viewport-wpe-git

maintainer codebam · 0 votes · scanned 2026-08-18 00:03:42.021799

LOW

Why flagged The package builds from a public git repository (plausibly the project's own) and installs only compiled binaries and static data; the low severity is due to few votes and recent upload, not malicious behavior.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from a public git repository (plausibly the project's own) and installs only compiled binaries and static data; the low severity is due to few votes and recent upload, not malicious behavior.

PKGBUILD

      1# Maintainer: Sean Behan <codebam@riseup.net>
    
      2#
    
      3# The shell drawn by WPE WebKit, inside the compositor process.
    
      4#
    
      5# The development version: this one follows `main` rather than a tag, so what
    
      6# it builds is whatever was pushed. `viewport-wpe` is the same recipe cut
    
      7# from the last release, and `viewport-wpe-bin` is that release already
    
      8# built — a system takes one of the three, and one engine.
    
      9#
    
      10# `pkgver()` reports the last tag, how many commits past it the checkout is,
    
      11# and which commit — `0.1.5.r12.gdeadbee` — so an installed snapshot sorts
    
      12# above the release it came after and says on sight what it is.
    
      13#
    
      14# This is the only variant that has an engine inside the compositor, and the
    
      15# only one whose engine has to exist as a package: wpewebkit is in the Arch
    
      16# repositories with the WPE platform API enabled, so wpe-platform-2.0.pc is
    
      17# there and no WebKit is compiled here.
    
      18
    
      19pkgname=viewport-wpe-git
    
      20pkgver=0.1.6.r3.g4f93524
    
      21pkgrel=1
    
      22pkgdesc='Wayland compositor whose entire shell is a web page — the Smithay rewrite (git)'
    
      23arch=('x86_64' 'aarch64')
    
      24url='https://github.com/codebam/viewport'
    
      25license=('GPL-3.0-or-later')
    
      26
    
      27depends=(
    
      28  'wayland'
    
      29  'libxkbcommon'
    
      30  'pixman'
    
      31  'libdrm'
    
      32  'libinput'
    
      33  'seatd'
    
      34  'systemd-libs'
    
      35  'mesa'
    
      36  'libglvnd'
    
      37  'vulkan-icd-loader'
    
      38  'wpewebkit'
    
      39  'glib2'
    
      40  'json-glib'
    
      41  'libxcb'
    
      42  'xcb-util-wm'
    
      43  'pipewire'
    
      44  # WebKit guesses the type of a file:// page from the shared MIME database,
    
      45  # because nothing else tells it. Without this every local page is treated as
    
      46  # an empty document: the load reports started, committed and finished, not
    
      47  # one script runs, and the desktop comes up with no bar and nothing laid out.
    
      48  # The bundled shell is loaded from file://, so this is a hard dependency —
    
      49  # and its absence looks like a compositor bug, not a missing package.
    
      50  'shared-mime-info'
    
      51)
    
      52
    
      53optdepends=(
    
      54  'xorg-xwayland: X11 clients'
    
      55  'xdg-desktop-portal-gtk: the portal interfaces the compositor does not answer itself'
    
      56  # Vulkan is the renderer wherever a Vulkan device owns the display; without
    
      57  # one the compositor draws with OpenGL instead, so these decide which of the
    
      58  # two a machine gets rather than whether it starts at all.
    
      59  'vulkan-radeon: AMD hardware'
    
      60  'vulkan-intel: Intel hardware'
    
      61  'nvidia-utils: NVIDIA hardware, and hardware video decode with it'
    
      62  # In a virtual machine: Venus passes Vulkan through to the host's GPU, and
    
      63  # needs the host to offer it — QEMU wants
    
      64  # `-device virtio-gpu-gl-pci,venus=on,blob=on,hostmem=2G`. Without it the
    
      65  # only device that loads is lavapipe, which owns no DRM node, cannot drive a
    
      66  # display, and turns every shell-frame copy into a copy on the CPU.
    
      67  'vulkan-virtio: a virtual machine with 3D acceleration'
    
      68  'vulkan-swrast: software Vulkan, for tests rather than a session'
    
      69  # The compositor imports the multi-planar YUV a hardware decoder produces
    
      70  # (NV12, P010 and the rest), so a player can hand over the decoder's own
    
      71  # buffer with nothing converted in between. That only happens if the player
    
      72  # can decode in hardware in the first place, which is what these provide.
    
      73  # Without one, video still plays — the player converts each frame itself,
    
      74  # which is the cost the import path exists to avoid.
    
      75  'libva-mesa-driver: hardware video decode on AMD and Intel, for zero-copy video'
    
      76  # The bar's icons are Material Design glyphs from a Nerd Font patch, and the
    
      77  # family names in data/shell/shell.css are the ones fontconfig reports:
    
      78  # "FiraCode Nerd Font" first, "Symbols Nerd Font" as the fallback that
    
      79  # carries the glyphs without the monospace face. With neither installed the
    
      80  # bar still lays out and every icon in it is a replacement box.
    
