blockwork-git

LOW

maintainer ethanstokes 0 votes scanned 2026-09-09 00:04:09.106193

View on AUR

Why flagged

Package builds from the project's own GitHub source; pnpm install runs against the project's own ui/ directory (normal frontend dependency resolution), not an undeclared external package; the few-votes/new-upload concern is minor and not indicative of malice.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): Package builds from the project's own GitHub source; pnpm install runs against the project's own ui/ directory (normal frontend dependency resolution), not an undeclared external package; the few-votes/new-upload concern is minor and not indicative of malice.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:34 pnpm install --dir ui

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Ethan Stokes <erstokes10@gmail.com>
    
      2
    
      3pkgname=blockwork-git
    
      4pkgver=0.5.0.r280.0aef58e
    
      5pkgrel=1
    
      6pkgdesc='A Tauri app to visually create and run automation.'
    
      7url='https://github.com/EthanRStokes/Blockwork'
    
      8arch=('x86_64')
    
      9license=('GPL-3.0-only')
    
      10makedepends=('rust' 'git' 'gcc' 'glibc' 'pnpm' 'cmake' 'ninja' 'curl' 'pkgconf'
    
      11             'gtk3' 'webkit2gtk-4.1' 'libsoup3' 'libappindicator' 'dbus')
    
      12depends=(
    
      13    'gtk3' 'nss' 'alsa-lib' 'hicolor-icon-theme' 'libxss' 'webkit2gtk-4.1'
    
      14    'libsoup3' 'libappindicator'
    
      15    'libgcc' 'glibc'
    
      16)
    
      17conflicts=('blockwork')
    
      18provides=('blockwork')
    
      19source=("git+https://github.com/EthanRStokes/Blockwork")
    
      20sha256sums=('SKIP')
    
      21options=('!lto')
    
      22
    
      23pkgver() {
    
      24	cd "$srcdir/Blockwork"
    
      25	printf "%s.r%s.%s" "$(git describe --tags --abbrev=0 | sed 's/^v//')" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
    
      26}
    
      27
    
      28prepare() {
    
      29    cd "$srcdir/Blockwork"
    
      30    git reset --hard HEAD
    
      31    git_tag="$(git describe --tags --abbrev=0 | sed 's/^v//')"
    
      32
    
      33    cargo fetch
    
      34    pnpm install --dir ui
    
      35}
    
      36
    
      37build() {
    
      38    cd "$srcdir/Blockwork"
    
      39    export BLOCKWORK_PNPM_OFFLINE=1
    
      40    cargo build --release --frozen
    
      41}
    
      42
    
      43package() {
    
      44    cd "$srcdir/Blockwork"
    
      45
    
      46    local libdir="$pkgdir/usr/lib/blockwork"
    
      47
    
      48    # Binary's RUNPATH is $ORIGIN, so the CEF runtime payload (libcef.so,
    
      49    # GL/Vulkan shims, *.pak, icudtl.dat, locales/, ...) has to live alongside
    
      50    # it in a private libdir, not /usr/bin.
    
      51    install -Dm755 "target/release/blockwork"                     "$libdir/blockwork"
    
      52    install -Dm755 "target/release/libcef.so"                  "$libdir/libcef.so"
    
      53    install -Dm755 "target/release/libEGL.so"                  "$libdir/libEGL.so"
    
      54    install -Dm755 "target/release/libGLESv2.so"                "$libdir/libGLESv2.so"
    
      55    install -Dm755 "target/release/libvk_swiftshader.so"       "$libdir/libvk_swiftshader.so"
    
      56    install -Dm755 "target/release/libvulkan.so.1"              "$libdir/libvulkan.so.1"
    
      57    install -Dm755 "target/release/chrome-sandbox"              "$libdir/chrome-sandbox"
    
      58    install -Dm644 "target/release/vk_swiftshader_icd.json"    "$libdir/vk_swiftshader_icd.json"
    
      59    install -Dm644 "target/release/icudtl.dat"                  "$libdir/icudtl.dat"
    
      60    install -Dm644 "target/release/v8_context_snapshot.bin"    "$libdir/v8_context_snapshot.bin"
    
      61    install -Dm644 "target/release/chrome_100_percent.pak"     "$libdir/chrome_100_percent.pak"
    
      62    install -Dm644 "target/release/chrome_200_percent.pak"     "$libdir/chrome_200_percent.pak"
    
      63    install -Dm644 "target/release/resources.pak"               "$libdir/resources.pak"
    
      64    cp -r "target/release/locales" "$libdir/locales"
    
      65
    
      66    install -d "$pkgdir/usr/bin"
    
      67    ln -sf /usr/lib/blockwork/blockwork "$pkgdir/usr/bin/blockwork"
    
      68
    
      69    install -Dm644 "res/icons/blockwork.png" "$pkgdir"/usr/share/icons/hicolor/256x256/apps/blockwork.png
    
      70    install -Dm644 "res/blockwork.desktop" "$pkgdir"/usr/share/applications/blockwork.desktop
    
      71}
    
      72

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-09 00:04:09	Low	3
2026-09-08 21:20:15	Low	3
2026-09-08 21:18:22	Medium	2