voisu

maintainer anuraj-dev · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from a legitimate source on GitHub with a pinned checksum, but the maintainer is new and the package has few votes, which is typical for new but legitimate AUR packages; no malicious behavior or unverifiable remote code execution is present.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from a legitimate source on GitHub with a pinned checksum, but the maintainer is new and the package has few votes, which is typical for new but legitimate AUR packages; no malicious behavior or unverifiable remote code execution is present.

PKGBUILD

      1# Maintainer: Anuraj Jit Saikia <rajasaikia1644@gmail.com>
    
      2pkgname=voisu
    
      3pkgver=0.10.1
    
      4pkgrel=1
    
      5pkgdesc="Cloud-first Linux dictation for Wayland (daemon, CLI, and optional Overlay)"
    
      6arch=('x86_64')
    
      7url="https://github.com/Anuraj-Dev/voisu"
    
      8# Voisu itself is MIT. The voisu, voisu-daemon and voisu-overlay binaries
    
      9# statically link the ring crate, which adds ISC (new ring code), Apache-2.0
    
      10# and BSD-3-Clause (BoringSSL-derived code) and MIT (once_cell polyfill).
    
      11# ring's full upstream license tree is installed under licenses/voisu/ring/.
    
      12license=('MIT' 'Apache-2.0' 'ISC' 'BSD-3-Clause')
    
      13# Runtime boundaries that are NOT visible to namcap's ELF scan because Voisu
    
      14# reaches them as subprocesses, a D-Bus service, or via dlopen:
    
      15#   pipewire-audio -> pw-record (audio capture; the base `pipewire` package
    
      16#                     does NOT ship pw-record)
    
      17#   wireplumber    -> wpctl, the microphone readiness check in system.rs
    
      18#   wl-clipboard   -> wl-copy / wl-paste (clipboard Delivery fallback)
    
      19#   libsecret      -> secret-tool (provider key storage)
    
      20#   curl           -> provider HTTPS/WSS transport
    
      21#   xdg-desktop-portal -> Trigger Key binding and direct Delivery portals
    
      22# libxkbcommon is a genuine runtime dep: the xkbcommon crate declares
    
      23# #[link(name = "xkbcommon")] and system.rs uses it on the Delivery path.
    
      24depends=('gtk4'
    
      25         'gtk4-layer-shell'
    
      26         'libxkbcommon'
    
      27         'pipewire'
    
      28         'pipewire-audio'
    
      29         'wireplumber'
    
      30         'wl-clipboard'
    
      31         'libsecret'
    
      32         'curl'
    
      33         'xdg-desktop-portal')
    
      34makedepends=('cargo')
    
      35# The workspace tests shell out to python3 (process.rs, system.rs) and spawn a
    
      36# private dbus-daemon (tests/delivery.rs, tests/daemon_cli_lifecycle.rs).
    
      37checkdepends=('python' 'dbus')
    
      38optdepends=('libei: direct Delivery of the Transcript into the focused window'
    
      39            'xdg-desktop-portal-kde: portal backend for KDE Plasma'
    
      40            'xdg-desktop-portal-hyprland: portal backend for Hyprland')
    
      41# ring bundles C crypto objects; makepkg's default LTO drops ring_core_* symbols
    
      42# at link time ("undefined symbol: ring_core_0_17_14__*"). Disabling makepkg LTO
    
      43# only affects the intermediate C/C++ objects, not Rust's own release codegen.
    
      44options=('!lto')
    
      45install="$pkgname.install"
    
      46# NOTE: the release tarball checksum is SKIP only because no v0.1.0 tag exists
    
      47# yet (the first tagged release ships with the release workflow). At the first
    
      48# real release, replace the tarball 'SKIP' below with the pinned sha256 via
    
      49# `updpkgsums` and regenerate .SRCINFO.
    
      50#
    
      51# The LICENSE.ring-* sidecars are verbatim copies of ring 0.17.14's license
    
      52# tree; they are installed under their UPSTREAM names and paths so that the
    
      53# cross-references inside ring's own LICENSE manifest resolve.
    
      54source=("$pkgname-$pkgver.tar.gz::https://github.com/Anuraj-Dev/voisu/archive/refs/tags/v$pkgver.tar.gz"
    
      55        'LICENSE.ring'
    
      56        'LICENSE.ring-BoringSSL'
    
      57        'LICENSE.ring-other-bits'
    
      58        'LICENSE.ring-once_cell-APACHE'
    
      59        'LICENSE.ring-once_cell-MIT'
    
      60        'LICENSE.ring-fiat')
    
      61sha256sums=('d65c2717c1beb2bfd2dea57852b0ff6b0dbc0ad781578886507908b7e4073675'
    
      62            'b3d734001a94efff3579978d953391aa7115f877657d25eb54037a43875d078a'
    
      63            '005fc765ddc5115da796cca915baa9557abae13ff35e0a47c47affc56f6c414d'
    
      64            'f025ccfb7dfb6bdfedc75ca0f67acc69e6fb4998143d834f7c2f38a29989680f'
    
      65            'a60eea817514531668d7e00765731449fe14d059d3249e0bc93b36de45f759f2'
    
      66            '6ee2ed6c77710de911761acd5fc1ad1da00f476beb1a7ef27e78c2d1858deafc'
    
      67            '9eacbcb81be660840c714a560a9d65ba07913db98dd4baf969f78dd499fdd60f')
    
      68
    
      69prepare() {
    
      70    cd "$pkgname-$pkgver"
    
      71    export RUSTUP_TOOLCHAIN=stable
    
      72    # Fetch exactly the Cargo.lock-pinned dependencies (whole graph, including
    
      73    # the feature-gated Overlay deps) so build()/check() run fully offline.
    
