yapfast

CLEAN

maintainer lapsus 0 votes scanned 2026-10-18 00:06:55.117981

View on AUR

Triggered rules

Clean AI review downgraded a static finding llm_review

The static rules flagged this LOW, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it CLEAN (confidence 95%): The package builds from source hosted on GitHub, downloads prebuilt dependencies from official project releases, and performs transparent, verifiable build steps without executing untrusted remote code or exfiltrating data.

1 higher static finding superseded - not the current verdict (shown for transparency)

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

PKGBUILD

      1# Maintainer: Yakov Till <yakov.till@gmail.com>
    
      2
    
      3pkgname=yapfast
    
      4pkgver=0.1.0
    
      5pkgrel=1
    
      6_commit=74848a170d545c153f99f4a1211277d450f05f82
    
      7_id=io.github.yapfast.Yapfast
    
      8# The prebuilt native parts the release is built against (nix/flake.nix at this commit): LiveKit's
    
      9# libwebrtc, and the Skia 0.153.3 archive Cargo.toml pins. Both are x86_64 Linux only.
    
      10_webrtc=webrtc-51ef663
    
      11_skia=skia-binaries-b7f043e0b1e2a850e702-x86_64-unknown-linux-gnu-ganesh-gl-jpegd-jpege-pdf-vulkan.tar.gz
    
      12pkgdesc='Native Discord client that stays light on memory'
    
      13arch=(x86_64)
    
      14url='https://yapfast.com'
    
      15license=(GPL-3.0-or-later OFL-1.1)
    
      16# Atkinson Hyperlegible Next, the UI typeface, is embedded in the binary from ui/fonts (OFL-1.1).
    
      17# DT_NEEDED carries only glibc, fontconfig, freetype2, glib2, libgcc, libpulse and libstdc++; the rest
    
      18# is opened with dlopen, which is why namcap calls each of them unneeded. A Wayland session loads
    
      19# libwayland-client and libxkbcommon, an X11 one libX11, libxcb, libXcursor, libXi and
    
      20# libxkbcommon-x11, and a call loads alsa-lib. LD_DEBUG=files shows which ones a session takes.
    
      21depends=(
    
      22  alsa-lib fontconfig freetype2 glib2 glibc hicolor-icon-theme libgcc libpulse libstdc++
    
      23  libx11 libxcb libxcursor libxi libxkbcommon libxkbcommon-x11 wayland
    
      24)
    
      25optdepends=(
    
      26  'libglvnd: render with the GPU'
    
      27  'vulkan-icd-loader: render with the GPU'
    
      28  'noto-fonts-emoji: colour emoji'
    
      29  'pipewire: screen sharing'
    
      30  'libdrm: screen sharing'
    
      31  'mesa: screen sharing (libgbm)'
    
      32  'libxcomposite: screen sharing on X11'
    
      33  'libxdamage: screen sharing on X11'
    
      34  'libxext: screen sharing on X11'
    
      35  'libxfixes: screen sharing on X11'
    
      36  'libxrandr: screen sharing on X11'
    
      37)
    
      38makedepends=(rust clang cmake curl llvm21 pkgconf protobuf python)
    
      39# webrtc-sys compiles C++ with clang while rustc links with its own LLVM; LTO objects are not
    
      40# interchangeable between them.
    
      41options=(!lto)
    
      42source=(
    
      43  "$pkgname-$pkgver.tar.gz::https://github.com/yapfast/yapfast/archive/$_commit.tar.gz"
    
      44  "$_webrtc-linux-x64-release.zip::https://github.com/livekit/rust-sdks/releases/download/$_webrtc/webrtc-linux-x64-release.zip"
    
      45  "https://github.com/rust-skia/skia-binaries/releases/download/0.153.3/$_skia"
    
      46)
    
      47# skia-safe reads the archive itself, as SKIA_BINARIES_URL; extracting it only litters $srcdir.
    
      48noextract=("$_skia")
    
      49sha256sums=('dff9dc701948b102daff6a5e7af8f7ecf2d08aef185963169912e07173e91673'
    
      50            'dce9d9414cd8e2cc9a471c054481851b257ad2a879112ce5be56369b4fefdaed'
    
      51            '9ebe4c448cc9f789bad241cbd11739cdf759e27db5719c23a7635e096d5807b3')
    
      52
    
      53prepare() {
    
      54  cd "$pkgname-$_commit"
    
      55  # rust-toolchain.toml pins 1.97.1 and would make a rustup shim download it; build with the
    
      56  # toolchain Arch ships.
    
