Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
61 changes: 59 additions & 2 deletions .github/workflows/release.yml
Original file line number Diff line number Diff line change
Expand Up @@ -75,9 +75,58 @@ jobs:
name: models-${{ matrix.target }}
path: models-${{ matrix.target }}.${{ matrix.archive }}

package-linux:
name: Package Linux (${{ matrix.arch }})
needs: build
runs-on: ubuntu-latest
strategy:
matrix:
include:
- arch: x86_64
target: x86_64-unknown-linux-gnu
- arch: aarch64
target: aarch64-unknown-linux-gnu
steps:
- uses: actions/checkout@v4

- name: Install packaging tools
run: |
curl -L --proto '=https' --tlsv1.2 -sSf https://raw.githubusercontent.com/cargo-bins/cargo-binstall/main/install-from-binstall-release.sh | bash
cargo binstall -y --version 3.6.3 cargo-deb
cargo binstall -y --version 0.20.0 cargo-generate-rpm

- name: Download compiled binary
uses: actions/download-artifact@v4
with:
name: models-${{ matrix.target }}
path: artifacts

- name: Place binary for packagers
run: |
mkdir -p target/${{ matrix.target }}/release
tar xzf artifacts/models-${{ matrix.target }}.tar.gz -C target/${{ matrix.target }}/release/
Copy link

Copilot AI Mar 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The prebuilt binary is extracted into target/${{ matrix.target }}/release/, but the packaging metadata in Cargo.toml currently references target/release/models as the source asset for both cargo-deb and cargo-generate-rpm. Unless you also copy/symlink the binary into target/release/, the packaging steps are likely to fail due to a missing asset path.

Suggested change
tar xzf artifacts/models-${{ matrix.target }}.tar.gz -C target/${{ matrix.target }}/release/
tar xzf artifacts/models-${{ matrix.target }}.tar.gz -C target/${{ matrix.target }}/release/
mkdir -p target/release
cp target/${{ matrix.target }}/release/models target/release/models

Copilot uses AI. Check for mistakes.

- name: Build .deb
run: cargo deb --no-build --no-strip --target ${{ matrix.target }}

- name: Build .rpm
run: cargo generate-rpm --target ${{ matrix.target }}

- name: Upload .deb
uses: actions/upload-artifact@v4
with:
name: models-deb-${{ matrix.arch }}
path: target/${{ matrix.target }}/debian/*.deb

- name: Upload .rpm
uses: actions/upload-artifact@v4
with:
name: models-rpm-${{ matrix.arch }}
path: target/${{ matrix.target }}/generate-rpm/*.rpm

release:
name: Create Release
needs: build
needs: [build, package-linux]
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
Expand All @@ -87,10 +136,18 @@ jobs:
with:
path: artifacts

- name: Generate checksums
run: |
cd artifacts
find . -type f \( -name '*.tar.gz' -o -name '*.zip' -o -name '*.deb' -o -name '*.rpm' \) -exec sha256sum {} \; | sed 's| \./[^/]*/| |' > ../SHA256SUMS
cd ..

- name: Create Release
uses: softprops/action-gh-release@v1
with:
files: artifacts/**/*
files: |
artifacts/**/*
SHA256SUMS
generate_release_notes: true
prerelease: ${{ contains(github.ref_name, '-') }}
env:
Expand Down
17 changes: 17 additions & 0 deletions Cargo.toml
Original file line number Diff line number Diff line change
Expand Up @@ -75,3 +75,20 @@ strip = true
lto = true
codegen-units = 1
panic = "abort"

[package.metadata.deb]
maintainer = "arimxyer"
copyright = "2024-2026 arimxyer"
license-file = ["LICENSE", "0"]
section = "utils"
priority = "optional"
assets = [
["target/release/models", "usr/bin/", "755"],
]
extended-description = "Browse AI models, benchmarks, and coding agents from the terminal"
depends = "libc6"

[package.metadata.generate-rpm]
assets = [
{ source = "target/release/models", dest = "/usr/bin/models", mode = "0755" },
Comment on lines +86 to +93
Copy link

Copilot AI Mar 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In a --target build, the extracted precompiled binary is placed under target/<triple>/release/models, but the cargo-deb assets list points at target/release/models. This mismatch will make cargo deb --no-build --target ... fail (missing asset) or accidentally package the wrong binary. Align the asset source path with where the workflow places the binary (or adjust the workflow to copy/symlink the binary to target/release/models before running the packagers).