      74    cargo fetch --locked --target "$CARCH-unknown-linux-gnu"
    
      75}
    
      76
    
      77build() {
    
      78    cd "$pkgname-$pkgver"
    
      79    export RUSTUP_TOOLCHAIN=stable
    
      80    export CARGO_TARGET_DIR=target
    
      81    # Base build is GTK-free: produces voisu and voisu-daemon.
    
      82    cargo build --frozen --release --workspace
    
      83    # The Overlay is feature-gated behind voisu-app/overlay.
    
      84    cargo build --frozen --release -p voisu-app --features overlay --bin voisu-overlay
    
      85}
    
      86
    
      87check() {
    
      88    cd "$pkgname-$pkgver"
    
      89    export RUSTUP_TOOLCHAIN=stable
    
      90    export CARGO_TARGET_DIR=target
    
      91    cargo test --frozen --release --workspace
    
      92}
    
      93
    
      94package() {
    
      95    cd "$pkgname-$pkgver"
    
      96
    
      97    install -Dm755 target/release/voisu "$pkgdir/usr/bin/voisu"
    
      98    install -Dm755 target/release/voisu-daemon "$pkgdir/usr/bin/voisu-daemon"
    
      99    install -Dm755 target/release/voisu-overlay "$pkgdir/usr/bin/voisu-overlay"
    
      100
    
      101    # systemd *user* units (Voisu never runs privileged system services).
    
      102    install -Dm644 packaging/voisu.service \
    
      103        "$pkgdir/usr/lib/systemd/user/voisu.service"
    
      104    install -Dm644 packaging/voisu-overlay.service \
    
      105        "$pkgdir/usr/lib/systemd/user/voisu-overlay.service"
    
      106
    
      107    # Desktop entry makes a resolvable app_id (voisu) available to portal
    
      108    # backends that support it; the stable session token is the primary fix.
    
      109    install -Dm644 packaging/voisu.desktop \
    
      110        "$pkgdir/usr/share/applications/voisu.desktop"
    
      111
    
      112    install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      113
    
      114    # ring's license tree, kept at its upstream names/paths so the
    
      115    # cross-references inside ring's LICENSE manifest actually resolve.
    
      116    local ringlic="$pkgdir/usr/share/licenses/$pkgname/ring"
    
      117    install -Dm644 "$srcdir/LICENSE.ring"            "$ringlic/LICENSE"
    
      118    install -Dm644 "$srcdir/LICENSE.ring-BoringSSL"  "$ringlic/LICENSE-BoringSSL"
    
      119    install -Dm644 "$srcdir/LICENSE.ring-other-bits" "$ringlic/LICENSE-other-bits"
    
      120    install -Dm644 "$srcdir/LICENSE.ring-once_cell-APACHE" \
    
      121        "$ringlic/src/polyfill/once_cell/LICENSE-APACHE"
    
      122    install -Dm644 "$srcdir/LICENSE.ring-once_cell-MIT" \
    
      123        "$ringlic/src/polyfill/once_cell/LICENSE-MIT"
    
      124    install -Dm644 "$srcdir/LICENSE.ring-fiat" \
    
      125        "$ringlic/third_party/fiat/LICENSE"
    
      126
    
      127    install -Dm644 README.md "$pkgdir/usr/share/doc/$pkgname/README.md"
    
      128}
    
      129

Changes since previous scan

--- PKGBUILD @ 2026-07-28 00:07
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,6 +1,6 @@
 # Maintainer: Anuraj Jit Saikia <rajasaikia1644@gmail.com>
 pkgname=voisu
-pkgver=0.7.0
+pkgver=0.10.1
 pkgrel=1
 pkgdesc="Cloud-first Linux dictation for Wayland (daemon, CLI, and optional Overlay)"
 arch=('x86_64')
@@ -58,7 +58,7 @@
         'LICENSE.ring-once_cell-APACHE'
         'LICENSE.ring-once_cell-MIT'
         'LICENSE.ring-fiat')
-sha256sums=('f64db026e6815c8d66e5eee383f1b43175a3af0714477956340f10726c1206f1'
+sha256sums=('d65c2717c1beb2bfd2dea57852b0ff6b0dbc0ad781578886507908b7e4073675'
             'b3d734001a94efff3579978d953391aa7115f877657d25eb54037a43875d078a'
             '005fc765ddc5115da796cca915baa9557abae13ff35e0a47c47affc56f6c414d'
             'f025ccfb7dfb6bdfedc75ca0f67acc69e6fb4998143d834f7c2f38a29989680f'

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 15:39:03	LOW	2
2026-07-28 00:07:28	CLEAN	2
2026-07-27 21:35:42	LOW	1
2026-07-24 00:02:28	CLEAN	2
2026-07-23 15:24:42	LOW	1
2026-07-23 13:24:23	LOW	1
2026-07-23 00:14:47	CLEAN	2
2026-07-22 21:22:00	LOW	1
2026-07-22 17:21:24	LOW	1
2026-07-22 00:29:32	LOW	2
2026-07-21 13:17:02	LOW	2
2026-07-21 09:16:42	LOW	2