bilibili

LOW
maintainer zxp19821005 3 votes scanned 2026-11-04 00:25:23.536954
View on AUR
Why flagged

The package builds from a legitimate GitHub source and uses standard build tools; the variable-named package installation via pnpm is part of normal project dependency resolution and does not introduce untrusted external code.

Triggered rules

Low AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it LOW (confidence 95%): The package builds from a legitimate GitHub source and uses standard build tools; the variable-named package installation via pnpm is part of normal project dependency resolution and does not introduce untrusted external code.

  • PKGBUILD:111 npm install -g "pnpm@${_ver}" --prefix "${HOME}/.pnpm" \

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2pkgname=bilibili
3_pkgver=1.20.0
4_subver=1
5pkgver="${_pkgver}_${_subver}"
6_electronversion=43
7_nodeversion=24
8pkgrel=1
9pkgdesc="Linux version based on Beilai official client porting supports roaming.基于哔哩哔哩官方客户端移植的Linux版本,支持漫游"
10arch=(
11 'aarch64'
12 'x86_64'
13)
14url="https://www.jysafe.cn/"
15_ghurl="https://github.com/msojocs/bilibili-linux"
16license=('MIT')
17provides=("${pkgname}")
18conflicts=(
19 "${pkgname}"
20)
21depends=(
22 "electron${_electronversion}"
23 'ffmpeg'
24 'libappindicator'
25 'nodejs'
26 'libinput'
27)
28makedepends=(
29 'wget'
30 'perl-image-exiftool'
31 'asar'
32 'unzip'
33 'p7zip'
34 'npm'
35 'nvm'
36 'pnpm'
37 'git'
38 'jq'
39)
40options=(
41 '!strip'
42 '!emptydirs'
43)
44source=(
45 "${pkgname}-${pkgver}.tar.gz::${_ghurl}/archive/refs/tags/v${_pkgver}-${_subver}.tar.gz"
46 "${pkgname}.js"
47 "${pkgname}.sh"
48)
49sha256sums=('8811694e7ada8fee07b6b3894ee51f214c150f3b1d7bab8646be91f0a58fdc66'
50 '562897be8a17076176f8d985c0d7bc1c685f2e7c9b3a932339ce015963243627'
51 'ace275e253744ca62d2572776df26b947f3c89616239985003126db635fc300e')
52_get_project_dir() {
53 local d
54 while IFS= read -r d; do
55 find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
56 done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
57}
58_ensure_local_nvm() {
59 local NVM_DIR="${srcdir}/.nvm"
60 source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
61 nvm install "${_nodeversion}"
62 nvm use "${_nodeversion}"
63}
64_get_app_dir() {
65 find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -printf '%h\n' 2>/dev/null \
66 | while read -r d; do [[ -d "${d}/resources" ]] && { echo "$d"; return 0; }; done
67}
68_get_electron_version() {
69 _elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
70 | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
71 | grep -oE '[0-9]+' | head -1)
72 [[ -z "${_elec_ver}" ]] && return 1
73 (( _elec_ver == _electronversion )) && c=32 || c=31
74 echo -e "Electron version: \033[1;${c}m${_elec_ver}$([[ $c -eq 31 ]] && echo " (expected ${_electronversion})")\033[0m"
75}
76_set_electron_build_env() {
77 export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
78 export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
79 export ELECTRON_SKIP_BINARY_DOWNLOAD=1
80 export ELECTRON_BUILDER_OFFLINE=true
81 export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
82}
83_set_pnpm_build_env() {
84 export HOME="${srcdir}/.home"
