aigcpanel-git

maintainer orphaned · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from a public git repository on Gitee, a plausible project host, and installs standard build artifacts; the npm registry is mirrored for availability, not malice, and no untrusted executables are downloaded or executed.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from a public git repository on Gitee, a plausible project host, and installs standard build artifacts; the npm registry is mirrored for availability, not malice, and no untrusted executables are downloaded or executed.

2 higher static findings superseded - not the current verdict (shown for transparency)

MEDIUM Package install from an untrusted index/registry host install_untrusted_index

An install command is pointed at a custom package index / registry on a non-allowlisted host (--index-url / --registry / --extra-index-url), a classic dependency-confusion vector.

PKGBUILD:37 npm config set registry https://registry.npmmirror.com

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:24 source=("git+https://gitee.com/modstart-lib/aigcpanel.git")

PKGBUILD

2 offending line(s) highlighted

      1# Contributor MYT1 <MYT1 @ YAHOO.com>
    
      2
    
      3pkgname=aigcpanel-git
    
      4_pkgname=AigcPanel
    
      5pkgdesc="AigcPanel 是一个简单易用的一站式AI数字人系统，小白也可使用。 支持视频合成、声音合成、声音克隆，简化本地模型管理、一键导入和使用AI模型。"
    
      6pkgver=20241122.1970dde
    
      7pkgrel=1
    
      8arch=('x86_64' 'arm64')
    
      9url=https://aigcpanel.com/
    
      10licence=(AGPL-3.0)
    
      11depends=('hicolor-icon-theme'
    
      12    'gtk3'
    
      13    'libnotify'
    
      14    "electron${_electronversion}"
    
      15    "ffmpeg")
    
      16makedepends=('asar'
    
      17    'npm'
    
      18    'nvm'
    
      19    'pnpm'
    
      20)
    
      21conflicts=("${pkgname%-git}"
    
      22    "${pkgname%-git}-bin"
    
      23)
    
      24source=("git+https://gitee.com/modstart-lib/aigcpanel.git")
    
      25sha256sums=('SKIP')
    
      26_electronversion=33
    
      27_nodeversion=23
    
      28
    
      29pkgver(){
    
      30    cd "${srcdir}/${pkgname%-git}"
    
      31
    
      32    # Commit date + short rev
    
      33    echo $(TZ=UTC git show -s --pretty=%cd --date=format-local:%Y%m%d HEAD).$(git rev-parse --short HEAD)
    
      34}
    
      35
    
      36prepare(){
    
      37    npm config set registry https://registry.npmmirror.com
    
      38    git -C "${srcdir}/${pkgname%-git}" clean -dfx
    
      39
    
      40	cd "${srcdir}/${pkgname%-git}"
    
      41	npm install
    
      42}
    
      43
    
      44build(){
    
      45	cd "${srcdir}/${pkgname%-git}"
    
      46	gendesk -q -f -n --pkgname="${pkgname%-git}" --pkgdesc="${pkgdesc}" --categories="Utility" --name="${_pkgname}" --exec="${pkgname%-git} %U" --comment="Link android to PC easily" --icon="${pkgname%-git}"
    
      47	sed -i '114,120d' electron-builder.json5
    
      48	npm run build:linux --dir
    
      49}
    
      50
    
      51package(){
    
      52	_arch=$(node -e "os=require('os'); console.log(os.arch());")-
    
      53	if [ ${_arch}==x64- ]
    
      54	then
    
      55		_arch=""
    
      56	fi
    
      57	cd "${srcdir}/${pkgname%-git}/dist-release/linux-unpacked"
    
      58	mkdir -p "${pkgdir}/opt/${pkgname%-git}"
    
      59	cp -r * "${pkgdir}/opt/${pkgname%-git}"
    
      60	mkdir -p "${pkgdir}/usr/bin"
    
      61	ln -s "/opt/${pkgname%-git}/${pkgname%-git}" "${pkgdir}/usr/bin/${pkgname%-git}"
    
      62	install -Dm644 "${srcdir}/${pkgname%-git}/${pkgname%-git}.desktop" "${pkgdir}/usr/share/applications/${pkgname%-git}.desktop"
    
      63	install -Dm644 "${srcdir}/${pkgname%-git}/dist/logo.svg" "${pkgdir}/usr/share/icons/hicolor/scalable/apps/${pkgname%-git}.svg"
    
      64	install -Dm644 "${srcdir}/${pkgname%-git}/dist/logo-white.svg" "${pkgdir}/usr/share/pixmaps/${pkgname%-git}.svg"
    
      65}
    
      66
    
      67

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	3
2026-08-02 00:16:08	LOW	3
2026-08-01 00:11:18	LOW	3
2026-07-31 00:14:10	LOW	3
2026-07-30 00:17:23	LOW	3
2026-07-29 00:25:53	LOW	3
2026-07-28 00:07:28	LOW	3
2026-07-27 00:24:32	LOW	3
2026-07-26 00:07:32	LOW	3
2026-07-25 00:13:44	LOW	3
2026-07-24 00:02:28	LOW	3
2026-07-23 00:14:47	LOW	3
2026-07-22 00:29:32	LOW	3
2026-07-21 00:24:15	LOW	3
2026-07-20 00:19:49	LOW	3
2026-07-19 00:17:08	LOW	3
2026-07-18 00:14:48	LOW	3
2026-07-17 00:06:16	LOW	3
2026-07-16 00:05:41	LOW	3
2026-07-15 00:09:25	LOW	3