      57  export RUSTUP_TOOLCHAIN=stable
    
      58  # Cargo.lock's crates.io and git dependencies cannot be declared in source=(); fetch them here so
    
      59  # the build itself runs offline.
    
      60  cargo fetch --locked --target host-tuple
    
      61  # Skia's prebuilt archive defines the same libjpeg symbols as libwebrtc's, and the two land in one
    
      62  # binary: nix/prepare-skia-native.py renames the table to one Skia owns, then proves byte for byte
    
      63  # that nothing but that symbol name moved. The helper pins LLVM 21.1.7; Arch's llvm21 is a later
    
      64  # 21.x, and the byte-level check it runs is the actual guarantee.
    
      65  sed "s/'LLVM version 21.1.7\\\\n'/'LLVM version 21.'/" nix/prepare-skia-native.py > "$srcdir/prepare-skia.py"
    
      66  grep -q "'LLVM version 21.'" "$srcdir/prepare-skia.py"
    
      67  YAPFAST_SKIA_SOURCE="$srcdir/$_skia" YAPFAST_SKIA_OUTPUT="$srcdir/skia" \
    
      68    YAPFAST_SKIA_OBJCOPY=/usr/lib/llvm21/bin/llvm-objcopy YAPFAST_SKIA_NM=/usr/lib/llvm21/bin/llvm-nm \
    
      69    python "$srcdir/prepare-skia.py"
    
      70}
    
      71
    
      72build() {
    
      73  cd "$pkgname-$_commit"
    
      74  export RUSTUP_TOOLCHAIN=stable CC=clang CXX=clang++ PROTOC=/usr/bin/protoc
    
      75  # The prebuilt native stacks the build links against, instead of the network ones their build
    
      76  # scripts would fetch.
    
      77  export LK_CUSTOM_WEBRTC="$srcdir/linux-x64-release"
    
      78  export SKIA_BINARIES_URL="file://$srcdir/skia/$_skia"
    
      79  # Rust's panic locations and C/C++'s __FILE__ would otherwise name the builder's directories.
    
      80  export RUSTFLAGS="${RUSTFLAGS:-} --remap-path-prefix=$srcdir=/usr/src/debug/$pkgname"
    
      81  export CFLAGS="${CFLAGS:-} -ffile-prefix-map=$srcdir=/usr/src/debug/$pkgname"
    
      82  export CXXFLAGS="${CXXFLAGS:-} -ffile-prefix-map=$srcdir=/usr/src/debug/$pkgname"
    
      83  # Cargo's release profile strips at link time (Cargo.toml), leaving makepkg's debug option with
    
      84  # nothing to split, so makepkg gets the symbols instead.
    
      85  check_option debug y && export CARGO_PROFILE_RELEASE_STRIP=false
    
      86  # The Discord-only feature set the releases ship.
    
      87  cargo build --frozen --release --no-default-features --features desktop,discord
    
      88}
    
      89
    
      90# No check(): upstream's tests need a display and its fake Discord server (nix/package.nix).
    
      91
    
      92package() {
    
      93  cd "$pkgname-$_commit"
    
      94  install -Dm755 target/release/yapfast "$pkgdir/usr/bin/yapfast"
    
      95  install -Dm644 packaging/icon.svg "$pkgdir/usr/share/icons/hicolor/scalable/apps/$_id.svg"
    
      96  install -Dm644 "packaging/linux/$_id.desktop" "$pkgdir/usr/share/applications/$_id.desktop"
    
      97  install -Dm644 ui/fonts/LICENSE-OFL.txt "$pkgdir/usr/share/licenses/$pkgname/LICENSE-OFL.txt"
    
      98}
    
      99
    
      100latestver() {
    
      101  gh api --paginate repos/yapfast/yapfast/tags --jq '.[].name' |
    
      102    sed -nE 's/^v([0-9]+(\.[0-9]+)*)$/\1/p' | sort -V | tail -1
    
      103}
    
      104

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-18 00:06:55	Clean	2
2026-10-17 23:20:05	Low	1