85 export XDG_CACHE_HOME="${HOME}/.cache"
86 export XDG_CONFIG_HOME="${HOME}/.config"
87 export XDG_DATA_HOME="${HOME}/.local/share"
88 export XDG_STATE_HOME="${HOME}/.local/state"
89 export PNPM_HOME="${HOME}/.pnpm/bin"
90 export pnpm_config_cache_dir="${HOME}/.pnpm_cache"
91 export pnpm_config_store_dir="${HOME}/.pnpm_store"
92 export pnpm_config_global_dir="${HOME}/.pnpm/global"
93 export pnpm_config_state_dir="${HOME}/.pnpm/state"
94 export pnpm_config_node_linker=hoisted
95 export pnpm_config_minimum_release_age=0
96 export pnpm_config_update_notifier=false
97 export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
98 export COREPACK_HOME="${HOME}/.corepack"
99 mkdir -p "${HOME}" "${PNPM_HOME}" "${pnpm_config_cache_dir}" "${pnpm_config_store_dir}" "${pnpm_config_global_dir}" "${pnpm_config_state_dir}" "${COREPACK_HOME}"
100 export PATH="${PNPM_HOME}:${PATH}"
101 local _detected=""
102 local _pkgjson="$(_get_project_dir)/package.json"
103 if [ -f "${_pkgjson}" ]; then
104 _detected="$(grep -o '"packageManager"[^,]*' "${_pkgjson}" 2>/dev/null | grep -oE 'pnpm@[^"+]+' | head -n1 | sed 's/^pnpm@//')"
105 if [ -z "${_detected}" ]; then
106 _detected="$(grep -oE '"pnpm"[[:space:]]*:[[:space:]]*"[^"]+"' "${_pkgjson}" 2>/dev/null | grep -oE '[0-9][0-9.]*' | head -n1)"
107 fi
108 fi
109 local _ver="${_pnpmver:-${_detected}}"
110 if [ -n "${_ver}" ]; then
111 npm install -g "pnpm@${_ver}" --prefix "${HOME}/.pnpm" \
112 --registry "${COREPACK_NPM_REGISTRY}"
113 fi
114}
115prepare() {
116 cd "$(_get_project_dir)"
117 _get_electron_version
118 sed -i -e "
119 s/@electronversion@/${_electronversion}/g
120 s/@appname@/${pkgname}/g
121 " "${srcdir}/${pkgname}.sh" "${srcdir}/${pkgname}.js"
122 sed -i "s/mkdir tmp/mkdir tmp \&\& cp ..\/..\/..\/.npmrc tmp/g" tools/fix-other.sh
123 _ensure_local_nvm
124 _set_electron_build_env
125 _set_pnpm_build_env
126 jq --arg ver "${SYSTEM_ELECTRON_VERSION}" '.devDependencies.electron = $ver' conf/build.json > conf/build.json.tmp && mv conf/build.json.tmp conf/build.json
127 export NODE_ENV=development
128 pnpm install
129}
130build() {
131 cd "$(_get_project_dir)"
132 _ensure_local_nvm
133 _set_electron_build_env
134 _set_pnpm_build_env
135 sed -i '/一次版本校验/,/^fi$/d' tools/update-bilibili.sh
136 sh tools/update-bilibili.sh
137 sh tools/fix-other.sh
138 sh tools/extension.sh
139 mv tmp/bili/resources/* app
140 find "$(_get_project_dir)/app" -type d \( -name "*win32*" -o -name "*darwin*" \) -exec rm -rf {} +
141}
142package() {
143 install -Dm755 "${srcdir}/${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
144 install -Dm644 "${srcdir}/${pkgname}.js" -t "${pkgdir}/usr/lib/${pkgname}"
145 cp -a "$(_get_project_dir)/app/." "${pkgdir}/usr/lib/${pkgname}/"
146 install -Dm644 "$(_get_project_dir)/res/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
147 _icon_sizes=(16x16 24x24 32x32 48x48 64x64 96x96 128x128 256x256 512x512 1024x1024)
148 for _icons in "${_icon_sizes[@]}";do
149 install -Dm644 "$(_get_project_dir)/res/icons/${_icons}.png" \
150 "${pkgdir}/usr/share/icons/hicolor/${_icons}/apps/${pkgname}.png"
151 done
152 install -Dm644 "$(_get_project_dir)/license" -t "${pkgdir}/usr/share/licenses/${pkgname}"
153}
154

