advantagescope-git

maintainer manganeese · 0 votes · scanned 2026-08-18 00:03:42.021799

LOW

Why flagged The npx command runs electron-builder to build the project from its own source; this is a standard part of the build process for Electron apps and does not execute untrusted remote code.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The npx command runs electron-builder to build the project from its own source; this is a standard part of the build process for Electron apps and does not execute untrusted remote code.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:66 npx electron-builder build --linux --"${!CARCH}" --dir $dist \

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: manganeese <mangoiscute95@gmail.com>
    
      2# Contributor: Noah Heller <softwareenginer@pm.me>
    
      3_emsdk=4.0.12
    
      4pkgname=advantagescope-git
    
      5pkgver=27.0.0.ralpha.5.9.g058f8f6e
    
      6pkgrel=1
    
      7epoch=
    
      8pkgdesc="robot diagnostics, log review/analysis, and data visualization application tool"
    
      9arch=(x86_64)
    
      10url="https://github.com/Mechanical-Advantage/AdvantageScope"
    
      11license=("LicenseRef-BSD-3.0-Clause-Noninfringement")
    
      12groups=()
    
      13_electron=electron39
    
      14depends=("$_electron" at-spi2-core bash glibc gtk3 hicolor-icon-theme libgcc libnotify libsecret libstdc++ libxss libxtst nss python3 xdg-utils)
    
      15makedepends=(emscripten git npm)
    
      16checkdepends=()
    
      17optdepends=()
    
      18provides=()
    
      19conflicts=(advantagescope)
    
      20replaces=()
    
      21backup=()
    
      22options=()
    
      23install=
    
      24changelog=
    
      25source=("git+$url.git"
    
      26        "advantagescope-git.desktop"
    
      27        "remove-version.patch")
    
      28noextract=()
    
      29b2sums=('SKIP'
    
      30        '9a501c0358f06bdea2802fa6e783cec578171fc854c030e2bd6be53640d91948a6e32feec6a098ffdbca269f31da1102d4383bc47f5fe23446e90d211a23ac14'
    
      31        '49e71a8305de082ed17af8ff82468e720325330ec778e81a915c0cd2cd0a01a011d2c2eb0ab6e307487d9abf569082628762a3fe5436055aa468f8728052d1ae')
    
      32validpgpkeys=()
    
      33
    
      34prepare() {
    
      35  _ver="$(</usr/lib/${_electron}/version)"
    
      36  cd AdvantageScope
    
      37  npm pkg set homepage="https://github.com/Mechanical-Advantage/AdvantageScope"
    
      38  npm pkg set version="${pkgver/.r/+r}"
    
      39  # apply all patches
    
      40  local src
    
      41  for src in "${source[@]}"; do
    
      42    src="${src%%::*}"
    
      43    src="${src##*/}"
    
      44    [[ $src = *.patch ]] || continue
    
      45    echo "Apply patch $src..."
    
      46    patch -Np1 < "../$src"
    
      47  done
    
      48  # allow git sources (they are depended on)
    
      49  # need to do a scriptless fetch before a normal one to make `youtube-dl-exec` work
    
      50  NPM_CONFIG_ALLOW_GIT=all npm ci --ignore-scripts
    
      51  NPM_CONFIG_ALLOW_GIT=all npm install
    
      52}
    
      53
    
      54pkgver() {
    
      55  cd "AdvantageScope"
    
      56  printf "%s" "$(git describe --tags | cut -c2- | sed 's+-+.r+' | tr - .)"
    
      57}
    
      58
    
      59build() {
    
      60  cd AdvantageScope
    
      61  local x86_64=x64
    
      62  npm run compile
    
      63  npm run wasm:compile
    
      64  npm run docs:build-embed
    
      65  export NODE_OPTIONS="--max-old-space-size=4096"
    
      66  npx electron-builder build --linux --"${!CARCH}" --dir $dist \
    
      67    -c.electronDist=/usr/lib/"$_electron" \
    
      68    -c.electronVersion="$_ver"
    
      69}
    
      70
    
      71package() {
    
      72  local x86_64=linux-unpacked
    
      73  install -Dm644 -t "${pkgdir}/usr/share/applications" "${pkgname}.desktop"
    
      74  install -Dm755 /dev/stdin "${pkgdir}/usr/bin/${pkgname}" <<EOF
    
      75#! /usr/bin/sh
    
      76exec $_electron "/usr/lib/${pkgname}/app.asar" "\$@"
    
      77EOF
    
      78  cd AdvantageScope
    
      79  install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/$pkgname/LICENSE"
    
      80  install -d "${pkgdir}/usr/lib/${pkgname}/"
    
      81  cp -r dist/${!CARCH}/resources/* "${pkgdir}/usr/lib/${pkgname}"
    
      82  cd icons/app/app-icons-linux
    
      83  for i in *x*.png; do
    
      84    local dir=${i%.png}
    
      85    dir=${dir#icon_}
    
      86    install -Dm6444 "$i" "${pkgdir}/usr/share/icons/hicolor/${dir}/apps/advantagescope.png"
    
      87  done
    
      88}
    
      89
    
      90# vim:set ts=2 sw=2 et:
    
      91

Changes since previous scan

--- PKGBUILD @ 2026-06-19 22:34
+++ PKGBUILD @ 2026-08-18 00:03
@@ -2,16 +2,17 @@
 # Contributor: Noah Heller <softwareenginer@pm.me>
 _emsdk=4.0.12
 pkgname=advantagescope-git
-pkgver=26.0.2.r66.g93cbdb70
+pkgver=27.0.0.ralpha.5.9.g058f8f6e
 pkgrel=1
 epoch=
 pkgdesc="robot diagnostics, log review/analysis, and data visualization application tool"
 arch=(x86_64)
-url="https://github.com/Mechanical-Advantage/AdvantageScope.git"
+url="https://github.com/Mechanical-Advantage/AdvantageScope"
 license=("LicenseRef-BSD-3.0-Clause-Noninfringement")
 groups=()
-depends=(nspr libxdamage dbus nss libxcb libxext glib2 libxrandr mesa libxfixes alsa-lib alsa-lib glibc gcc-libs libcups libxkbcommon cairo at-spi2-core pango expat libx11 gtk3 libdrm libxcomposite hicolor-icon-theme)
-makedepends=(jq curl git npm tar python libcrypt.so=1)
+_electron=electron39
+depends=("$_electron" at-spi2-core bash glibc gtk3 hicolor-icon-theme libgcc libnotify libsecret libstdc++ libxss libxtst nss python3 xdg-utils)
+makedepends=(emscripten git npm)
 checkdepends=()
 optdepends=()
 provides=()
@@ -21,38 +22,70 @@
 options=()
 install=
 changelog=
-source=("git+$url" "emsdk-$pkgver.tar.gz::https://github.com/emscripten-core/emsdk/archive/refs/tags/$_emsdk.tar.gz")
+source=("git+$url.git"
+        "advantagescope-git.desktop"
+        "remove-version.patch")
 noextract=()
-sha256sums=('SKIP' 'd972bf0909718f155aeb5627429230471c94b2a8a3047ee696e2690ec73961cb')
+b2sums=('SKIP'
+        '9a501c0358f06bdea2802fa6e783cec578171fc854c030e2bd6be53640d91948a6e32feec6a098ffdbca269f31da1102d4383bc47f5fe23446e90d211a23ac14'
+        '49e71a8305de082ed17af8ff82468e720325330ec778e81a915c0cd2cd0a01a011d2c2eb0ab6e307487d9abf569082628762a3fe5436055aa468f8728052d1ae')
 validpgpkeys=()
 
 prepare() {
-  cd emsdk-$_emsdk
-  ./emsdk install latest
+  _ver="$(</usr/lib/${_electron}/version)"
+  cd AdvantageScope
+  npm pkg set homepage="https://github.com/Mechanical-Advantage/AdvantageScope"
+  npm pkg set version="${pkgver/.r/+r}"
+  # apply all patches
+  local src
+  for src in "${source[@]}"; do
+    src="${src%%::*}"
+    src="${src##*/}"
+    [[ $src = *.patch ]] || continue
+    echo "Apply patch $src..."
+    patch -Np1 < "../$src"
+  done
+  # allow git sources (they are depended on)
+  # need to do a scriptless fetch before a normal one to make `youtube-dl-exec` work
+  NPM_CONFIG_ALLOW_GIT=all npm ci --ignore-scripts
+  NPM_CONFIG_ALLOW_GIT=all npm install
 }
 
 pkgver() {
   cd "AdvantageScope"
   printf "%s" "$(git describe --tags | cut -c2- | sed 's+-+.r+' | tr - .)"
 }
+
 build() {
   cd AdvantageScope
-  "$srcdir"/emsdk-$_emsdk/emsdk activate latest
-  source "$srcdir"/emsdk-$_emsdk/emsdk_env.sh
-  npm install
-  jq '. + { homepage: "https://github.com/Mechanical-Advantage/AdvantageScope", version: "'"${pkgver/.r/+r}"'" }' package.json >temp.json && mv temp.json package.json
-  npm run build -- --linux --config.linux.target=pacman
-  cd dist
-  tar xvf advantagescope-${pkgver%.r*}.pacman
+  local x86_64=x64
+  npm run compile
+  npm run wasm:compile
+  npm run docs:build-embed
+  export NODE_OPTIONS="--max-old-space-size=4096"
+  npx electron-builder build --linux --"${!CARCH}" --dir $dist \
+    -c.electronDist=/usr/lib/"$_electron" \
+    -c.electronVersion="$_ver"
 }
 
 package() {
+  local x86_64=linux-unpacked
+  install -Dm644 -t "${pkgdir}/usr/share/applications" "${pkgname}.desktop"
+  install -Dm755 /dev/stdin "${pkgdir}/usr/bin/${pkgname}" <<EOF
+#! /usr/bin/sh
+exec $_electron "/usr/lib/${pkgname}/app.asar" "\$@"
+EOF
   cd AdvantageScope
   install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/$pkgname/LICENSE"
-  cd dist
-  cp -rf opt "$pkgdir"
-  cp -rf usr "$pkgdir"
-  mkdir -p "$pkgdir/usr/bin"
-  ln -s "/opt/AdvantageScope/$pkgname" "$pkgdir/usr/bin/$pkgname"
+  install -d "${pkgdir}/usr/lib/${pkgname}/"
+  cp -r dist/${!CARCH}/resources/* "${pkgdir}/usr/lib/${pkgname}"
+  cd icons/app/app-icons-linux
+  for i in *x*.png; do
+    local dir=${i%.png}
+    dir=${dir#icon_}
+    install -Dm6444 "$i" "${pkgdir}/usr/share/icons/hicolor/${dir}/apps/advantagescope.png"
+  done
 }
 
+# vim:set ts=2 sw=2 et:
+

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	LOW	2
2026-08-17 00:18:29	LOW	2
2026-08-16 00:03:42	LOW	2
2026-08-15 00:26:13	LOW	2
2026-08-14 00:03:41	LOW	2
2026-08-13 00:17:07	LOW	2
2026-08-12 03:22:23	MEDIUM	1
2026-06-19 22:34:54	CLEAN	0