viewport-webkitgtk-git

maintainer codebam · 0 votes · scanned 2026-08-18 00:03:42.021799

LOW

Why flagged The package builds from a public git repository (plausibly the project's own) and installs compiled binaries and static web assets; the only risk is the unverifiable source due to SKIP'd checksum, but this is typical for -git packages and does not imply active malice or remote code execution.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from a public git repository (plausibly the project's own) and installs compiled binaries and static web assets; the only risk is the unverifiable source due to SKIP'd checksum, but this is typical for -git packages and does not imply active malice or remote code execution.

PKGBUILD

      1# Maintainer: Sean Behan <codebam@riseup.net>
    
      2#
    
      3# The shell drawn by WebKitGTK, in a process of its own as an ordinary Wayland
    
      4# client of this compositor. Nothing here builds an engine: `webkitgtk-6.0` is
    
      5# a package.
    
      6#
    
      7# The development version: this one follows `main` rather than a tag, so what
    
      8# it builds is whatever was pushed. `viewport-webkitgtk` is the same recipe cut
    
      9# from the last release, and `viewport-webkitgtk-bin` is that release already
    
      10# built — a system takes one of the three, and one engine.
    
      11#
    
      12# `pkgver()` reports the last tag, how many commits past it the checkout is,
    
      13# and which commit — `0.1.5.r12.gdeadbee` — so an installed snapshot sorts
    
      14# above the release it came after and says on sight what it is.
    
      15
    
      16pkgname=viewport-webkitgtk-git
    
      17pkgver=0.1.6.r3.g4f93524
    
      18pkgrel=1
    
      19pkgdesc='Wayland compositor whose shell is a web page — WebKitGTK, out of process (git)'
    
      20arch=('x86_64' 'aarch64')
    
      21url='https://github.com/codebam/viewport'
    
      22license=('GPL-3.0-or-later')
    
      23
    
      24depends=(
    
      25  'wayland'
    
      26  'libxkbcommon'
    
      27  'pixman'
    
      28  'libdrm'
    
      29  'libinput'
    
      30  'seatd'
    
      31  'systemd-libs'
    
      32  'mesa'
    
      33  'libglvnd'
    
      34  'vulkan-icd-loader'
    
      35  'pipewire'
    
      36  'libxcb'
    
      37  'xcb-util-wm'
    
      38  'webkitgtk-6.0'
    
      39  'gtk4'
    
      40  # WebKit guesses the type of a file:// page from the shared MIME database.
    
      41  # Without it the bundled shell loads "successfully" and draws nothing.
    
      42  'shared-mime-info'
    
      43)
    
      44
    
      45optdepends=(
    
      46  'xorg-xwayland: X11 clients'
    
      47  'xdg-desktop-portal-gtk: the portal interfaces the compositor does not answer itself'
    
      48  # Vulkan is the renderer wherever a Vulkan device owns the display; without
    
      49  # one the compositor draws with OpenGL instead, so these are what decide
    
      50  # which of the two a machine gets rather than whether it starts at all.
    
      51  'vulkan-radeon: AMD hardware'
    
      52  'vulkan-intel: Intel hardware'
    
      53  'nvidia-utils: NVIDIA hardware, and hardware video decode with it'
    
      54  # In a virtual machine: Venus passes Vulkan through to the host's GPU, and
    
      55  # needs the host to offer it — QEMU wants
    
      56  # `-device virtio-gpu-gl-pci,venus=on,blob=on,hostmem=2G`. Without it the
    
      57  # only device that loads is lavapipe, which owns no DRM node, cannot drive
    
      58  # a display, and turns every shell-frame copy into a copy on the CPU.
    
      59  'vulkan-virtio: a virtual machine with 3D acceleration'
    
      60  'vulkan-swrast: software Vulkan, for tests rather than a session'
    
      61  'libva-mesa-driver: hardware video decode, for zero-copy video'
    
      62  # The bar's icons are Material Design glyphs from a Nerd Font patch, and the
    
      63  # family names in data/shell/shell.css are the ones fontconfig reports:
    
      64  # "FiraCode Nerd Font" first, "Symbols Nerd Font" as the fallback that
    
      65  # carries the glyphs without the monospace face. With neither installed the
    
      66  # bar still lays out and every icon in it is a replacement box.
    
      67  'ttf-firacode-nerd: the icons in the bar, and the font the shell names first'
    
      68  'ttf-nerd-fonts-symbols: the icons in the bar, without the patched monospace family'
    
      69)
    
      70
    
      71makedepends=(
    
      72  # cargo comes with it: Arch has no separate cargo package, and naming
    
      73  # one fails dependency resolution before a line is compiled.
    
      74  'rust'
    
      75  'git'
    
      76  'pkgconf'
    
      77  'clang'
    
      78  'vulkan-headers'
    
      79  'wayland-protocols'
    
      80
    
      81)
    
      82
    
      83provides=("viewport=$pkgver" "viewport-webkitgtk=$pkgver")
    
      84conflicts=('viewport'
    
      85           'viewport-webkitgtk'
    
      86           'viewport-wpe'
    
      87           'viewport-chromium')
    
      88options=('!lto')
    
      89
    
      90source=("viewport::git+https://github.com/codebam/viewport.git")
    
      91sha256sums=('SKIP')
    
      92
    
      93# The version, read off the checkout rather than written here: the last tag,
    
      94# the distance from it, and the commit.
    
      95#
    
      96# makepkg runs this after fetching and rewrites the `pkgver=` above with what
    
      97# it returns, so the number in the recipe is whatever the last person to build
    
      98# it saw — one commit behind by construction, which is what every VCS package
    
      99# in the AUR carries. It is a marker, not a claim: what gets installed is
    
      100# always what `main` says at build time.
    
      101pkgver() {
    
      102  cd "$srcdir/viewport"
    
      103  git describe --long --tags --abbrev=7 \
    
      104    | sed 's/^v//;s/\([^-]*-g\)/r\1/;s/-/./g'
    
      105}
    
      106
    
      107prepare() {
    
      108  cd "$srcdir/viewport"
    
      109  # A git dependency (the smithay fork, for the tearing-control patch) has to
    
      110  # be fetched here rather than during build(), so build() is the only step
    
      111  # that has to work offline.
    
      112  export RUSTUP_TOOLCHAIN=stable
    
      113  cargo fetch --locked --target "$(rustc -vV | sed -n 's/host: //p')"
    
      114}
    
      115
    
      116build() {
    
      117  cd "$srcdir/viewport"
    
      118  export RUSTUP_TOOLCHAIN=stable
    
      119  export CARGO_TARGET_DIR=target
    
      120  cargo build --frozen --release -p viewport -p viewport-shell-gtk
    
      121}
    
      122
    
      123package() {
    
      124  cd "$srcdir/viewport"
    
      125
    
      126  # Which engine this package installed, said outright. The binary picks a
    
      127  # default of its own and cannot know which shell program is beside it, so a
    
      128  # wrapper names it. `${VIEWPORT_SHELL_BACKEND:-}` first, so `--shell-backend`
    
      129  # and the config file still win.
    
      130  install -Dm755 target/release/viewport "$pkgdir/usr/lib/viewport/viewport"
    
      131  install -Dm755 /dev/stdin "$pkgdir/usr/bin/viewport" <<'EOF'
    
      132#!/bin/sh
    
      133export VIEWPORT_SHELL_BACKEND="${VIEWPORT_SHELL_BACKEND:-webkitgtk}"
    
      134# And where the shell is. The compositor finds its own assets at
    
      135# `<prefix>/share/viewport`, taken from the directory two above the binary —
    
      136# which works for /usr/bin/viewport and does not for the wrapped layout here:
    
      137# /usr/lib/viewport/viewport gives /usr/lib/share/viewport, nothing is there,
    
      138# and it falls back to `$PWD/data/shell`. A login shell starts in $HOME, so
    
      139# that is a black screen with a working cursor and one line in the log:
    
      140#
    
      141#   the shell page failed to load from file:///home/you/data/shell/index.html
    
      142#
    
      143# Set only when unset, so --url and the config file still win.
    
      144export VIEWPORT_SHELL_URL="${VIEWPORT_SHELL_URL:-file:///usr/share/viewport/shell/index.html}"
    
      145exec /usr/lib/viewport/viewport "$@"
    
      146EOF
    
      147  install -Dm755 target/release/viewport-shell-gtk \
    
      148    "$pkgdir/usr/lib/viewport/viewport-shell-gtk"
    
      149
    
      150  # The shell itself, and the page it falls back to. Without them an installed
    
      151  # compositor has nothing to load: the default URL resolves beside the binary,
    
      152  # and a session started from a login shell has no source tree under it.
    
      153  install -dm755 "$pkgdir/usr/share/viewport"
    
      154  cp -r data/shell "$pkgdir/usr/share/viewport/shell"
    
      155  install -Dm644 data/fallback.html "$pkgdir/usr/share/viewport/fallback.html"
    
      156  install -Dm644 data/config.example.json \
    
      157    "$pkgdir/usr/share/viewport/config.example.json"
    
      158
    
      159  # How xdg-desktop-portal learns this backend exists. Without the file the
    
      160  # frontend does not know the name "viewport" refers to anything, so a config
    
      161  # naming it matches nothing and the request goes elsewhere.
    
      162  install -Dm644 data/portal-share/xdg-desktop-portal/portals/viewport.portal \
    
      163    "$pkgdir/usr/share/xdg-desktop-portal/portals/viewport.portal"
    
      164
    
      165  # The session target the compositor starts on launch. Without it
    
      166  # graphical-session.target stays inactive, and xdg-desktop-portal — which
    
      167  # holds Requisite=graphical-session.target — refuses to start at all, taking
    
      168  # the Settings interface and every application's dark theme with it.
    
      169  install -Dm644 data/systemd/user/viewport-session.target \
    
      170    "$pkgdir/usr/lib/systemd/user/viewport-session.target"
    
      171
    
      172  install -Dm644 docs/viewport.1 "$pkgdir/usr/share/man/man1/viewport.1"
    
      173
    
      174  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE" 2>/dev/null || true
    
      175
    
      176  install -Dm644 /dev/stdin "$pkgdir/usr/share/wayland-sessions/viewport.desktop" <<'EOF'
    
      177[Desktop Entry]
    
      178Name=Viewport
    
      179Comment=Wayland compositor with a WebKitGTK shell
    
      180Exec=viewport
    
      181Type=Application
    
      182EOF
    
      183}
    
      184

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	LOW	2
2026-08-17 00:18:29	LOW	2
2026-08-16 00:03:42	LOW	2
2026-08-15 23:31:34	LOW	2