Changes since previous scan

--- PKGBUILD @ 2026-11-03 00:01
+++ PKGBUILD @ 2026-11-04 00:25
@@ -1,10 +1,10 @@
# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
pkgname=bilibili
-_pkgver=1.19.0
-_subver=3
+_pkgver=1.20.0
+_subver=1
pkgver="${_pkgver}_${_subver}"
_electronversion=43
-_nodeversion=22
+_nodeversion=24
pkgrel=1
pkgdesc="Linux version based on Beilai official client porting supports roaming.基于哔哩哔哩官方客户端移植的Linux版本,支持漫游"
arch=(
@@ -42,32 +42,45 @@
'!emptydirs'
)
source=(
- "${pkgname}-${pkgver}::git+${_ghurl}#tag=v${_pkgver}-${_subver}"
+ "${pkgname}-${pkgver}.tar.gz::${_ghurl}/archive/refs/tags/v${_pkgver}-${_subver}.tar.gz"
+ "${pkgname}.js"
"${pkgname}.sh"
)
-sha256sums=('293cdb47ba838c162a75794a24e194ab008636c416bb3f0e1301fd35cbb6f749'
- 'bd5358d8f323d3c2c2f0733364ee4ea55f551dd86ba0be2a76846210b60897fc')
-_ensure_local_nvm() {
- local NVM_DIR="${srcdir}/.nvm"
- source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
- nvm install "${_nodeversion}"
- nvm use "${_nodeversion}"
-}
+sha256sums=('8811694e7ada8fee07b6b3894ee51f214c150f3b1d7bab8646be91f0a58fdc66'
+ '562897be8a17076176f8d985c0d7bc1c685f2e7c9b3a932339ce015963243627'
+ 'ace275e253744ca62d2572776df26b947f3c89616239985003126db635fc300e')
_get_project_dir() {
local d
while IFS= read -r d; do
find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
}
+_ensure_local_nvm() {
+ local NVM_DIR="${srcdir}/.nvm"
+ source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
+ nvm install "${_nodeversion}"
+ nvm use "${_nodeversion}"
+}
_get_app_dir() {
- find "${srcdir}" -type d -name "node_modules" -prune -o -type f -name "resources.pak" -print0 | xargs -0 dirname | head -n 1
+ find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -printf '%h\n' 2>/dev/null \
+ | while read -r d; do [[ -d "${d}/resources" ]] && { echo "$d"; return 0; }; done
}
-_set_build_env() {
+_get_electron_version() {
+ _elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
+ | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
+ | grep -oE '[0-9]+' | head -1)
+ [[ -z "${_elec_ver}" ]] && return 1
+ (( _elec_ver == _electronversion )) && c=32 || c=31
+ echo -e "Electron version: \033[1;${c}m${_elec_ver}$([[ $c -eq 31 ]] && echo " (expected ${_electronversion})")\033[0m"
+}
+_set_electron_build_env() {
export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
export ELECTRON_SKIP_BINARY_DOWNLOAD=1
export ELECTRON_BUILDER_OFFLINE=true
export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
+}
+_set_pnpm_build_env() {
export HOME="${srcdir}/.home"
export XDG_CACHE_HOME="${HOME}/.cache"
export XDG_CONFIG_HOME="${HOME}/.config"
@@ -85,25 +98,19 @@
export COREPACK_HOME="${HOME}/.corepack"
mkdir -p "${HOME}" "${PNPM_HOME}" "${pnpm_config_cache_dir}" "${pnpm_config_store_dir}" "${pnpm_config_global_dir}" "${pnpm_config_state_dir}" "${COREPACK_HOME}"
export PATH="${PNPM_HOME}:${PATH}"
- local _pnpmver=""
+ local _detected=""
local _pkgjson="$(_get_project_dir)/package.json"
if [ -f "${_pkgjson}" ]; then
- _pnpmver="$(grep -o '"packageManager"[^,]*' "${_pkgjson}" 2>/dev/null | grep -oE 'pnpm@[^"+]+' | head -n1 | sed 's/^pnpm@//')"
- if [ -z "${_pnpmver}" ]; then
- _pnpmver="$(grep -oE '"pnpm"[[:space:]]*:[[:space:]]*"[^"]+"' "${_pkgjson}" 2>/dev/null | grep -oE '[0-9][0-9.]*' | head -n1)"
+ _detected="$(grep -o '"packageManager"[^,]*' "${_pkgjson}" 2>/dev/null | grep -oE 'pnpm@[^"+]+' | head -n1 | sed 's/^pnpm@//')"