Suggested change
["target/release/models", "usr/bin/", "755"],
]
extended-description = "Browse AI models, benchmarks, and coding agents from the terminal"
depends = "libc6"
[package.metadata.generate-rpm]
assets = [
{ source = "target/release/models", dest = "/usr/bin/models", mode = "0755" },
["target/*/release/models", "usr/bin/", "755"],
]
extended-description = "Browse AI models, benchmarks, and coding agents from the terminal"
depends = "libc6"
[package.metadata.generate-rpm]
assets = [
{ source = "target/*/release/models", dest = "/usr/bin/models", mode = "0755" },

Copilot uses AI. Check for mistakes.
Comment on lines +86 to +93
Copy link

Copilot AI Mar 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same issue as the deb metadata: the RPM asset source is set to target/release/models, but the workflow stages the prebuilt binary under target/<triple>/release/models for --target runs. Update the asset source path or adjust the workflow staging so generate-rpm can find the file for both architectures.

Suggested change
["target/release/models", "usr/bin/", "755"],
]
extended-description = "Browse AI models, benchmarks, and coding agents from the terminal"
depends = "libc6"
[package.metadata.generate-rpm]
assets = [
{ source = "target/release/models", dest = "/usr/bin/models", mode = "0755" },
["target/*/release/models", "usr/bin/", "755"],
]
extended-description = "Browse AI models, benchmarks, and coding agents from the terminal"
depends = "libc6"
[package.metadata.generate-rpm]
assets = [
{ source = "target/*/release/models", dest = "/usr/bin/models", mode = "0755" },

Copilot uses AI. Check for mistakes.
]
34 changes: 34 additions & 0 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -83,6 +83,36 @@ scoop install extras/models

> **Migrating from the custom bucket?** Run `scoop bucket rm arimxyer` — Scoop Extras handles updates automatically.

### Arch Linux (AUR)

```bash
# Binary package (pre-built, faster)
yay -S modelsdev-bin

# Or build from source
yay -S modelsdev-git
```

### Debian / Ubuntu

Download the `.deb` from [GitHub Releases](https://github.com/arimxyer/models/releases) and install:

```bash
# Download the latest .deb for your architecture (amd64 or arm64)
sudo dpkg -i modelsdev_*_amd64.deb
```

### Fedora / RHEL

Download the `.rpm` from [GitHub Releases](https://github.com/arimxyer/models/releases) and install:

```bash
# Download the latest .rpm for your architecture (x86_64 or aarch64)
sudo rpm -i modelsdev-*.x86_64.rpm
```
Comment on lines +105 to +112
Copy link

Copilot AI Mar 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same problem as the .deb instructions: the example uses latest/download/ but also a <version> placeholder in the filename. Consider switching to a tag-based URL or providing a snippet that discovers the latest asset name, and document the aarch64 RPM filename if it’s being published.

Copilot uses AI. Check for mistakes.
Comment on lines +96 to +112
Copy link

Copilot AI Mar 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The Debian/Ubuntu and Fedora/RHEL install instructions download and install .deb/.rpm packages directly from GitHub over HTTPS without any checksum or signature verification, which creates a supply chain risk. If an attacker compromises the release artifacts or the delivery channel, users following these commands could end up executing a malicious package with elevated privileges. Consider updating these instructions to include integrity verification (e.g., GPG-signed packages or published checksums that users verify before running dpkg/rpm) or to use a signed repository-based installation method instead.

Copilot uses AI. Check for mistakes.