      81  'ttf-firacode-nerd: the icons in the bar, and the font the shell names first'
    
      82  'ttf-nerd-fonts-symbols: the icons in the bar, without the patched monospace family'
    
      83)
    
      84
    
      85makedepends=(
    
      86  # cargo comes with it: Arch has no separate cargo package, and naming
    
      87  # one fails dependency resolution before a line is compiled.
    
      88  'rust'
    
      89  'git'
    
      90  'pkgconf'
    
      91  'clang'
    
      92  'vulkan-headers'
    
      93  'wayland-protocols'
    
      94)
    
      95
    
      96provides=("viewport=$pkgver" "viewport-wpe=$pkgver")
    
      97conflicts=('viewport'
    
      98           'viewport-webkitgtk'
    
      99           'viewport-wpe'
    
      100           'viewport-chromium')
    
      101options=('!lto')
    
      102
    
      103source=("viewport::git+https://github.com/codebam/viewport.git")
    
      104sha256sums=('SKIP')
    
      105
    
      106# The version, read off the checkout rather than written here: the last tag,
    
      107# the distance from it, and the commit.
    
      108#
    
      109# makepkg runs this after fetching and rewrites the `pkgver=` above with what
    
      110# it returns, so the number in the recipe is whatever the last person to build
    
      111# it saw — one commit behind by construction, which is what every VCS package
    
      112# in the AUR carries. It is a marker, not a claim: what gets installed is
    
      113# always what `main` says at build time.
    
      114pkgver() {
    
      115  cd "$srcdir/viewport"
    
      116  git describe --long --tags --abbrev=7 \
    
      117    | sed 's/^v//;s/\([^-]*-g\)/r\1/;s/-/./g'
    
      118}
    
      119
    
      120prepare() {
    
      121  cd "$srcdir/viewport"
    
      122  # A git dependency (the smithay fork, for the tearing-control patch) has to
    
      123  # be fetched here rather than during build(), so that build() is the only
    
      124  # step that has to work offline.
    
      125  export RUSTUP_TOOLCHAIN=stable
    
      126  cargo fetch --locked --target "$(rustc -vV | sed -n 's/host: //p')"
    
      127}
    
      128
    
      129build() {
    
      130  cd "$srcdir/viewport"
    
      131  export RUSTUP_TOOLCHAIN=stable
    
      132  export CARGO_TARGET_DIR=target
    
      133  # --features wpe is not the default, and without it there is no shell at all:
    
      134  # grey where the wallpaper and the bar should be, and nothing in the log to
    
      135  # say why.
    
      136  cargo build --frozen --release -p viewport --features wpe
    
      137}
    
      138
    
      139package() {
    
      140  cd "$srcdir/viewport"
    
      141
    
      142  install -Dm755 target/release/viewport "$pkgdir/usr/bin/viewport"
    
      143
    
      144  # The shell itself, and the page it falls back to. Without them an installed
    
      145  # compositor has nothing to load: the default URL resolves beside the binary,
    
      146  # and a session started from a login shell has no source tree under it.
    
      147  install -dm755 "$pkgdir/usr/share/viewport"
    
      148  cp -r data/shell "$pkgdir/usr/share/viewport/shell"
    
      149  install -Dm644 data/fallback.html "$pkgdir/usr/share/viewport/fallback.html"
    
      150  install -Dm644 data/config.example.json \
    
      151    "$pkgdir/usr/share/viewport/config.example.json"
    
      152
    
      153  # How xdg-desktop-portal learns this backend exists. Without the file the
    
      154  # frontend does not know the name "viewport" refers to anything, so a config
    
      155  # naming it matches nothing and the request goes elsewhere.
    
      156  install -Dm644 data/portal-share/xdg-desktop-portal/portals/viewport.portal \
    
      157    "$pkgdir/usr/share/xdg-desktop-portal/portals/viewport.portal"
    
      158
    
      159  # The session target the compositor starts on launch. Without it
    
      160  # graphical-session.target stays inactive, and xdg-desktop-portal — which
    
      161  # holds Requisite=graphical-session.target — refuses to start at all, taking
    
      162  # the Settings interface and every application's dark theme with it.
    
      163  install -Dm644 data/systemd/user/viewport-session.target \
    
      164    "$pkgdir/usr/lib/systemd/user/viewport-session.target"
    
      165
    
      166  install -Dm644 docs/viewport.1 "$pkgdir/usr/share/man/man1/viewport.1"
    
      167
    
      168  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE" 2>/dev/null || true
    
      169
    
      170  install -Dm644 /dev/stdin "$pkgdir/usr/share/wayland-sessions/viewport.desktop" <<'EOF'
    
      171[Desktop Entry]
    
      172Name=Viewport
    
      173Comment=Wayland compositor with a WPE WebKit shell
    
      174Exec=viewport
    
      175Type=Application
    
      176EOF
    
      177}
    
      178

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	LOW	2
2026-08-17 00:18:29	LOW	2
2026-08-16 00:03:42	LOW	2
2026-08-15 23:31:34	LOW	2