viewport-wpe-bin
maintainer codebam
· 0 votes
· scanned 2026-08-18 03:38:23.746777
LOW
View on AUR ↗
Why flagged
The package is a binary release from the same upstream project, installing prebuilt but officially generated artifacts; the only risk is the unverifiable nature of the prebuilt package, but it matches the source build output and comes from the project's own release infrastructure.
Triggered rules
LOW
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
LOW
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package is a binary release from the same upstream project, installing prebuilt but officially generated artifacts; the only risk is the unverifiable nature of the prebuilt package, but it matches the source build output and comes from the project's own release infrastructure.
PKGBUILD
1
# Maintainer: Sean Behan <codebam@riseup.net>
2
#
3
# The same compositor as `viewport-wpe`, already built. The source
4
# package compiles the whole tree and the WPE engine with it — Smithay, wgpu,
5
# Vulkan and WebKit inside the compositor process — which is the tallest build
6
# of the four; this one unpacks the binaries the release was cut with instead.
7
#
8
# The upstream artifact is itself an Arch package, built from the recipe in
9
# packaging/aur/viewport-wpe of the tagged tree, so what lands in $pkgdir here is
10
# byte for byte what the source package would have produced.
11
#
12
# The shell is drawn by WPE WebKit inside the compositor, not in a process of
13
# its own, so there is no second shell binary to place here and no wrapper:
14
# `--features wpe` is the engine in this process, and the one binary this
15
# package carries is /usr/bin/viewport itself.
16
17
pkgname=viewport-wpe-bin
18
pkgver=0.1.8
19
pkgrel=1
20
pkgdesc='Wayland compositor whose entire shell is a web page — WPE WebKit, in-process (binary release)'
21
arch=('x86_64')
22
url='https://github.com/codebam/viewport'
23
license=('GPL-3.0-or-later')
24
25
# The pkgrel of the upstream artifact, which moves independently of this
26
# package's own: a fix to this recipe bumps pkgrel without a new release to
27
# download.
28
_pkgrel=1
29
30
depends=(
31
'wayland'
32
'libxkbcommon'
33
'pixman'
34
'libdrm'
35
'libinput'
36
'seatd'
37
'systemd-libs'
38
'mesa'
39
'libglvnd'
40
'vulkan-icd-loader'
41
'wpewebkit'
42
'glib2'
43
'json-glib'
44
'libxcb'
45
'xcb-util-wm'
46
'pipewire'
47
# WebKit guesses the type of a file:// page from the shared MIME database,
48
# because nothing else tells it. Without this every local page is treated as
49
# an empty document: the load reports started, committed and finished, not
50
# one script runs, and the desktop comes up with no bar and nothing laid out.
51
# The bundled shell is loaded from file://, so this is a hard dependency —
52
# and its absence looks like a compositor bug, not a missing package.
53
'shared-mime-info'
54
)
55
56
optdepends=(
57
'xorg-xwayland: X11 clients'
58
'xdg-desktop-portal-gtk: the portal interfaces the compositor does not answer itself'
59
# Vulkan is the renderer wherever a Vulkan device owns the display; without
60
# one the compositor draws with OpenGL instead, so these decide which of the
61
# two a machine gets rather than whether it starts at all.
62
'vulkan-radeon: AMD hardware'
63
'vulkan-intel: Intel hardware'
64
'nvidia-utils: NVIDIA hardware, and hardware video decode with it'
65
# In a virtual machine: Venus passes Vulkan through to the host's GPU, and
66
# needs the host to offer it — QEMU wants
67
# `-device virtio-gpu-gl-pci,venus=on,blob=on,hostmem=2G`. Without it the
68
# only device that loads is lavapipe, which owns no DRM node, cannot drive a
69
# display, and turns every shell-frame copy into a copy on the CPU.
70
'vulkan-virtio: a virtual machine with 3D acceleration'
71
'vulkan-swrast: software Vulkan, for tests rather than a session'