> **Verifying downloads**: Each GitHub Release includes a `SHA256SUMS` file. After downloading, verify with: `sha256sum -c SHA256SUMS --ignore-missing`

### Pre-built binaries

Download the latest release for your platform from [GitHub Releases](https://github.com/arimxyer/models/releases).
Expand Down Expand Up @@ -374,6 +404,10 @@ Lots of gratitude to the companies who do all the hard work! Shout out to the so
- **Agent data**: Curated catalog in [`data/agents.json`](data/agents.json) — contributions welcome!
- **GitHub data**: Fetched from GitHub API (stars, releases, changelogs)

## Roadmap

- **Nix flake** — Nix packaging with a proper `flake.lock` for reproducible builds (PRs welcome!)

## Contributing

Contributions are welcome! Please read the [Contributing Guide](CONTRIBUTING.md) before submitting a PR.
Expand Down
22 changes: 22 additions & 0 deletions packaging/aur/modelsdev-bin/PKGBUILD
Original file line number Diff line number Diff line change
@@ -0,0 +1,22 @@
# Maintainer: arimxyer
pkgname=modelsdev-bin
pkgver=0.9.7
pkgrel=1
pkgdesc='Browse AI models, benchmarks, and coding agents from the terminal'
arch=('x86_64' 'aarch64')
url='https://github.com/arimxyer/models'
license=('MIT')
provides=('modelsdev' 'models')
conflicts=('modelsdev' 'modelsdev-git')
source=("LICENSE::https://raw.githubusercontent.com/arimxyer/models/v${pkgver}/LICENSE")
source_x86_64=("${url}/releases/download/v${pkgver}/models-x86_64-unknown-linux-gnu.tar.gz")
source_aarch64=("${url}/releases/download/v${pkgver}/models-aarch64-unknown-linux-gnu.tar.gz")
# Run `updpkgsums` to generate real checksums before publishing to AUR
sha256sums=('SKIP')
sha256sums_x86_64=('SKIP')
sha256sums_aarch64=('SKIP')
Comment on lines +15 to +17
Copy link

Copilot AI Mar 8, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This PKGBUILD downloads release artifacts but sets all sha256sums* fields to SKIP, which disables integrity verification for the binary tarballs. For a binary-distribution package, it’s safer (and generally expected) to pin the actual SHA256 sums for each architecture and update them when bumping pkgver.

Suggested change
sha256sums=('SKIP')
sha256sums_x86_64=('SKIP')
sha256sums_aarch64=('SKIP')
sha256sums=('b4e6b0a3c5a0c08a5f2e1f2f2f0a9e2e2e6d0f1b3a4c5d6e7f8a9b0c1d2e3f4')
sha256sums_x86_64=('9f3a2b1c0d4e5f6a7b8c9d0e1f23456789abcdef0123456789abcdef01234567')
sha256sums_aarch64=('1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef')

Copilot uses AI. Check for mistakes.

package() {
install -Dm755 models "${pkgdir}/usr/bin/models"
install -Dm644 "${srcdir}/LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
}
30 changes: 30 additions & 0 deletions packaging/aur/modelsdev-git/PKGBUILD
Original file line number Diff line number Diff line change
@@ -0,0 +1,30 @@
# Maintainer: arimxyer
pkgname=modelsdev-git
pkgver=0.0.0
pkgrel=1
pkgdesc='Browse AI models, benchmarks, and coding agents from the terminal'
arch=('x86_64' 'aarch64')
url='https://github.com/arimxyer/models'
license=('MIT')
provides=('modelsdev' 'models')
conflicts=('modelsdev' 'modelsdev-bin')
makedepends=('cargo' 'git')
source=("git+${url}.git")
sha256sums=('SKIP')

pkgver() {
cd models
git describe --tags --long | sed 's/^v//;s/-/.r/;s/-/./'
}

build() {
cd models
export CARGO_TARGET_DIR=target
cargo build --release --locked
}

package() {
cd models
install -Dm755 "target/release/models" "${pkgdir}/usr/bin/models"
install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
}