asciidoctor-web-pdf-git

maintainer taotieren · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from the project's own git source and uses 'npm pack' to create a local package for installation, which is a normal part of building the project; no external untrusted packages are demonstrably installed despite the static analysis flag.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from the project's own git source and uses 'npm pack' to create a local package for installation, which is a normal part of building the project; no external untrusted packages are demonstrably installed despite the static analysis flag.

PKGBUILD:54 npm install -g --prefix "${pkgdir}/usr" $(npm pack)

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:54 npm install -g --prefix "${pkgdir}/usr" $(npm pack)

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: taotieren <admin@taotieren.com>
    
      2
    
      3pkgname=asciidoctor-web-pdf-git
    
      4pkgver=1.0.0.alpha.16.r22.gf1a84c1
    
      5pkgrel=1
    
      6pkgdesc="A PDF converter for AsciiDoc based on web technologies. It allows complex layouts to be defined with CSS and JavaScript, while writing the content in AsciiDoc."
    
      7arch=($CARCH)
    
      8url="https://github.com/Mogztter/asciidoctor-web-pdf"
    
      9license=('MIT')
    
      10provides=(${pkgname%-git} asciidoctor-pdf)
    
      11conflicts=(${pkgname%-git} asciidoctor-pdf)
    
      12#replaces=(${pkgname})
    
      13depends=(
    
      14    sh
    
      15    cairo
    
      16    dbus
    
      17    expat
    
      18    gcc-libs
    
      19    glib2
    
      20    glibc
    
      21    libcups
    
      22    libx11
    
      23    libxcb
    
      24    libxext
    
      25    nodejs
    
      26    nspr
    
      27    nss
    
      28)
    
      29makedepends=(
    
      30    git
    
      31    npm
    
      32    poppler
    
      33    ghostscript
    
      34)
    
      35backup=()
    
      36options=()
    
      37install=
    
      38source=("${pkgname%-git}::git+${url}.git")
    
      39sha256sums=('SKIP')
    
      40noextract=()
    
      41
    
      42pkgver() {
    
      43    cd "${srcdir}/${pkgname%-git}"
    
      44    (
    
      45        set -o pipefail
    
      46        git describe --long --tag --abbrev=7 2>/dev/null | sed 's/^[vV]//g;s/\([^-]*-g\)/r\1/;s/-/./g' ||
    
      47            printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
    
      48    )
    
      49}
    
      50
    
      51package() {
    
      52    cd "${srcdir}/${pkgname%-git}"
    
      53    export PUPPETEER_SKIP_DOWNLOAD=true
    
      54    npm install -g --prefix "${pkgdir}/usr" $(npm pack)
    
      55
    
      56    # Non-deterministic race in npm gives 777 permissions to random directories.
    
      57    # See https://github.com/npm/cli/issues/1103 for details.
    
      58    find "${pkgdir}/usr" -type d -exec chmod 755 {} +
    
      59
    
      60    # npm gives ownership of ALL FILES to build user
    
      61    # https://bugs.archlinux.org/task/63396
    
      62    chown -R root:root "${pkgdir}"
    
      63
    
      64    install -Dm0644 "${srcdir}/${pkgname%-git}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}/"
    
      65}
    
      66

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2