chatbox-git

LOW
maintainer zxp19821005 0 votes scanned 2026-09-29 09:23:18.383364
View on AUR
Why flagged

The package builds from the project's own GitHub source using standard Node.js tooling; the variable-named package install (pnpm) refers to version pinning from the project's package.json, not an external untrusted package.

Triggered rules

Low AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it LOW (confidence 95%): The package builds from the project's own GitHub source using standard Node.js tooling; the variable-named package install (pnpm) refers to version pinning from the project's package.json, not an external untrusted package.

  • PKGBUILD:86 npm install -g "pnpm@${_pnpmver}" --prefix "${HOME}/.pnpm" \

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2pkgname=chatbox-git
3_pkgname=Chatbox
4pkgver=1.23.5.r0.g0ac6385
5_electronversion=35
6_nodeversion=22
7pkgrel=1
8pkgdesc="A desktop client for ChatGPT, Claude and other LLM."
9arch=('any')
10url="https://chatboxai.app/"
11_ghurl="https://github.com/chatboxai/chatbox"
12license=("GPL-3.0-or-later")
13conflicts=("${pkgname%-git}")
14provides=("${pkgname%-git}=${pkgver%.r*}")
15depends=(
16 "electron${_electronversion}"
17 'nodejs'
18)
19makedepends=(
20 'npm'
21 'git'
22 'nvm'
23 'gendesk'
24 'pnpm'
25 'jq'
26)
27optdepends=(
28 'ollama: Use your local Ollama model'
29)
30source=(
31 "${pkgname//-/.}::git+${_ghurl}.git"
32 "${pkgname%-git}.sh"
33)
34sha256sums=('SKIP'
35 'bd5358d8f323d3c2c2f0733364ee4ea55f551dd86ba0be2a76846210b60897fc')
36_get_project_dir() {
37 local d
38 while IFS= read -r d; do
39 find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
40 done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
41}
42pkgver() {
43 cd "$(_get_project_dir)"
44 set -o pipefail
45 git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
46 printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
47}
48_ensure_local_nvm() {
49 local NVM_DIR="${srcdir}/.nvm"
50 source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
51 nvm install "${_nodeversion}"
52 nvm use "${_nodeversion}"
53}
54_set_build_env() {
55 export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
56 export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
57 export ELECTRON_SKIP_BINARY_DOWNLOAD=1
58 export ELECTRON_BUILDER_OFFLINE=true
59 export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
60 export HOME="${srcdir}/.home"
61 export XDG_CACHE_HOME="${HOME}/.cache"
62 export XDG_CONFIG_HOME="${HOME}/.config"
63 export XDG_DATA_HOME="${HOME}/.local/share"
64 export XDG_STATE_HOME="${HOME}/.local/state"
65 export PNPM_HOME="${HOME}/.pnpm/bin"
66 export pnpm_config_cache_dir="${HOME}/.pnpm_cache"
67 export pnpm_config_store_dir="${HOME}/.pnpm_store"
68 export pnpm_config_global_dir="${HOME}/.pnpm/global"
69 export pnpm_config_state_dir="${HOME}/.pnpm/state"
70 export pnpm_config_node_linker=hoisted
71 export pnpm_config_minimum_release_age=0
72 export pnpm_config_update_notifier=false
73 export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
74 export COREPACK_HOME="${HOME}/.corepack"
75 mkdir -p "${HOME}" "${PNPM_HOME}" "${pnpm_config_cache_dir}" "${pnpm_config_store_dir}" "${pnpm_config_global_dir}" "${pnpm_config_state_dir}" "${COREPACK_HOME}"
76 export PATH="${PNPM_HOME}:${PATH}"
77 local _pnpmver=""
78 local _pkgjson="$(_get_project_dir)/package.json"
79 if [ -f "${_pkgjson}" ]; then
80 _pnpmver="$(grep -o '"packageManager"[^,]*' "${_pkgjson}" 2>/dev/null | grep -oE 'pnpm@[^"+]+' | head -n1 | sed 's/^pnpm@//')"
81 if [ -z "${_pnpmver}" ]; then
82 _pnpmver="$(grep -oE '"pnpm"[[:space:]]*:[[:space:]]*"[^"]+"' "${_pkgjson}" 2>/dev/null | grep -oE '[0-9][0-9.]*' | head -n1)"
83 fi
84 fi
85 if [ -n "${_pnpmver}" ]; then
86 npm install -g "pnpm@${_pnpmver}" --prefix "${HOME}/.pnpm" \
87 --registry "${COREPACK_NPM_REGISTRY}"
88 fi
89}
90_get_app_dir() {
91 find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1
92}
93_get_electron_version() {
94 _elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
95 | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
96 | grep -v '^$' | sed 's/^[^0-9]*//' | head -1)
97 [[ -z "${_elec_ver}" ]] && return 1
98 echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
99}
100prepare() {
101 cd "$(_get_project_dir)"
102 _get_electron_version
103 sed -i -e "
104 s/@electronversion@/${_electronversion}/g
105 s/@appname@/${pkgname%-git}/g
106 s/@runname@/app.asar/g
107 s/@cfgdirname@/xyz.${pkgname%-git}app.app/g
108 " "${srcdir}/${pkgname%-git}.sh"
109 gendesk -q -f -n \
110 --pkgname="${pkgname%-git}" \
111 --pkgdesc="${pkgdesc}" \
112 --categories="Utility" \
113 --name="${_pkgname}" \
114 --exec="${pkgname%-git} %U"
115 _set_build_env
116 _ensure_local_nvm
117 find src -type f -exec sed -i "s/process.resourcesPath/\"\/usr\/lib\/${pkgname%-git}\"/g" {} \;
118 sed -i "/UPDATE_CHANNEL/d" electron-builder.yml
119 sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g" package.json
120 export NODE_ENV=development
121 pnpm install
122}
123build() {
124 cd "$(_get_project_dir)"
125 _set_build_env
126 _ensure_local_nvm
127 export NODE_ENV=production
128 pnpm run build
129 pnpm -c exec "electron-builder --linux dir -c.electronDist=${ELECTRON_DIST} --config electron-builder.yml"
130 local _app_dir="$(_get_app_dir)"
131 rm -rf "${_app_dir}/resources/default_app.asar"
132 find "${_app_dir}/resources" -type d -exec chmod 755 {} +
133 case "${CARCH}" in
134 aarch64) _archrem=x64 ;;
135 x86_64) _archrem=arm ;;
136 esac
137 find "${_app_dir}/resources/app.asar.unpacked" -type d \
138 \( -name "darwin*" -o -name "win32*" -o -name "*${_archrem}"* \) \
139 -exec rm -rf {} +
140}
141package() {
142 install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
143 install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-git}"
144 local _app_dir="$(_get_app_dir)"
145 cp -a "${_app_dir}/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"
146 local _src="$(_get_project_dir)"
147 _icon_sizes=(16x16 24x24 32x32 48x48 64x64 128x128 256x256 512x512 1024x1024)
148 for _icons in "${_icon_sizes[@]}";do
149 install -Dm644 "${_src}/assets/icons/${_icons}.png" \
150 "${pkgdir}/usr/share/icons/hicolor/${_icons}/apps/${pkgname%-git}.png"
151 done
152 install -Dm644 "${_src}/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
153 install -Dm644 "${_src}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
154}
155

Changes since previous scan

--- PKGBUILD @ 2026-09-17 03:24
+++ PKGBUILD @ 2026-09-29 09:23
@@ -1,7 +1,7 @@
# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
pkgname=chatbox-git
_pkgname=Chatbox
-pkgver=1.23.3.r0.g0cf406c
+pkgver=1.23.5.r0.g0ac6385
_electronversion=35
_nodeversion=22
pkgrel=1
@@ -21,7 +21,7 @@
'git'
'nvm'
'gendesk'
- 'curl'
+ 'pnpm'
'jq'
)
optdepends=(
@@ -32,9 +32,15 @@
"${pkgname%-git}.sh"
)
sha256sums=('SKIP'
- 'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
+ 'bd5358d8f323d3c2c2f0733364ee4ea55f551dd86ba0be2a76846210b60897fc')
+_get_project_dir() {
+ local d
+ while IFS= read -r d; do
+ find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
+ done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
+}
pkgver() {
- cd "${srcdir}/${pkgname//-/.}"
+ cd "$(_get_project_dir)"
set -o pipefail
git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
@@ -49,43 +55,50 @@
export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
export ELECTRON_SKIP_BINARY_DOWNLOAD=1
- _ev="$(electron${_electronversion} -v)"
- export SYSTEM_ELECTRON_VERSION="${_ev#v}"
- export HOME="${srcdir}/.electron-gyp"
- mkdir -p "${HOME}"
- export XDG_CACHE_HOME="${srcdir}/.cache"
- export XDG_CONFIG_HOME="${srcdir}/.config"
- export XDG_DATA_HOME="${srcdir}/.local/share"
- export XDG_STATE_HOME="${srcdir}/.local/state"
- export PNPM_CACHE_DIR="${srcdir}/.pnpm_cache"
- export PNPM_STORE_DIR="${srcdir}/.pnpm_store"
- export PNPM_GLOBAL_DIR="${srcdir}/.pnpm/global"
- export PNPM_GLOBAL_BIN_DIR="${srcdir}/.pnpm/bin"
- export PNPM_STATE_DIR="${srcdir}/.pnpm/state"
- export PNPM_CONFIG_MINIMUM_RELEASE_AGE=0
- export PNPM_NODE_LINKER=hoisted
- export PNPM_FETCH_RETRIES=3
- export PNPM_FETCH_RETRY_MAXTIMEOUT=10000
- export PNPM_UPDATE_NOTIFIER=false
- export PNPM_NO_COLOR=true
- export PNPM_NO_PROGRESS=true
- export pnpm_config_platform=linux
- export pnpm_config_arch="${CARCH}"
- export COREPACK_HOME="${srcdir}/.corepack"
- export NODE_OPTIONS="--max-old-space-size=4096"
- export npm_config_node_options="--max-old-space-size=4096"
+ export ELECTRON_BUILDER_OFFLINE=true
+ export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
+ export HOME="${srcdir}/.home"
+ export XDG_CACHE_HOME="${HOME}/.cache"
+ export XDG_CONFIG_HOME="${HOME}/.config"
+ export XDG_DATA_HOME="${HOME}/.local/share"
+ export XDG_STATE_HOME="${HOME}/.local/state"
+ export PNPM_HOME="${HOME}/.pnpm/bin"
+ export pnpm_config_cache_dir="${HOME}/.pnpm_cache"
+ export pnpm_config_store_dir="${HOME}/.pnpm_store"
+ export pnpm_config_global_dir="${HOME}/.pnpm/global"
+ export pnpm_config_state_dir="${HOME}/.pnpm/state"
+ export pnpm_config_node_linker=hoisted
+ export pnpm_config_minimum_release_age=0
+ export pnpm_config_update_notifier=false
+ export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
+ export COREPACK_HOME="${HOME}/.corepack"
+ mkdir -p "${HOME}" "${PNPM_HOME}" "${pnpm_config_cache_dir}" "${pnpm_config_store_dir}" "${pnpm_config_global_dir}" "${pnpm_config_state_dir}" "${COREPACK_HOME}"
+ export PATH="${PNPM_HOME}:${PATH}"
+ local _pnpmver=""
+ local _pkgjson="$(_get_project_dir)/package.json"
+ if [ -f "${_pkgjson}" ]; then
+ _pnpmver="$(grep -o '"packageManager"[^,]*' "${_pkgjson}" 2>/dev/null | grep -oE 'pnpm@[^"+]+' | head -n1 | sed 's/^pnpm@//')"
+ if [ -z "${_pnpmver}" ]; then
+ _pnpmver="$(grep -oE '"pnpm"[[:space:]]*:[[:space:]]*"[^"]+"' "${_pkgjson}" 2>/dev/null | grep -oE '[0-9][0-9.]*' | head -n1)"
+ fi
+ fi
+ if [ -n "${_pnpmver}" ]; then
+ npm install -g "pnpm@${_pnpmver}" --prefix "${HOME}/.pnpm" \
+ --registry "${COREPACK_NPM_REGISTRY}"
+ fi
}
_get_app_dir() {
find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1
}
_get_electron_version() {
- _elec_ver=$(find "${srcdir}" -maxdepth 5 -name "package.json" ! -path "*/node_modules/*" \
- -exec grep -l '"electron"' {} + | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null | head -1)
- [[ -z "${_elec_ver}" ]] && return 1
- echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
+ _elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
+ | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
+ | grep -v '^$' | sed 's/^[^0-9]*//' | head -1)
+ [[ -z "${_elec_ver}" ]] && return 1
+ echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
}
prepare() {
- cd "${srcdir}/${pkgname//-/.}"
+ cd "$(_get_project_dir)"
_get_electron_version
sed -i -e "
s/@electronversion@/${_electronversion}/g
@@ -104,40 +117,39 @@
find src -type f -exec sed -i "s/process.resourcesPath/\"\/usr\/lib\/${pkgname%-git}\"/g" {} \;
sed -i "/UPDATE_CHANNEL/d" electron-builder.yml
sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g" package.json
- NODE_ENV=development pnpm install
+ export NODE_ENV=development
+ pnpm install
}
build() {
- cd "${srcdir}/${pkgname//-/.}"
+ cd "$(_get_project_dir)"
_set_build_env
_ensure_local_nvm
- NODE_ENV=production pnpm run build
- NODE_ENV=production pnpm -c exec "electron-builder --linux dir -c.electronDist=${ELECTRON_DIST} --config electron-builder.yml"
- local _app_dir=$(_get_app_dir)
+ export NODE_ENV=production
+ pnpm run build
+ pnpm -c exec "electron-builder --linux dir -c.electronDist=${ELECTRON_DIST} --config electron-builder.yml"
+ local _app_dir="$(_get_app_dir)"
rm -rf "${_app_dir}/resources/default_app.asar"
- case "${CARCH}" in
- aarch64)
- rm -rf \
- "${_app_dir}/resources/app.asar.unpacked/node_modules/@anthropic-ai/sandbox-runtime/dist/vendor/seccomp/x64" \
- "${_app_dir}/resources/app.asar.unpacked/node_modules/@anthropic-ai/sandbox-runtime/vendor/seccomp/x64"
- ;;
- x86_64)
- rm -rf \
- "${_app_dir}/resources/app.asar.unpacked/node_modules/@anthropic-ai/sandbox-runtime/dist/vendor/seccomp/arm64" \
- "${_app_dir}/resources/app.asar.unpacked/node_modules/@anthropic-ai/sandbox-runtime/vendor/seccomp/arm64"
- ;;
- esac
+ find "${_app_dir}/resources" -type d -exec chmod 755 {} +
+ case "${CARCH}" in
+ aarch64) _archrem=x64 ;;
+ x86_64) _archrem=arm ;;
+ esac
+ find "${_app_dir}/resources/app.asar.unpacked" -type d \
+ \( -name "darwin*" -o -name "win32*" -o -name "*${_archrem}"* \) \
+ -exec rm -rf {} +
}
package() {
install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-git}"
- local _app_dir=$(_get_app_dir)
+ local _app_dir="$(_get_app_dir)"
cp -a "${_app_dir}/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"
+ local _src="$(_get_project_dir)"
_icon_sizes=(16x16 24x24 32x32 48x48 64x64 128x128 256x256 512x512 1024x1024)
for _icons in "${_icon_sizes[@]}";do
- install -Dm644 "${srcdir}/${pkgname//-/.}/assets/icons/${_icons}.png" \
+ install -Dm644 "${_src}/assets/icons/${_icons}.png" \
"${pkgdir}/usr/share/icons/hicolor/${_icons}/apps/${pkgname%-git}.png"
done
- install -Dm644 "${srcdir}/${pkgname//-/.}/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
- install -Dm644 "${srcdir}/${pkgname//-/.}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
+ install -Dm644 "${_src}/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
+ install -Dm644 "${_src}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
}

Scan history

Scanned at (UTC)SeverityRules
2026-09-29 09:23:18 Low 1
2026-09-17 03:24:22 Clean 0
2026-07-29 01:40:32 Clean 0
2026-06-26 04:24:37 Clean 0
2026-06-18 16:11:54 Clean 0

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion