concat, concat-bin, concat-git: new packages

Concat (https://github.com/jub0t/Concat) is a Tauri 2 shell around a Rust
video engine, sold as a CapCut replacement. The project is mid-rename: the
binary, the desktop entry, the icons and the .deb asset all still say
WolfCut, so the packages install upstream's paths unchanged and add a
/usr/bin/concat symlink.

Upstream stages a static ffmpeg/ffprobe pair (180 MB) and whisper-cli
inside its bundle so the app runs on a machine with nothing installed.
Both lookups fall back to PATH, so concat-bin drops those two directories
and the source packages set WOLFCUT_SYSTEM_TOOLS=1 - the switch upstream
put in build.rs for exactly this case - leaving ffmpeg and whisper-cpp to
Arch. That is 17 MB installed instead of 225 MB.

!lto is not optional: makepkg's lto puts -flto=auto into CFLAGS, and ring
compiles hand-written assembly through cc, which then comes out as bitcode
and links to nothing.

sherpa-onnx-sys ships no C++ build; its build script downloads a prebuilt
static-lib archive. concat lists that archive as a checksummed source and
points the build script at it, with the version read out of upstream's
Cargo.lock by pkg.sh. concat-git cannot pin it - the version moves with
main - so there the build script fetches it.

Every upstream release is a v<version>-alpha.<n> prerelease published on a
push to main, several a day, and the release list is ordered by creation
rather than by version, so the newest is picked by publication date.

Only concat-git is published for now; concat and concat-bin are held back
with AUR_PUBLISH=false until that cadence has been lived with.

README.md

@@ -43,6 +43,9 @@ source in the `PKGBUILD` (and drop the `-bin` suffix), or don't package it.
 | `cachy-auto-update` | [Felitendo/cachy-auto-update](https://github.com/Felitendo/cachy-auto-update) — unattended background updates for CachyOS (pacman, AUR, Flatpak, AppImages) | *built from source* | [cachy-auto-update](https://aur.archlinux.org/packages/cachy-auto-update) |
 | `chiaki-ng-bin` | [streetpea/chiaki-ng](https://github.com/streetpea/chiaki-ng) — PlayStation Remote Play client (Qt6) | AppImage | [chiaki-ng-bin](https://aur.archlinux.org/packages/chiaki-ng-bin) |
 | `chromium-widevine-helper` | [GloriousEggroll/chromium-widevine-helper](https://github.com/GloriousEggroll/chromium-widevine-helper) — extension + native helper installing Google's Widevine CDM into Chromium-based browser profiles | *no build step* | [chromium-widevine-helper](https://aur.archlinux.org/packages/chromium-widevine-helper) |
+| `concat` | [jub0t/Concat](https://github.com/jub0t/Concat) — free and open-source CapCut replacement (Tauri 2 shell around a Rust video engine) | *built from source* | *not published yet* |
+| `concat-bin` | [jub0t/Concat](https://github.com/jub0t/Concat) — prebuilt release of `concat` | `.deb` | *not published yet* |
+| `concat-git` | [jub0t/Concat](https://github.com/jub0t/Concat) — `main` branch of `concat` | *built from source* | [concat-git](https://aur.archlinux.org/packages/concat-git) |
 | `faugus-launcher-bin` | [Faugus/faugus-launcher](https://github.com/Faugus/faugus-launcher) — launcher for Windows games via UMU-Launcher | `.deb` (`all`) | [faugus-launcher-bin](https://aur.archlinux.org/packages/faugus-launcher-bin) |
 | `fluxer-bin` | [fluxer.app](https://fluxer.app) — Fluxer desktop client (Electron) | tarball | [fluxer-bin](https://aur.archlinux.org/packages/fluxer-bin) |
 | `lunar-client-bin` | [lunarclient.com](https://lunarclient.com) — Minecraft PvP modpack launcher | AppImage | [lunar-client-bin](https://aur.archlinux.org/packages/lunar-client-bin) |
@@ -97,6 +100,10 @@ Then create a directory named after the AUR package containing:
     too.
   - `BUILD_DEPS` — optional array of Arch packages to install before the CI
     test build; only needed by packages that build from source.
+  - `AUR_PUBLISH` — optional; set to `false` to keep a package out of the AUR
+    while it is still being prepared. Everything else still runs, so the
+    `PKGBUILD` is kept current and test-built; only the publishing waits.
+    Flip it to `true` to go live (`concat`, `concat-bin`).
 
   Other local source files in the directory (`.desktop` files, patches, …) are
   pushed to the AUR alongside `PKGBUILD` and `.SRCINFO`.

concat-bin/.SRCINFO

@@ -0,0 +1,34 @@
+pkgbase = concat-bin
+	pkgdesc = Free and open-source CapCut replacement, a Tauri video editor with a Rust engine (upstream binary)
+	pkgver = 0.2.0alpha.15
+	pkgrel = 1
+	url = https://github.com/jub0t/Concat
+	arch = x86_64
+	license = MPL-2.0
+	depends = webkit2gtk-4.1
+	depends = gtk3
+	depends = glib2
+	depends = libsoup3
+	depends = gdk-pixbuf2
+	depends = cairo
+	depends = dbus
+	depends = glib-networking
+	depends = alsa-lib
+	depends = ffmpeg
+	depends = gcc-libs
+	depends = glibc
+	depends = hicolor-icon-theme
+	optdepends = whisper-cpp: on-device auto-captions and transcription
+	optdepends = vulkan-icd-loader: Vulkan compositor backend
+	optdepends = libglvnd: OpenGL compositor backend
+	provides = concat
+	conflicts = concat
+	noextract = concat-bin-0.2.0alpha.15.deb
+	options = !strip
+	options = !debug
+	source = concat-bin-0.2.0alpha.15.deb::https://github.com/jub0t/Concat/releases/download/v0.2.0-alpha.15/WolfCut_0.2.0_amd64.deb
+	source = LICENSE-0.2.0alpha.15::https://raw.githubusercontent.com/jub0t/Concat/v0.2.0-alpha.15/LICENSE
+	sha256sums = 1faae2cd2203d3eaeb4b280e1f773e5dbe4be9eb31a485c4b9a9d3fd31e049e4
+	sha256sums = 66a3107d5ad6a058aab753eaac2047ccb2ed0e39465dd0fe5844da3e300d5172
+
+pkgname = concat-bin

concat-bin/PKGBUILD

@@ -0,0 +1,74 @@
+# Maintainer: Felitendo
+# This PKGBUILD is updated automatically:
+# https://github.com/Felitendo/PKGBUILDS
+
+pkgname=concat-bin
+pkgver=0.2.0alpha.15
+pkgrel=1
+pkgdesc="Free and open-source CapCut replacement, a Tauri video editor with a Rust engine (upstream binary)"
+arch=('x86_64')
+url="https://github.com/jub0t/Concat"
+license=('MPL-2.0')
+# What the binary links against, plus what it reaches for at run time:
+# glib-networking is the webview's TLS backend, and the ffmpeg pair is
+# spawned by every media operation - see the resources note in package().
+# The model downloads carry their own TLS (rustls), so openssl is not needed.
+depends=('webkit2gtk-4.1' 'gtk3' 'glib2' 'libsoup3' 'gdk-pixbuf2' 'cairo'
+         'dbus' 'glib-networking' 'alsa-lib' 'ffmpeg' 'gcc-libs' 'glibc'
+         'hicolor-icon-theme')
+# wgpu picks its backend at run time: Vulkan first, GL as the fallback. Both
+# loaders come from the driver stack every desktop already has, so neither is
+# a hard dependency of the editor.
+optdepends=('whisper-cpp: on-device auto-captions and transcription'
+            'vulkan-icd-loader: Vulkan compositor backend'
+            'libglvnd: OpenGL compositor backend')
+provides=('concat')
+conflicts=('concat')
+options=('!strip' '!debug')
+# Upstream has no stable release yet. The build workflow publishes a
+# v<version>-alpha.<n> prerelease for every green push to main, so /latest is
+# empty and the newest versioned release is picked by publication date; see
+# pkg.sh. The asset name carries tauri.conf.json's version rather than the
+# tag (every alpha of 0.2.0 ships WolfCut_0.2.0_amd64.deb), so it is resolved
+# through the GitHub API and synced here along with the checksums.
+#
+# pkgver drops the hyphens from the tag (v0.2.0-alpha.15 -> 0.2.0alpha.15).
+# pacman sorts that older than a later plain 0.2.0 (`vercmp 0.2.0alpha.15
+# 0.2.0` is -1, the trailing alphabetic segment loses), so the prereleases
+# upgrade to the eventual stable release on their own and no epoch is needed.
+_tag="v0.2.0-alpha.15"
+_asset="WolfCut_0.2.0_amd64.deb"
+source=("${pkgname}-${pkgver}.deb::https://github.com/jub0t/Concat/releases/download/${_tag}/${_asset}"
+        "LICENSE-${pkgver}::https://raw.githubusercontent.com/jub0t/Concat/${_tag}/LICENSE")
+noextract=("${pkgname}-${pkgver}.deb")
+sha256sums=('1faae2cd2203d3eaeb4b280e1f773e5dbe4be9eb31a485c4b9a9d3fd31e049e4' '66a3107d5ad6a058aab753eaac2047ccb2ed0e39465dd0fe5844da3e300d5172')
+
+package() {
+  # /usr/bin/wolfcut-desktop, the desktop entry, the icons and the staged
+  # resources in /usr/lib/WolfCut - the project is mid-rename, the binary and
+  # every path it installs still carry the old name.
+  bsdtar -xOf "$srcdir/${pkgname}-${pkgver}.deb" 'data.tar.*' \
+    | bsdtar -xpf - -C "$pkgdir" ./usr
+
+  # Upstream stages a static ffmpeg/ffprobe pair (180 MB) and whisper-cli
+  # inside the bundle so the app runs on a machine with nothing installed.
+  # Both lookups fall back to PATH when the staged copy is missing (desktop
+  # `use_bundled_ffmpeg`, `transcribe::find_binary`), so the packaged Arch
+  # copies are used instead of shipping a second ffmpeg. Named explicitly
+  # rather than dropping the whole resource directory: anything else upstream
+  # stages there is a resource the app needs, and a rename fails here loudly.
+  rm -r "$pkgdir/usr/lib/WolfCut/ffmpeg" "$pkgdir/usr/lib/WolfCut/whisper"
+  rmdir --ignore-fail-on-non-empty "$pkgdir/usr/lib/WolfCut" "$pkgdir/usr/lib"
+
+  # Tauri emits the entry with an empty Categories=, which keeps the editor
+  # out of the application menu. Same categories upstream's Nix build sets.
+  sed -i 's|^Categories=.*|Categories=AudioVideo;AudioVideoEditing;|' \
+    "$pkgdir/usr/share/applications/WolfCut.desktop"
+
+  # the AUR package is named after the project, the executable after what the
+  # project used to be called - keep it reachable under both
+  ln -s wolfcut-desktop "$pkgdir/usr/bin/concat"
+
+  install -Dm644 "$srcdir/LICENSE-${pkgver}" \
+    "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
+}

concat-bin/pkg.sh

@@ -0,0 +1,79 @@
+# concat-bin - Concat (https://github.com/jub0t/Concat), a free and
+# open-source CapCut replacement: a Tauri 2 shell around a Rust video engine.
+#
+# Upstream publishes a Linux .deb per release, so there is no build step
+# here: on a new version only pkgver, the asset name and the checksums are
+# refreshed and the PKGBUILD repackages the .deb.
+#
+# The project has no stable release yet. Its build workflow publishes a
+# "v<version>-alpha.<n>" prerelease for every green push to main, so /latest
+# is empty and every tag is a prerelease - the alphas are what there is to
+# package. They arrive several times a day, which is also how often this
+# package can move.
+#
+# The release list is not ordered by version: GitHub sorts it by creation
+# time, and upstream's alpha numbering has already run out of step with it
+# (v0.2.0-alpha.10 sits between alpha.2 and alpha.1). The newest release is
+# therefore picked by publication date rather than by list position.
+#
+# The asset name carries tauri.conf.json's version, not the tag - every alpha
+# of 0.2.0 ships WolfCut_0.2.0_amd64.deb - so it cannot be derived from
+# pkgver and is resolved through the API into the _asset variable.
+#
+# pkgver drops the hyphens from the tag (v0.2.0-alpha.15 -> 0.2.0alpha.15).
+# pacman sorts that older than a later plain 0.2.0 (`vercmp 0.2.0alpha.15
+# 0.2.0` is -1), so the prereleases upgrade to the eventual stable release on
+# their own and no epoch is needed.
+
+# Not on the AUR yet. concat-git goes up first; these two follow once the
+# alpha-per-push release cadence has been lived with for a while - upstream
+# publishes several a day, and each one is an AUR push (and, for concat, a
+# full Rust build in CI). Flip this to true to publish; until then the
+# PKGBUILD is still kept current and test-built here.
+AUR_PUBLISH=false
+
+UPSTREAM_REPO="jub0t/Concat"
+
+# newest published release whose tag looks like a version
+latest_tag() {
+  gh api "repos/$UPSTREAM_REPO/releases?per_page=100" \
+    --jq '[.[] | select(.draft | not) | select(.tag_name | test("^v[0-9]"))]
+          | sort_by(.published_at) | last | .tag_name'
+}
+
+tag_to_pkgver() {
+  sed 's/^v//; s/-//g'
+}
+
+latest_version() {
+  latest_tag | tag_to_pkgver
+}
+
+# refresh_checksums <version> <pkgbuild-path>
+refresh_checksums() {
+  local ver="$1" pkgbuild="$2"
+  local tag asset sha_deb sha_license
+
+  tag="$(latest_tag)"
+  if [[ "$(tag_to_pkgver <<< "$tag")" != "$ver" ]]; then
+    echo "newest versioned release is $tag, not the requested $ver - try again" >&2
+    return 1
+  fi
+
+  # e.g. WolfCut_0.2.0_amd64.deb - the version is tauri.conf.json's, not the tag's
+  asset="$(gh api "repos/$UPSTREAM_REPO/releases/tags/$tag" --jq '.assets[].name' \
+    | grep -E '_amd64\.deb$')"
+  [[ "$(wc -l <<< "$asset")" -eq 1 ]] || { echo "expected exactly one amd64 .deb, got: $asset" >&2; return 1; }
+
+  sha_deb="$(curl -sfL "https://github.com/$UPSTREAM_REPO/releases/download/$tag/$asset" \
+    | sha256sum | cut -d' ' -f1)"
+  # the .deb ships no copyright file, so the license comes from the tag
+  sha_license="$(curl -sfL "https://raw.githubusercontent.com/$UPSTREAM_REPO/$tag/LICENSE" \
+    | sha256sum | cut -d' ' -f1)"
+
+  sed -i \
+    -e "s|^_tag=.*|_tag=\"$tag\"|" \
+    -e "s|^_asset=.*|_asset=\"$asset\"|" \
+    -e "s|^sha256sums=.*|sha256sums=('$sha_deb' '$sha_license')|" \
+    "$pkgbuild"
+}

concat-git/.SRCINFO

@@ -0,0 +1,35 @@
+pkgbase = concat-git
+	pkgdesc = Free and open-source CapCut replacement, a Tauri video editor with a Rust engine (git)
+	pkgver = 0.2.0.alpha.16.r0.g8938ec3
+	pkgrel = 1
+	url = https://github.com/jub0t/Concat
+	arch = x86_64
+	license = MPL-2.0
+	makedepends = rust
+	makedepends = npm
+	makedepends = pkgconf
+	makedepends = git
+	depends = webkit2gtk-4.1
+	depends = gtk3
+	depends = glib2
+	depends = libsoup3
+	depends = gdk-pixbuf2
+	depends = cairo
+	depends = dbus
+	depends = glib-networking
+	depends = alsa-lib
+	depends = ffmpeg
+	depends = gcc-libs
+	depends = glibc
+	depends = hicolor-icon-theme
+	optdepends = whisper-cpp: on-device auto-captions and transcription
+	optdepends = vulkan-icd-loader: Vulkan compositor backend
+	optdepends = libglvnd: OpenGL compositor backend
+	provides = concat
+	conflicts = concat
+	options = !debug
+	options = !lto
+	source = concat-git::git+https://github.com/jub0t/Concat.git
+	sha256sums = SKIP
+
+pkgname = concat-git

concat-git/PKGBUILD

@@ -0,0 +1,114 @@
+# Maintainer: Felitendo
+# This PKGBUILD is updated automatically:
+# https://github.com/Felitendo/PKGBUILDS
+
+pkgname=concat-git
+pkgver=0.2.0.alpha.16.r0.g8938ec3
+pkgrel=1
+pkgdesc="Free and open-source CapCut replacement, a Tauri video editor with a Rust engine (git)"
+arch=('x86_64')
+url="https://github.com/jub0t/Concat"
+license=('MPL-2.0')
+# glib-networking is what gives the webview a TLS backend; alsa-lib is the
+# engine's cpal playback backend; every media operation spawns the ffmpeg
+# pair - see the WOLFCUT_SYSTEM_TOOLS note below. The model downloads carry
+# their own TLS (rustls), so nothing here links openssl.
+depends=('webkit2gtk-4.1' 'gtk3' 'glib2' 'libsoup3' 'gdk-pixbuf2' 'cairo'
+         'dbus' 'glib-networking' 'alsa-lib' 'ffmpeg' 'gcc-libs' 'glibc'
+         'hicolor-icon-theme')
+makedepends=('rust' 'npm' 'pkgconf' 'git')
+# wgpu picks its backend at run time: Vulkan first, GL as the fallback. Both
+# loaders come from the driver stack every desktop already has, so neither is
+# a hard dependency of the editor.
+optdepends=('whisper-cpp: on-device auto-captions and transcription'
+            'vulkan-icd-loader: Vulkan compositor backend'
+            'libglvnd: OpenGL compositor backend')
+provides=('concat')
+conflicts=('concat')
+# !debug: the release profile already sets strip = true, so there is nothing
+# left to split into a debug package.
+# !lto: makepkg's lto puts -flto=auto into CFLAGS, and ring - the crypto
+# behind the model downloads' TLS - compiles hand-written assembly through
+# cc, which comes out as bitcode and links to nothing. Rust's own LTO is set
+# in the release profile and is unaffected.
+options=('!debug' '!lto')
+source=("${pkgname}::git+https://github.com/jub0t/Concat.git")
+sha256sums=('SKIP')
+
+pkgver() {
+  cd "$pkgname"
+  git describe --long --abbrev=7 --tags --match 'v[0-9]*' \
+    | sed 's/^v//; s/\([^-]*-g\)/r\1/; s/-/./g'
+}
+
+prepare() {
+  cd "$pkgname/desktop"
+
+  # the frontend toolchain (vite, tsc, tailwind) and the crate registry
+  npm ci --cache "$srcdir/npm-cache"
+
+  export RUSTUP_TOOLCHAIN=stable
+  cd src-tauri
+  cargo fetch --locked --target "$(rustc -vV | sed -n 's/^host: //p')"
+}
+
+build() {
+  cd "$pkgname/desktop"
+
+  export RUSTUP_TOOLCHAIN=stable
+  export CARGO_TARGET_DIR=target
+
+  # build.rs refuses a release build without a staged ffmpeg/whisper-cli,
+  # because a bundle that ships without them is broken when launched from a
+  # desktop file with no PATH to fall back on. A distribution package is the
+  # documented exception: the lookups fall back to PATH, and ffmpeg and
+  # whisper-cpp are packaged for Arch already.
+  export WOLFCUT_SYSTEM_TOOLS=1
+
+  # vite build -> desktop/dist, which tauri-build embeds into the binary
+  npm run build
+
+  cd src-tauri
+  # sherpa-onnx-sys, the text-to-speech backend, ships no C++ build: its build
+  # script downloads a prebuilt static-lib archive from its own release page.
+  # concat pins that archive as a checksummed source; here the version moves
+  # with main, so the build script fetches it - build() needs the network.
+  cargo build --release --frozen
+}
+
+package() {
+  cd "$pkgname"
+
+  # same paths the upstream .deb installs: the project is mid-rename and its
+  # executable, desktop entry and icons all still carry the old name
+  install -Dm755 "desktop/src-tauri/target/release/wolfcut-desktop" \
+    "$pkgdir/usr/bin/wolfcut-desktop"
+
+  # the AUR package is named after the project, the executable after what the
+  # project used to be called - keep it reachable under both
+  ln -s wolfcut-desktop "$pkgdir/usr/bin/concat"
+
+  # tauri only writes a desktop entry when it bundles, and the one it puts in
+  # the .deb has an empty Categories=. This is that entry with the categories
+  # upstream's Nix build sets.
+  install -Dm644 /dev/stdin "$pkgdir/usr/share/applications/WolfCut.desktop" <<'EOF'
+[Desktop Entry]
+Type=Application
+Name=WolfCut
+Comment=Free and open source video editor
+Exec=wolfcut-desktop
+Icon=wolfcut-desktop
+Terminal=false
+Categories=AudioVideo;AudioVideoEditing;
+StartupWMClass=wolfcut-desktop
+EOF
+
+  install -Dm644 "desktop/src-tauri/icons/32x32.png" \
+    "$pkgdir/usr/share/icons/hicolor/32x32/apps/wolfcut-desktop.png"
+  install -Dm644 "desktop/src-tauri/icons/128x128.png" \
+    "$pkgdir/usr/share/icons/hicolor/128x128/apps/wolfcut-desktop.png"
+  install -Dm644 "desktop/src-tauri/icons/128x128@2x.png" \
+    "$pkgdir/usr/share/icons/hicolor/256x256@2/apps/wolfcut-desktop.png"
+
+  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
+}

concat-git/pkg.sh

@@ -0,0 +1,35 @@
+# concat-git - Concat (https://github.com/jub0t/Concat) built from the main
+# branch. Same build as concat, see that package for why the Tauri binary
+# needs nothing but a JS toolchain and cargo, and why WOLFCUT_SYSTEM_TOOLS=1
+# is the right switch for a distribution package.
+#
+# The one difference: concat pins the prebuilt sherpa-onnx static-lib archive
+# as a checksummed source, which it can because the version comes from a
+# tagged Cargo.lock. Here it moves with main, so sherpa-onnx-sys' build
+# script downloads it and build() needs the network.
+#
+# VCS packages are not version-tracked here on purpose. The AUR copy of a -git
+# PKGBUILD carries only a snapshot of pkgver; the real version comes from
+# pkgver() when the user builds it. Upstream publishes an alpha release for
+# every green push to main, several times a day, so following main here would
+# mean several AUR pushes a day that change nothing for anyone.
+# latest_version() therefore reports the pkgver that is already in the
+# PKGBUILD, which makes the update run a no-op: the package is rebuilt,
+# re-checked and pushed only when the packaging itself changes.
+#
+# When that happens, makepkg refreshes the pkgver snapshot in the PKGBUILD as
+# part of the test build, so the committed snapshot follows along by itself.
+
+# Installed in CI (pacman) before the makepkg test build.
+BUILD_DEPS=(rust npm git webkit2gtk-4.1 gtk3 libsoup3 alsa-lib)
+
+latest_version() {
+  grep -Po '^pkgver=\K.*' "$(dirname "${BASH_SOURCE[0]}")/PKGBUILD"
+}
+
+# refresh_checksums <version> <pkgbuild-path>
+# Unreachable: latest_version() never reports a version other than the current
+# one. The git source carries SKIP checksums, so there would be nothing to do.
+refresh_checksums() {
+  :
+}

concat/.SRCINFO

@@ -0,0 +1,35 @@
+pkgbase = concat
+	pkgdesc = Free and open-source CapCut replacement, a Tauri video editor with a Rust engine
+	pkgver = 0.2.0alpha.15
+	pkgrel = 1
+	url = https://github.com/jub0t/Concat
+	arch = x86_64
+	license = MPL-2.0
+	makedepends = rust
+	makedepends = npm
+	makedepends = pkgconf
+	depends = webkit2gtk-4.1
+	depends = gtk3
+	depends = glib2
+	depends = libsoup3
+	depends = gdk-pixbuf2
+	depends = cairo
+	depends = dbus
+	depends = glib-networking
+	depends = alsa-lib
+	depends = ffmpeg
+	depends = gcc-libs
+	depends = glibc
+	depends = hicolor-icon-theme
+	optdepends = whisper-cpp: on-device auto-captions and transcription
+	optdepends = vulkan-icd-loader: Vulkan compositor backend
+	optdepends = libglvnd: OpenGL compositor backend
+	noextract = sherpa-onnx-v1.13.6-linux-x64-static-lib.tar.bz2
+	options = !debug
+	options = !lto
+	source = concat-0.2.0alpha.15.tar.gz::https://github.com/jub0t/Concat/archive/refs/tags/v0.2.0-alpha.15.tar.gz
+	source = https://github.com/k2-fsa/sherpa-onnx/releases/download/v1.13.6/sherpa-onnx-v1.13.6-linux-x64-static-lib.tar.bz2
+	sha256sums = 2b77c892fdd10f1cc93842bd8f0c30504ef17c797ddf386bc100308d175c4c8c
+	sha256sums = fe4968c3cd2ad3dfd1ea925500e5542aef70dd7119847257ffde95d6260cd629
+
+pkgname = concat

concat/PKGBUILD

@@ -0,0 +1,121 @@
+# Maintainer: Felitendo
+# This PKGBUILD is updated automatically:
+# https://github.com/Felitendo/PKGBUILDS
+
+pkgname=concat
+pkgver=0.2.0alpha.15
+pkgrel=1
+pkgdesc="Free and open-source CapCut replacement, a Tauri video editor with a Rust engine"
+arch=('x86_64')
+url="https://github.com/jub0t/Concat"
+license=('MPL-2.0')
+# glib-networking is what gives the webview a TLS backend; alsa-lib is the
+# engine's cpal playback backend; every media operation spawns the ffmpeg
+# pair - see the WOLFCUT_SYSTEM_TOOLS note below. The model downloads carry
+# their own TLS (rustls), so nothing here links openssl.
+depends=('webkit2gtk-4.1' 'gtk3' 'glib2' 'libsoup3' 'gdk-pixbuf2' 'cairo'
+         'dbus' 'glib-networking' 'alsa-lib' 'ffmpeg' 'gcc-libs' 'glibc'
+         'hicolor-icon-theme')
+makedepends=('rust' 'npm' 'pkgconf')
+# wgpu picks its backend at run time: Vulkan first, GL as the fallback. Both
+# loaders come from the driver stack every desktop already has, so neither is
+# a hard dependency of the editor.
+optdepends=('whisper-cpp: on-device auto-captions and transcription'
+            'vulkan-icd-loader: Vulkan compositor backend'
+            'libglvnd: OpenGL compositor backend')
+# !debug: the release profile already sets strip = true, so there is nothing
+# left to split into a debug package.
+# !lto: makepkg's lto puts -flto=auto into CFLAGS, and ring - the crypto
+# behind the model downloads' TLS - compiles hand-written assembly through
+# cc, which comes out as bitcode and links to nothing. Rust's own LTO is set
+# in the release profile and is unaffected.
+options=('!debug' '!lto')
+# Upstream has no stable release yet: the build workflow publishes a
+# v<version>-alpha.<n> prerelease for every green push to main. Only the
+# versioned tags are packaged, and pkgver drops their hyphens
+# (v0.2.0-alpha.15 -> 0.2.0alpha.15), which pacman sorts older than a later
+# plain 0.2.0, so no epoch is needed. See pkg.sh.
+_tag="v0.2.0-alpha.15"
+# sherpa-onnx-sys (the text-to-speech backend) does not build its C++ side:
+# it downloads a prebuilt static-lib archive from its own release page unless
+# it is handed one. Handing it one keeps that binary under makepkg's
+# checksums instead of arriving unverified from a build script. The version
+# follows upstream's Cargo.lock and is synced by pkg.sh.
+_sherpa="1.13.6"
+source=("${pkgname}-${pkgver}.tar.gz::https://github.com/jub0t/Concat/archive/refs/tags/${_tag}.tar.gz"
+        "https://github.com/k2-fsa/sherpa-onnx/releases/download/v${_sherpa}/sherpa-onnx-v${_sherpa}-linux-x64-static-lib.tar.bz2")
+noextract=("sherpa-onnx-v${_sherpa}-linux-x64-static-lib.tar.bz2")
+sha256sums=('2b77c892fdd10f1cc93842bd8f0c30504ef17c797ddf386bc100308d175c4c8c' 'fe4968c3cd2ad3dfd1ea925500e5542aef70dd7119847257ffde95d6260cd629')
+
+_srcname="Concat-${_tag#v}"
+
+prepare() {
+  cd "$_srcname/desktop"
+
+  # the frontend toolchain (vite, tsc, tailwind) and the crate registry, both
+  # fetched here so build() runs without the network
+  npm ci --cache "$srcdir/npm-cache"
+
+  export RUSTUP_TOOLCHAIN=stable
+  cd src-tauri
+  cargo fetch --locked --target "$(rustc -vV | sed -n 's/^host: //p')"
+}
+
+build() {
+  cd "$_srcname/desktop"
+
+  export RUSTUP_TOOLCHAIN=stable
+  export CARGO_TARGET_DIR=target
+
+  # build.rs refuses a release build without a staged ffmpeg/whisper-cli,
+  # because a bundle that ships without them is broken when launched from a
+  # desktop file with no PATH to fall back on. A distribution package is the
+  # documented exception: the lookups fall back to PATH, and ffmpeg and
+  # whisper-cpp are packaged for Arch already.
+  export WOLFCUT_SYSTEM_TOOLS=1
+  # the checksummed archive from source[1], instead of a download in build()
+  export SHERPA_ONNX_ARCHIVE_DIR="$srcdir"
+
+  # vite build -> desktop/dist, which tauri-build embeds into the binary
+  npm run build
+
+  cd src-tauri
+  cargo build --release --frozen
+}
+
+package() {
+  cd "$_srcname"
+
+  # same paths the upstream .deb installs: the project is mid-rename and its
+  # executable, desktop entry and icons all still carry the old name
+  install -Dm755 "desktop/src-tauri/target/release/wolfcut-desktop" \
+    "$pkgdir/usr/bin/wolfcut-desktop"
+
+  # the AUR package is named after the project, the executable after what the
+  # project used to be called - keep it reachable under both
+  ln -s wolfcut-desktop "$pkgdir/usr/bin/concat"
+
+  # tauri only writes a desktop entry when it bundles, and the one it puts in
+  # the .deb has an empty Categories=. This is that entry with the categories
+  # upstream's Nix build sets.
+  install -Dm644 /dev/stdin "$pkgdir/usr/share/applications/WolfCut.desktop" <<'EOF'
+[Desktop Entry]
+Type=Application
+Name=WolfCut
+Comment=Free and open source video editor
+Exec=wolfcut-desktop
+Icon=wolfcut-desktop
+Terminal=false
+Categories=AudioVideo;AudioVideoEditing;
+StartupWMClass=wolfcut-desktop
+EOF
+
+  install -Dm644 "desktop/src-tauri/icons/32x32.png" \
+    "$pkgdir/usr/share/icons/hicolor/32x32/apps/wolfcut-desktop.png"
+  install -Dm644 "desktop/src-tauri/icons/128x128.png" \
+    "$pkgdir/usr/share/icons/hicolor/128x128/apps/wolfcut-desktop.png"
+  install -Dm644 "desktop/src-tauri/icons/128x128@2x.png" \
+    "$pkgdir/usr/share/icons/hicolor/256x256@2/apps/wolfcut-desktop.png"
+
+  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
+}

concat/pkg.sh

@@ -0,0 +1,90 @@
+# concat - Concat (https://github.com/jub0t/Concat), a free and open-source
+# CapCut replacement: a Tauri 2 shell around a Rust video engine.
+#
+# Source package: the PKGBUILD builds the Tauri binary from the release
+# tarball - the same executable upstream wraps into the .deb that concat-bin
+# repackages. Upstream's flake.nix is the reference for what that needs, and
+# this follows it: JS toolchain plus cargo, and WOLFCUT_SYSTEM_TOOLS=1 to opt
+# out of staging a private ffmpeg/whisper-cli into the bundle, because Arch
+# packages both and the app falls back to PATH.
+#
+# sherpa-onnx-sys, the text-to-speech backend, ships no C++ build: its build
+# script downloads a prebuilt static-lib archive from the sherpa-onnx release
+# page. The PKGBUILD lists that archive as a source and points the build
+# script at it (SHERPA_ONNX_ARCHIVE_DIR), so the binary is checksummed by
+# makepkg rather than fetched unverified mid-build. Its version has to follow
+# upstream's Cargo.lock, so refresh_checksums() reads it from the tarball and
+# syncs the _sherpa variable in the PKGBUILD.
+#
+# Release/version handling is identical to concat-bin: every upstream release
+# is a "v<version>-alpha.<n>" prerelease published on a push to main, the
+# release list is ordered by creation rather than by version (v0.2.0-alpha.10
+# sits between alpha.2 and alpha.1), so the newest is picked by publication
+# date, and pkgver drops the hyphens - see concat-bin/pkg.sh.
+
+# Not on the AUR yet. concat-git goes up first; these two follow once the
+# alpha-per-push release cadence has been lived with for a while - upstream
+# publishes several a day, and each one is an AUR push (and, for concat, a
+# full Rust build in CI). Flip this to true to publish; until then the
+# PKGBUILD is still kept current and test-built here.
+AUR_PUBLISH=false
+
+UPSTREAM_REPO="jub0t/Concat"
+
+# Installed in CI (pacman) before the makepkg test build.
+BUILD_DEPS=(rust npm webkit2gtk-4.1 gtk3 libsoup3 alsa-lib)
+
+latest_tag() {
+  gh api "repos/$UPSTREAM_REPO/releases?per_page=100" \
+    --jq '[.[] | select(.draft | not) | select(.tag_name | test("^v[0-9]"))]
+          | sort_by(.published_at) | last | .tag_name'
+}
+
+tag_to_pkgver() {
+  sed 's/^v//; s/-//g'
+}
+
+latest_version() {
+  latest_tag | tag_to_pkgver
+}
+
+# refresh_checksums <version> <pkgbuild-path>
+refresh_checksums() {
+  local ver="$1" pkgbuild="$2"
+  local tag tarball sherpa sha_src sha_sherpa
+
+  tag="$(latest_tag)"
+  if [[ "$(tag_to_pkgver <<< "$tag")" != "$ver" ]]; then
+    echo "newest versioned release is $tag, not the requested $ver - try again" >&2
+    return 1
+  fi
+
+  # kept on disk rather than streamed: the tarball is needed twice, once for
+  # its checksum and once for the Cargo.lock inside it
+  tarball="$(mktemp)"
+  if ! curl -sfL -o "$tarball" \
+       "https://github.com/$UPSTREAM_REPO/archive/refs/tags/$tag.tar.gz"; then
+    rm -f "$tarball"
+    echo "could not download the $tag source tarball" >&2
+    return 1
+  fi
+
+  sha_src="$(sha256sum "$tarball" | cut -d' ' -f1)"
+  sherpa="$(tar -xOzf "$tarball" --wildcards '*/desktop/src-tauri/Cargo.lock' \
+    | grep -A2 '^name = "sherpa-onnx-sys"' | sed -n 's/^version = "\(.*\)"/\1/p')"
+  rm -f "$tarball"
+
+  if [[ -z "$sherpa" ]]; then
+    echo "could not read the sherpa-onnx-sys version from $tag's Cargo.lock" >&2
+    return 1
+  fi
+
+  sha_sherpa="$(curl -sfL "https://github.com/k2-fsa/sherpa-onnx/releases/download/v$sherpa/sherpa-onnx-v$sherpa-linux-x64-static-lib.tar.bz2" \
+    | sha256sum | cut -d' ' -f1)"
+
+  sed -i \
+    -e "s|^_tag=.*|_tag=\"$tag\"|" \
+    -e "s|^_sherpa=.*|_sherpa=\"$sherpa\"|" \
+    -e "s|^sha256sums=.*|sha256sums=('$sha_src' '$sha_sherpa')|" \
+    "$pkgbuild"
+}