72
# The compositor imports the multi-planar YUV a hardware decoder produces
73
# (NV12, P010 and the rest), so a player can hand over the decoder's own
74
# buffer with nothing converted in between. That only happens if the player
75
# can decode in hardware in the first place, which is what these provide.
76
# Without one, video still plays — the player converts each frame itself,
77
# which is the cost the import path exists to avoid.
78
'libva-mesa-driver: hardware video decode on AMD and Intel, for zero-copy video'
79
# The bar's icons are Material Design glyphs from a Nerd Font patch, and the
80
# family names in data/shell/shell.css are the ones fontconfig reports:
81
# "FiraCode Nerd Font" first, "Symbols Nerd Font" as the fallback that
82
# carries the glyphs without the monospace face. With neither installed the
83
# bar still lays out and every icon in it is a replacement box.
84
'ttf-firacode-nerd: the icons in the bar, and the font the shell names first'
85
'ttf-nerd-fonts-symbols: the icons in the bar, without the patched monospace family'
86
)
87
88
provides=("viewport=$pkgver" "viewport-wpe=$pkgver")
89
# Every engine's package installs a binary called `viewport` and provides that
90
# name, so a system takes one of them — this one, the source recipe it was
91
# built from, or another engine's.
92
conflicts=('viewport'
93
'viewport-webkitgtk'
94
'viewport-wpe'
95
'viewport-chromium')
96
97
# Nothing to strip and nothing to index: these binaries were stripped where
98
# they were built, and a -debug package cut from them would hold no symbols.
99
options=('!strip' '!debug')
100
101
# Downloaded under a name that is not *.pkg.tar.*, so the artifact sitting in
102
# the build directory is not mistaken for the package this recipe produced.
103
source_x86_64=("$pkgname-$pkgver.tar.zst::$url/releases/download/v$pkgver/viewport-wpe-$pkgver-$_pkgrel-$CARCH.pkg.tar.zst")
104
sha256sums_x86_64=('55399531f1e9768f59c6da8bfd6cf547c2619666fc4ea072a5c0b4439412bba3')
105
106
package() {
107
# The source is an Arch package, so makepkg has already unpacked a $pkgdir
108
# tree into $srcdir; everything beside usr/ is package metadata that pacman
109
# generates again for this package.
110
cp -a "$srcdir/usr" "$pkgdir/usr"
111
112
# The man page comes with the artifact rather than being installed here:
113
# this recipe unpacks a built package, so `$srcdir` holds `usr/` and the
114
# metadata pacman regenerates, and there is no source tree to copy a page
115
# out of. The source recipe installs it, so the `cp -a` above carries it.
116
117
# The licence directory is named for the package that installed it, and that
118
# is a different name here.
119
mv "$pkgdir/usr/share/licenses/viewport-wpe" \
120
"$pkgdir/usr/share/licenses/$pkgname"
121
}
122
Changes since previous scan
--- PKGBUILD @ 2026-08-16 00:03+++ PKGBUILD @ 2026-08-18 03:38@@ -15,7 +15,7 @@ # package carries is /usr/bin/viewport itself. pkgname=viewport-wpe-bin-pkgver=0.1.7+pkgver=0.1.8 pkgrel=1 pkgdesc='Wayland compositor whose entire shell is a web page — WPE WebKit, in-process (binary release)' arch=('x86_64')@@ -101,7 +101,7 @@ # Downloaded under a name that is not *.pkg.tar.*, so the artifact sitting in # the build directory is not mistaken for the package this recipe produced. source_x86_64=("$pkgname-$pkgver.tar.zst::$url/releases/download/v$pkgver/viewport-wpe-$pkgver-$_pkgrel-$CARCH.pkg.tar.zst")-sha256sums_x86_64=('8eb733e7211e5725862487a6ad593f7599532d300a8682595e5087cb5a01fe15')+sha256sums_x86_64=('55399531f1e9768f59c6da8bfd6cf547c2619666fc4ea072a5c0b4439412bba3') package() { # The source is an Arch package, so makepkg has already unpacked a $pkgdirScan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-18 03:38:23 | LOW | 2 |
| 2026-08-16 00:03:42 | CLEAN | 2 |
| 2026-08-15 23:31:34 | LOW | 1 |