+ if [ -z "${_detected}" ]; then
+ _detected="$(grep -oE '"pnpm"[[:space:]]*:[[:space:]]*"[^"]+"' "${_pkgjson}" 2>/dev/null | grep -oE '[0-9][0-9.]*' | head -n1)"
fi
fi
- if [ -n "${_pnpmver}" ]; then
- npm install -g "pnpm@${_pnpmver}" --prefix "${HOME}/.pnpm" \
+ local _ver="${_pnpmver:-${_detected}}"
+ if [ -n "${_ver}" ]; then
+ npm install -g "pnpm@${_ver}" --prefix "${HOME}/.pnpm" \
--registry "${COREPACK_NPM_REGISTRY}"
fi
-}
-_get_electron_version() {
- _elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
- | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
- | grep -v '^$' | sed 's/^[^0-9]*//' | head -1)
- [[ -z "${_elec_ver}" ]] && return 1
- echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
}
prepare() {
cd "$(_get_project_dir)"
@@ -111,19 +118,20 @@
sed -i -e "
s/@electronversion@/${_electronversion}/g
s/@appname@/${pkgname}/g
- s/@runname@/app.asar/g
- s/@cfgdirname@/${pkgname}/g
- " "${srcdir}/${pkgname}.sh"
+ " "${srcdir}/${pkgname}.sh" "${srcdir}/${pkgname}.js"
sed -i "s/mkdir tmp/mkdir tmp \&\& cp ..\/..\/..\/.npmrc tmp/g" tools/fix-other.sh
_ensure_local_nvm
- _set_build_env
- sed -i "s/\"electronVersion\": \"[^\"]*\"/\"electronVersion\": \"${SYSTEM_ELECTRON_VERSION}\"/g" conf/build.json
- NODE_ENV=development pnpm install
+ _set_electron_build_env
+ _set_pnpm_build_env
+ jq --arg ver "${SYSTEM_ELECTRON_VERSION}" '.devDependencies.electron = $ver' conf/build.json > conf/build.json.tmp && mv conf/build.json.tmp conf/build.json
+ export NODE_ENV=development
+ pnpm install
}
build() {
cd "$(_get_project_dir)"
_ensure_local_nvm
- _set_build_env
+ _set_electron_build_env
+ _set_pnpm_build_env
sed -i '/一次版本校验/,/^fi$/d' tools/update-bilibili.sh
sh tools/update-bilibili.sh
sh tools/fix-other.sh
@@ -133,15 +141,14 @@
}
package() {
install -Dm755 "${srcdir}/${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
- install -Dm755 -d "${pkgdir}/usr/lib/${pkgname}"
- local _src="$(_get_project_dir)"
- cp -a "${_src}/app/." "${pkgdir}/usr/lib/${pkgname}/"
- install -Dm644 "${_src}/res/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
+ install -Dm644 "${srcdir}/${pkgname}.js" -t "${pkgdir}/usr/lib/${pkgname}"
+ cp -a "$(_get_project_dir)/app/." "${pkgdir}/usr/lib/${pkgname}/"
+ install -Dm644 "$(_get_project_dir)/res/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
_icon_sizes=(16x16 24x24 32x32 48x48 64x64 96x96 128x128 256x256 512x512 1024x1024)
for _icons in "${_icon_sizes[@]}";do
- install -Dm644 "${_src}/res/icons/${_icons}.png" \
+ install -Dm644 "$(_get_project_dir)/res/icons/${_icons}.png" \
"${pkgdir}/usr/share/icons/hicolor/${_icons}/apps/${pkgname}.png"
done
- install -Dm644 "${_src}/license" -t "${pkgdir}/usr/share/licenses/${pkgname}"
+ install -Dm644 "$(_get_project_dir)/license" -t "${pkgdir}/usr/share/licenses/${pkgname}"
}

Scan history

Scanned at (UTC)SeverityRules
2026-11-04 00:25:23 Low 1
2026-11-03 04:04:05 Low 1
2026-11-03 00:01:00 Low 1
2026-11-02 00:26:00 Low 1
2026-11-01 00:21:48 Low 1
2026-10-31 00:07:41 Low 1
2026-10-30 00:29:30 Low 1
2026-10-29 00:13:55 Low 1
2026-10-28 00:06:54 Low 1
2026-10-27 00:23:28 Low 1
2026-10-26 00:12:40 Low 1
2026-10-25 00:20:48 Low 1
2026-10-24 00:14:55 Low 1
2026-10-23 00:02:19 Low 1
2026-10-22 00:13:10 Low 1
2026-10-21 00:12:50 Low 1
2026-10-20 00:10:31 Low 1
2026-10-19 00:03:55 Low 1
2026-10-18 00:06:55 Low 1
2026-10-17 00:21:55 Low 1

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion