
    
      122  # Which engine this package installed, said outright. The binary picks a
    
      123  # default of its own and cannot know which shell program is beside it, so a
    
      124  # wrapper names it. `${VIEWPORT_SHELL_BACKEND:-}` first, so `--shell-backend`
    
      125  # and the config file still win.
    
      126  install -Dm755 target/release/viewport "$pkgdir/usr/lib/viewport/viewport"
    
      127  install -Dm755 /dev/stdin "$pkgdir/usr/bin/viewport" <<'EOF'
    
      128#!/bin/sh
    
      129export VIEWPORT_SHELL_BACKEND="${VIEWPORT_SHELL_BACKEND:-chromium}"
    
      130export VIEWPORT_CHROMIUM_BIN="${VIEWPORT_CHROMIUM_BIN:-/usr/bin/chromium}"
    
      131# And where the shell is. The compositor finds its own assets at
    
      132# `<prefix>/share/viewport`, taken from the directory two above the binary —
    
      133# which works for /usr/bin/viewport and does not for the wrapped layout here:
    
      134# /usr/lib/viewport/viewport gives /usr/lib/share/viewport, nothing is there,
    
      135# and it falls back to `$PWD/data/shell`. A login shell starts in $HOME, so
    
      136# that is a black screen with a working cursor and one line in the log:
    
      137#
    
      138#   the shell page failed to load from file:///home/you/data/shell/index.html
    
      139#
    
      140# Set only when unset, so --url and the config file still win.
    
      141export VIEWPORT_SHELL_URL="${VIEWPORT_SHELL_URL:-file:///usr/share/viewport/shell/index.html}"
    
      142exec /usr/lib/viewport/viewport "$@"
    
      143EOF
    
      144  install -Dm755 target/release/viewport-shell-chromium \
    
      145    "$pkgdir/usr/lib/viewport/viewport-shell-chromium"
    
      146
    
      147  # The shell itself, and the page it falls back to. Without them an installed
    
      148  # compositor has nothing to load: the default URL resolves beside the binary,
    
      149  # and a session started from a login shell has no source tree under it.
    
      150  install -dm755 "$pkgdir/usr/share/viewport"
    
      151  cp -r data/shell "$pkgdir/usr/share/viewport/shell"
    
      152  install -Dm644 data/fallback.html "$pkgdir/usr/share/viewport/fallback.html"
    
      153  install -Dm644 data/config.example.json \
    
      154    "$pkgdir/usr/share/viewport/config.example.json"
    
      155
    
      156  # How xdg-desktop-portal learns this backend exists. Without the file the
    
      157  # frontend does not know the name "viewport" refers to anything, so a config
    
      158  # naming it matches nothing and the request goes elsewhere.
    
      159  install -Dm644 data/portal-share/xdg-desktop-portal/portals/viewport.portal \
    
      160    "$pkgdir/usr/share/xdg-desktop-portal/portals/viewport.portal"
    
      161
    
      162  # The session target the compositor starts on launch. Without it
    
      163  # graphical-session.target stays inactive, and xdg-desktop-portal — which
    
      164  # holds Requisite=graphical-session.target — refuses to start at all, taking
    
      165  # the Settings interface and every application's dark theme with it.
    
      166  install -Dm644 data/systemd/user/viewport-session.target \
    
      167    "$pkgdir/usr/lib/systemd/user/viewport-session.target"
    
      168
    
      169  install -Dm644 docs/viewport.1 "$pkgdir/usr/share/man/man1/viewport.1"
    
      170
    
      171  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE" 2>/dev/null || true
    
      172
    
      173  install -Dm644 /dev/stdin "$pkgdir/usr/share/wayland-sessions/viewport.desktop" <<'EOF'
    
      174[Desktop Entry]
    
      175Name=Viewport
    
      176Comment=Wayland compositor with a Chromium shell
    
      177Exec=viewport
    
      178Type=Application
    
      179EOF
    
      180}
    
      181

Changes since previous scan

--- PKGBUILD @ 2026-08-15 00:26
+++ PKGBUILD @ 2026-08-18 00:03
@@ -14,7 +14,7 @@
 # above the release it came after and says on sight what it is.
 
 pkgname=viewport-chromium-git
-pkgver=0.1.5.r2.g4fa16d3
+pkgver=0.1.6.r3.g4f93524
 pkgrel=1
 pkgdesc='Wayland compositor whose shell is a web page — Chromium, driven as a child process (git)'
 arch=('x86_64' 'aarch64')

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	LOW	2
2026-08-17 00:18:29	LOW	2
2026-08-16 00:03:42	LOW	2
2026-08-15 23:31:34	LOW	2
2026-08-15 00:26:13	CLEAN	2
2026-08-14 11:29:14	LOW	1