asciidoctor-web-pdf
LOW
maintainer taotieren
2 votes
scanned 2026-08-20 03:10:35.909995
Why flagged
The package installs a Node.js application from a source tarball hosted on GitHub, which is a normal AUR practice; the variable-named dependency in npm install refers to the local source, not an untrusted remote package.
Triggered rules
Low
AI review of an ambiguous pattern
llm_review
The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it LOW (confidence 95%): The package installs a Node.js application from a source tarball hosted on GitHub, which is a normal AUR practice; the variable-named dependency in npm install refers to the local source, not an untrusted remote package.
-
PKGBUILD:44
npm install -g --prefix "${pkgdir}/usr" "${srcdir}/${pkgname}-${_tagname}.tar.gz"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: taotieren <admin@taotieren.com>
2
3
pkgname=asciidoctor-web-pdf
4
_tagname=1.0.2
5
pkgver=${_tagname//-/_}
6
pkgrel=1
7
pkgdesc="A PDF converter for AsciiDoc based on web technologies. It allows complex layouts to be defined with CSS and JavaScript, while writing the content in AsciiDoc."
8
arch=('any')
9
url="https://github.com/Mogztter/asciidoctor-web-pdf"
10
license=('MIT')
11
provides=(${pkgname})
12
conflicts=(${pkgname})
13
replaces=()
14
depends=(
15
sh
16
cairo
17
dbus
18
expat
19
glib2
20
libcups
21
libgcc_s.so
22
libstdc++.so
23
libx11
24
libxcb
25
libxext
26
nodejs
27
nspr
28
nss
29
)
30
makedepends=(
31
npm
32
poppler
33
ghostscript
34
)
35
backup=()
36
options=()
37
install=
38
source=("${pkgname}-${_tagname}.tar.gz::${url}/archive/refs/tags/v${_tagname}.tar.gz")
39
sha256sums=('e6cee377923ef27d66871f86ae0b3b2181192bcfa5159fd70641c3d8c9d94aba')
40
# noextract=("${pkgname}-${_tagname}.tar.gz")
41
42
package() {
43
export PUPPETEER_SKIP_DOWNLOAD=true
44
npm install -g --prefix "${pkgdir}/usr" "${srcdir}/${pkgname}-${_tagname}.tar.gz"
45
46
# Non-deterministic race in npm gives 777 permissions to random directories.
47
# See https://github.com/npm/cli/issues/1103 for details.
48
find "${pkgdir}/usr" -type d -exec chmod 755 {} +
49
50
# npm gives ownership of ALL FILES to build user
51
# https://bugs.archlinux.org/task/63396
52
chown -R root:root "${pkgdir}"
53
54
install -Dm0644 "${srcdir}/${pkgname}-${_tagname}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}/"
55
}
56
Changes since previous scan
--- PKGBUILD @ 2026-08-19 17:42+++ PKGBUILD @ 2026-08-20 03:10@@ -1,7 +1,7 @@ # Maintainer: taotieren <admin@taotieren.com> pkgname=asciidoctor-web-pdf-_tagname=1.0.1+_tagname=1.0.2 pkgver=${_tagname//-/_} pkgrel=1 pkgdesc="A PDF converter for AsciiDoc based on web technologies. It allows complex layouts to be defined with CSS and JavaScript, while writing the content in AsciiDoc."@@ -36,7 +36,7 @@ options=() install= source=("${pkgname}-${_tagname}.tar.gz::${url}/archive/refs/tags/v${_tagname}.tar.gz")-sha256sums=('e9568bdfd9c140c642a6b2496aa26ee105fe8385bb24db5eaec5214ef01af8bc')+sha256sums=('e6cee377923ef27d66871f86ae0b3b2181192bcfa5159fd70641c3d8c9d94aba') # noextract=("${pkgname}-${_tagname}.tar.gz") package() {Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-20 03:10:35 | Low | 1 |
| 2026-08-19 17:42:05 | Clean | 1 |
| 2026-08-17 23:38:16 | Clean | 1 |
| 2026-08-16 09:32:18 | Clean | 1 |
| 2026-08-15 01:30:13 | Clean | 1 |
| 2026-08-14 17:29:23 | Clean | 1 |
| 2026-06-18 16:11:54 | Clean | 0 |