voisu-bin

maintainer anuraj-dev · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads prebuilt binaries from a GitHub release by the maintainer; while the host is not whitelisted, GitHub is a common and generally trusted platform, and the binaries are for a legitimate open-source project with source available, reducing risk.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 80%): The package downloads prebuilt binaries from a GitHub release by the maintainer; while the host is not whitelisted, GitHub is a common and generally trusted platform, and the binaries are for a legitimate open-source project with source available, reducing risk.

PKGBUILD

      1# Maintainer: Anuraj Jit Saikia <rajasaikia1644@gmail.com>
    
      2#
    
      3# Hand-written in cargo-aur's style. cargo-aur was not run to generate this
    
      4# skeleton because (a) it targets single-binary crates and would need manual
    
      5# extension for Voisu's three binaries plus the two systemd user units, and
    
      6# (b) no GitHub Release / prebuilt tarball exists yet to point it at. When the
    
      7# release workflow (ticket 14) publishes a `cargo aur` tarball, this file's
    
      8# fields already match cargo-aur's output layout.
    
      9pkgname=voisu-bin
    
      10pkgver=0.10.1
    
      11pkgrel=1
    
      12pkgdesc="Cloud-first Linux dictation for Wayland (prebuilt binaries)"
    
      13arch=('x86_64')
    
      14url="https://github.com/Anuraj-Dev/voisu"
    
      15license=('MIT' 'Apache-2.0' 'ISC' 'BSD-3-Clause')
    
      16# Same runtime boundaries as the source package: pipewire-audio ships pw-record
    
      17# (the base `pipewire` package does not), wireplumber ships wpctl for the
    
      18# microphone readiness check, wl-clipboard/libsecret/curl are subprocesses,
    
      19# xdg-desktop-portal is a D-Bus service, and libxkbcommon is linked directly.
    
      20depends=('gtk4'
    
      21         'gtk4-layer-shell'
    
      22         'libxkbcommon'
    
      23         'pipewire'
    
      24         'pipewire-audio'
    
      25         'wireplumber'
    
      26         'wl-clipboard'
    
      27         'libsecret'
    
      28         'curl'
    
      29         'xdg-desktop-portal')
    
      30optdepends=('libei: direct Delivery of the Transcript into the focused window'
    
      31            'xdg-desktop-portal-kde: portal backend for KDE Plasma'
    
      32            'xdg-desktop-portal-hyprland: portal backend for Hyprland')
    
      33provides=("voisu=$pkgver")
    
      34conflicts=('voisu')
    
      35install="$pkgname.install"
    
      36# NOTE: the release asset does not exist until the first tagged release. The
    
      37# tarball 'SKIP' below MUST be replaced with the pinned sha256 (or b2sum, as
    
      38# cargo-aur emits) at the first real release, then regenerate .SRCINFO.
    
      39#
    
      40# RELEASE TARBALL CONTRACT (ticket 14). The archive must contain, at the top
    
      41# level:
    
      42#   voisu, voisu-daemon, voisu-overlay
    
      43#   voisu.service, voisu-overlay.service
    
      44#   voisu.desktop
    
      45#   LICENSE
    
      46#   ring/LICENSE
    
      47#   ring/LICENSE-BoringSSL
    
      48#   ring/LICENSE-other-bits
    
      49#   ring/src/polyfill/once_cell/LICENSE-APACHE
    
      50#   ring/src/polyfill/once_cell/LICENSE-MIT
    
      51#   ring/third_party/fiat/LICENSE
    
      52# ring's tree must keep those UPSTREAM names and paths so the cross-references
    
      53# inside ring's own LICENSE manifest resolve once installed.
    
      54source=("$pkgname-$pkgver.tar.gz::https://github.com/Anuraj-Dev/voisu/releases/download/v$pkgver/voisu-$pkgver-${CARCH}.tar.gz")
    
      55sha256sums=('d3fe417bdffa9be35dbcdfecfacadc27f6744fe6c8ec5b26befa529a8a5959bc')
    
      56
    
      57package() {
    
      58    install -Dm755 voisu "$pkgdir/usr/bin/voisu"
    
      59    install -Dm755 voisu-daemon "$pkgdir/usr/bin/voisu-daemon"
    
      60    install -Dm755 voisu-overlay "$pkgdir/usr/bin/voisu-overlay"
    
      61
    
      62    install -Dm644 voisu.service "$pkgdir/usr/lib/systemd/user/voisu.service"
    
      63    install -Dm644 voisu-overlay.service \
    
      64        "$pkgdir/usr/lib/systemd/user/voisu-overlay.service"
    
      65
    
      66    # Desktop entry makes a resolvable app_id (voisu) available to portal
    
      67    # backends that support it; the stable session token is the primary fix.
    
      68    install -Dm644 voisu.desktop "$pkgdir/usr/share/applications/voisu.desktop"
    
      69
    
      70    install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      71
    
      72    # Preserve ring's upstream license tree verbatim.
    
      73    local ringlic="$pkgdir/usr/share/licenses/$pkgname/ring"
    
      74    install -Dm644 ring/LICENSE              "$ringlic/LICENSE"
    
      75    install -Dm644 ring/LICENSE-BoringSSL    "$ringlic/LICENSE-BoringSSL"
    
      76    install -Dm644 ring/LICENSE-other-bits   "$ringlic/LICENSE-other-bits"
    
      77    install -Dm644 ring/src/polyfill/once_cell/LICENSE-APACHE \
    
      78        "$ringlic/src/polyfill/once_cell/LICENSE-APACHE"
    
      79    install -Dm644 ring/src/polyfill/once_cell/LICENSE-MIT \
    
      80        "$ringlic/src/polyfill/once_cell/LICENSE-MIT"
    
      81    install -Dm644 ring/third_party/fiat/LICENSE \
    
      82        "$ringlic/third_party/fiat/LICENSE"
    
      83}
    
      84

Changes since previous scan

--- PKGBUILD @ 2026-07-28 00:07
+++ PKGBUILD @ 2026-08-03 00:08
@@ -7,7 +7,7 @@
 # release workflow (ticket 14) publishes a `cargo aur` tarball, this file's
 # fields already match cargo-aur's output layout.
 pkgname=voisu-bin
-pkgver=0.7.0
+pkgver=0.10.1
 pkgrel=1
 pkgdesc="Cloud-first Linux dictation for Wayland (prebuilt binaries)"
 arch=('x86_64')
@@ -52,7 +52,7 @@
 # ring's tree must keep those UPSTREAM names and paths so the cross-references
 # inside ring's own LICENSE manifest resolve once installed.
 source=("$pkgname-$pkgver.tar.gz::https://github.com/Anuraj-Dev/voisu/releases/download/v$pkgver/voisu-$pkgver-${CARCH}.tar.gz")
-sha256sums=('e665bd6d51d5cf039d3608c52de0f80a64634b8d945461bf946b72b344d11860')
+sha256sums=('d3fe417bdffa9be35dbcdfecfacadc27f6744fe6c8ec5b26befa529a8a5959bc')
 
 package() {
     install -Dm755 voisu "$pkgdir/usr/bin/voisu"

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 15:39:03	LOW	2
2026-07-28 00:07:28	CLEAN	2
2026-07-27 21:35:42	LOW	1
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 15:24:42	LOW	2
2026-07-23 13:24:23	LOW	2
2026-07-23 00:14:47	CLEAN	2
2026-07-22 21:22:00	LOW	1
2026-07-22 17:21:24	LOW	1
2026-07-22 00:29:32	LOW	2
2026-07-21 13:17:02	LOW	2