bruno

HIGH

maintainer vianney 16 votes scanned 2026-08-20 15:11:35.617252

View on AUR

Why flagged

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time.

Triggered rules

High npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time.

PKGBUILD:47 npm install --cache "${srcdir}/npm-cache" --include dev
PKGBUILD:48 npm install node-addon-api --save-dev --cache "${srcdir}/npm-cache"

High npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell.

PKGBUILD:102 npx --no asar e packages/bruno-electron/out/linux-unpacked/resources/app.asar "${pkgdir}/usr/lib/${pkgname}/"

PKGBUILD

3 offending line(s) highlighted

      1# Maintainer: Vianney Bouchaud <aur dot vianney at bouchaud dot org>
    
      2
    
      3pkgname=bruno
    
      4pkgdesc="Opensource API Client for Exploring and Testing APIs"
    
      5pkgver=4.0.0
    
      6pkgrel=1
    
      7arch=('x86_64')
    
      8url="https://www.usebruno.com/"
    
      9license=('MIT')
    
      10_electron=electron37
    
      11depends=(
    
      12    "${_electron}"
    
      13    'alsa-lib'
    
      14)
    
      15makedepends=(
    
      16    'nvm'
    
      17    'python-setuptools'
    
      18    'python'
    
      19)
    
      20
    
      21source=(
    
      22   "${pkgname}-${pkgver}.tar.gz::https://github.com/usebruno/bruno/archive/v${pkgver}.tar.gz"
    
      23   com.usebruno.app.Bruno.desktop
    
      24)
    
      25
    
      26sha256sums=('61c536c22add27f325ac1de5134fb06182ad77653a24ef10f6b230aeda16b536'
    
      27            'e7267d33e2168f46942f57082a3c1c9afc46760038486c9cc9e9ff96d90fa841')
    
      28
    
      29_ensure_local_nvm() {
    
      30  # lets be sure we are starting clean
    
      31  which nvm >/dev/null 2>&1 && nvm deactivate && nvm unload
    
      32
    
      33  export NVM_DIR="${srcdir}/${pkgname}-${pkgver}/.nvm"
    
      34  # The init script returns 3 if version
    
      35  #   specified in ./.nvrc is not (yet) installed in $NVM_DIR
    
      36  #   but nvm itself still gets loaded ok
    
      37  source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
    
      38}
    
      39
    
      40prepare() {
    
      41    _ensure_local_nvm
    
      42    cd "${pkgname}-${pkgver}"
    
      43
    
      44    nvm install
    
      45
    
      46    export HUSKY=0
    
      47    npm install --cache "${srcdir}/npm-cache" --include dev
    
      48    npm install node-addon-api --save-dev --cache "${srcdir}/npm-cache"
    
      49}
    
      50
    
      51build() {
    
      52    _ensure_local_nvm
    
      53    export NODE_ENV=production
    
      54    export NODE_OPTIONS=--openssl-legacy-provider
    
      55
    
      56    cd "${pkgname}-${pkgver}"
    
      57
    
      58    npm run sandbox:bundle-libraries --workspace=packages/bruno-js
    
      59
    
      60    npm run build --workspace=packages/bruno-common
    
      61    npm run build --workspace=packages/bruno-requests
    
      62    npm run build --workspace=packages/bruno-converters
    
      63    npm run build --workspace=packages/bruno-query
    
      64    npm run build --workspace=packages/bruno-graphql-docs
    
      65    npm run build --workspace=packages/bruno-schema-types
    
      66    npm run build --workspace=packages/bruno-filestore
    
      67    npm run build --workspace=packages/bruno-app
    
      68
    
      69    rm -rf packages/bruno-electron/{out,web}
    
      70    mkdir -p packages/bruno-electron/web
    
      71    cp -r packages/bruno-app/dist/* packages/bruno-electron/web
    
      72
    
      73    sed -i -e 's@/static/@static/@g' packages/bruno-electron/web/**.html
    
      74    sed -i -e 's@/static/font@../../static/font@g' packages/bruno-electron/web/static/css/**.**.css
    
      75
    
      76    find packages/bruno-electron/web -name '*.map' -type f -delete
    
      77
    
      78    electronDist="/usr/lib/${_electron}"
    
      79    electronVer="$(cat ${electronDist}/version)"
    
      80
    
      81    npm run pack --workspace=packages/bruno-electron -- \
    
      82        --linux \
    
      83        --x64 \
    
      84        --config electron-builder-config.js \
    
      85        -c.electronDist=${electronDist} \
    
      86        -c.electronVersion=${electronVer}
    
      87}
    
      88
    
      89package() {
    
      90    install -Dm0644 com.usebruno.app.Bruno.desktop -t "${pkgdir}/usr/share/applications/"
    
      91
    
      92    cd "${pkgname}-${pkgver}"
    
      93
    
      94    install -Dm0755 /dev/null "${pkgdir}/usr/bin/${pkgname}"
    
      95    cat >> "${pkgdir}/usr/bin/${pkgname}" <<EOD
    
      96#! /usr/bin/sh
    
      97ELECTRON_IS_DEV=0 exec ${_electron} /usr/lib/bruno "\$@"
    
      98EOD
    
      99
    
      100    install -Dm0644 license.md "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      101    install -d "${pkgdir}/usr/lib/${pkgname}/"
    
      102    npx --no asar e packages/bruno-electron/out/linux-unpacked/resources/app.asar "${pkgdir}/usr/lib/${pkgname}/"
    
      103
    
      104    for i in 16 24 48 64 128 256 512 1024; do
    
      105        install -Dm644 "packages/bruno-electron/resources/icons/png/${i}x${i}.png" "${pkgdir}/usr/share/icons/hicolor/${i}x${i}/apps/com.usebruno.app.Bruno.png"
    
      106    done
    
      107}
    
      108

Changes since previous scan

--- PKGBUILD @ 2026-07-05 09:18
+++ PKGBUILD @ 2026-08-20 15:11
@@ -2,7 +2,7 @@
 
 pkgname=bruno
 pkgdesc="Opensource API Client for Exploring and Testing APIs"
-pkgver=3.5.1
+pkgver=4.0.0
 pkgrel=1
 arch=('x86_64')
 url="https://www.usebruno.com/"
@@ -23,7 +23,7 @@
    com.usebruno.app.Bruno.desktop
 )
 
-sha256sums=('8089324fe3dc3cc6de986ecbaebd4a2bbd82d79ad0bf19e6b8d074425dd7e320'
+sha256sums=('61c536c22add27f325ac1de5134fb06182ad77653a24ef10f6b230aeda16b536'
             'e7267d33e2168f46942f57082a3c1c9afc46760038486c9cc9e9ff96d90fa841')
 
 _ensure_local_nvm() {

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-20 15:11:35	High	2
2026-07-25 07:33:00	Clean	3
2026-07-25 07:29:36	High	2
2026-07-05 09:18:22	Clean	3
2026-07-05 09:16:49	High	3
2026-06-25 12:23:50	Clean	3
2026-06-25 12:22:11	High	3
2026-06-20 00:50:07	Clean	3
2026-06-20 00:27:34	Clean	3
2026-06-20 00:18:46	High	2
2026-06-19 23:51:18	Medium	3
2026-06-19 19:07:35	Low	3
2026-06-19 18:54:17	Low	3
2026-06-18 16:11:54	High	2