chunksize-checker-git

MEDIUM
maintainer zxp19821005 0 votes scanned 2026-11-02 18:02:51.835640
View on AUR
Why flagged

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

Triggered rules

Medium npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

  • PKGBUILD:105 npm add yauzl

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2pkgname=chunksize-checker-git
3_pkgname='ChunkSize Checker'
4pkgver=0.0.5.r5.g44d12a8
5_electronversion=45
6_nodeversion=24
7pkgrel=1
8pkgdesc="Calculate the number of total tokens, optimal chunk size and chunk overlap from any given document."
9arch=('any')
10url="https://github.com/yuma-shintani/chunksize-checker"
11license=('MIT')
12conflicts=("${pkgname%-git}")
13provides=("${pkgname%-git}=${pkgver%.r*}")
14depends=(
15 "electron${_electronversion}"
16)
17makedepends=(
18 'gendesk'
19 'npm'
20 'nvm'
21 'git'
22 'jq'
23)
24source=(
25 "${pkgname%-git}.git::git+${url}"
26 "${pkgname%-git}.js"
27 "${pkgname%-git}.sh"
28)
29sha256sums=('SKIP'
30 '562897be8a17076176f8d985c0d7bc1c685f2e7c9b3a932339ce015963243627'
31 'ace275e253744ca62d2572776df26b947f3c89616239985003126db635fc300e')
32_get_project_dir() {
33 local d
34 while IFS= read -r d; do
35 find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
36 done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
37}
38pkgver() {
39 cd "$(_get_project_dir)"
40 set -o pipefail
41 git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
42 printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
43}
44_ensure_local_nvm() {
45 local NVM_DIR="${srcdir}/.nvm"
46 source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
47 nvm install "${_nodeversion}"
48 nvm use "${_nodeversion}"
49}
50_get_app_dir() {
51 find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -printf '%h\n' 2>/dev/null \
52 | while read -r d; do [[ -d "${d}/resources" ]] && { echo "$d"; return 0; }; done
53}
54_get_electron_version() {
55 _elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
56 | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
57 | grep -oE '[0-9]+' | head -1)
58 [[ -z "${_elec_ver}" ]] && return 1
59 (( _elec_ver == _electronversion )) && c=32 || c=31
60 echo -e "Electron version: \033[1;${c}m${_elec_ver}$([[ $c -eq 31 ]] && echo " (expected ${_electronversion})")\033[0m"
61}
62_set_electron_build_env() {
63 export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
64 export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
65 export ELECTRON_SKIP_BINARY_DOWNLOAD=1
66 export ELECTRON_BUILDER_OFFLINE=true
67 export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
68}
69_set_npm_build_env() {
70 export HOME="${srcdir}/.home"
71 export XDG_CACHE_HOME="${HOME}/.cache"
72 export XDG_CONFIG_HOME="${HOME}/.config"
73 export XDG_DATA_HOME="${HOME}/.local/share"
74 export npm_config_cache="${HOME}/.npm_cache"
75 export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
76 export COREPACK_HOME="${HOME}/.corepack"
77 export npm_config_audit=false
78 export npm_config_registry="${NPM_CONFIG_REGISTRY:-${npm_config_registry:-https://registry.npmjs.org}}"
79 mkdir -p "${HOME}" "${npm_config_cache}" "${COREPACK_HOME}"
80}
81prepare() {
82 cd "$(_get_project_dir)"
83 _get_electron_version
84 sed -i -e "
85 s/@electronversion@/${_electronversion}/g
86 s/@appname@/${pkgname%-git}/g
87 " "${srcdir}/${pkgname%-git}.sh" "${srcdir}/${pkgname%-git}.js"
88 gendesk -q -f -n \
89 --pkgname="${pkgname%-git}" \
90 --pkgdesc="${pkgdesc}" \
91 --categories="Development" \
92 --name="${_pkgname}" \
93 --exec="${pkgname%-git} %U"
94 _ensure_local_nvm
95 _set_electron_build_env
96 _set_npm_build_env
97 sed -i -e "
98 s/const mainWindow/mainWindow/g
99 s/..\/..\/build\/icon.ico/.\/icon.png/g
100 /process.platform ===/d
101 " src/main/index.js
102 jq --arg ver "${SYSTEM_ELECTRON_VERSION}" '.devDependencies.electron = $ver' package.json > package.json.tmp && mv package.json.tmp package.json
103 export NODE_ENV=development
104 npm install
105 npm add yauzl
106}
107build() {
108 cd "$(_get_project_dir)"
109 _ensure_local_nvm
110 _set_electron_build_env
111 _set_npm_build_env
112 export NODE_ENV=production
113 npm run build
114 npm exec -c "electron-builder --linux dir -c.electronDist=${ELECTRON_DIST} --config electron-builder.yml"
115 rm -rf "$(_get_app_dir)/resources/default_app.asar"
116}
117package() {
118 install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
119 install -Dm644 "${srcdir}/${pkgname%-git}.js" -t "${pkgdir}/usr/lib/${pkgname%-git}"
120 cp -a "$(_get_app_dir)/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"
121 install -Dm644 "$(_get_project_dir)/build/icon.png" -t "${pkgdir}/usr/lib/${pkgname%-git}"
122 install -Dm644 "$(_get_project_dir)/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
123 install -Dm644 "$(_get_project_dir)/build/icon.png" "${pkgdir}/usr/share/icons/512x512/apps/${pkgname%-git}.png"
124 install -Dm644 "$(_get_project_dir)/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
125}
126

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-11-02 18:02
@@ -1,11 +1,11 @@
# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
pkgname=chunksize-checker-git
_pkgname='ChunkSize Checker'
-pkgver=0.0.2.r0.gb11a64d
-_electronversion=31
-_nodeversion=20
+pkgver=0.0.5.r5.g44d12a8
+_electronversion=45
+_nodeversion=24
pkgrel=1
-pkgdesc="Calculate the number of total tokens, optimal chunk size and chunk overlap from any given document.(Use system-wide electron)"
+pkgdesc="Calculate the number of total tokens, optimal chunk size and chunk overlap from any given document."
arch=('any')
url="https://github.com/yuma-shintani/chunksize-checker"
license=('MIT')
@@ -19,78 +19,108 @@
'npm'
'nvm'
'git'
- 'curl'
+ 'jq'
)
source=(
"${pkgname%-git}.git::git+${url}"
+ "${pkgname%-git}.js"
"${pkgname%-git}.sh"
)
sha256sums=('SKIP'
- '291f50480f5a61bc9c68db7d44cd0412071128706baa868a9cb854f8779a1980')
+ '562897be8a17076176f8d985c0d7bc1c685f2e7c9b3a932339ce015963243627'
+ 'ace275e253744ca62d2572776df26b947f3c89616239985003126db635fc300e')
+_get_project_dir() {
+ local d
+ while IFS= read -r d; do
+ find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
+ done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
+}
pkgver() {
- cd "${srcdir}/${pkgname%-git}.git"
- set -o pipefail
- git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
- printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
+ cd "$(_get_project_dir)"
+ set -o pipefail
+ git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
+ printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
}
_ensure_local_nvm() {
- local NVM_DIR="${srcdir}/.nvm"
- source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
- nvm install "${_nodeversion}"
- nvm use "${_nodeversion}"
+ local NVM_DIR="${srcdir}/.nvm"
+ source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
+ nvm install "${_nodeversion}"
+ nvm use "${_nodeversion}"
+}
+_get_app_dir() {
+ find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -printf '%h\n' 2>/dev/null \
+ | while read -r d; do [[ -d "${d}/resources" ]] && { echo "$d"; return 0; }; done
+}
+_get_electron_version() {
+ _elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
+ | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
+ | grep -oE '[0-9]+' | head -1)
+ [[ -z "${_elec_ver}" ]] && return 1
+ (( _elec_ver == _electronversion )) && c=32 || c=31
+ echo -e "Electron version: \033[1;${c}m${_elec_ver}$([[ $c -eq 31 ]] && echo " (expected ${_electronversion})")\033[0m"
+}
+_set_electron_build_env() {
+ export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
+ export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
+ export ELECTRON_SKIP_BINARY_DOWNLOAD=1
+ export ELECTRON_BUILDER_OFFLINE=true
+ export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
+}
+_set_npm_build_env() {
+ export HOME="${srcdir}/.home"
+ export XDG_CACHE_HOME="${HOME}/.cache"
+ export XDG_CONFIG_HOME="${HOME}/.config"
+ export XDG_DATA_HOME="${HOME}/.local/share"
+ export npm_config_cache="${HOME}/.npm_cache"
+ export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
+ export COREPACK_HOME="${HOME}/.corepack"
+ export npm_config_audit=false
+ export npm_config_registry="${NPM_CONFIG_REGISTRY:-${npm_config_registry:-https://registry.npmjs.org}}"
+ mkdir -p "${HOME}" "${npm_config_cache}" "${COREPACK_HOME}"
}
prepare() {
- cd "${srcdir}/${pkgname%-git}.git"
+ cd "$(_get_project_dir)"
+ _get_electron_version
sed -i -e "
s/@electronversion@/${_electronversion}/g
s/@appname@/${pkgname%-git}/g
- s/@runname@/app.asar/g
- s/@cfgdirname@/${pkgname%-git}/g
- s/@options@/env ELECTRON_OZONE_PLATFORM_HINT=auto/g
- " "${srcdir}/${pkgname%-git}.sh"
- _ensure_local_nvm
+ " "${srcdir}/${pkgname%-git}.sh" "${srcdir}/${pkgname%-git}.js"
gendesk -q -f -n \
--pkgname="${pkgname%-git}" \
--pkgdesc="${pkgdesc}" \
--categories="Development" \
--name="${_pkgname}" \
--exec="${pkgname%-git} %U"
- export ELECTRON_SKIP_BINARY_DOWNLOAD=1
- export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/v//g')"
- HOME="${srcdir}/.electron-gyp"
- {
- echo -e '\n'
- #echo 'build_from_source=true'
- echo "cache=${srcdir}/.npm_cache"
- echo "maxsockets=10"
- } >> .npmrc
- if [[ "$(curl -s ipinfo.io/country)" == *"CN"* ]]; then
- {
- echo 'registry=https://registry.npmmirror.com'
- echo 'electron_mirror=https://registry.npmmirror.com/-/binary/electron/'
- echo 'electron_builder_binaries_mirror=https://registry.npmmirror.com/-/binary/electron-builder-binaries/'
- } >> .npmrc
- find ./ -type f -name "package-lock.json" -exec sed -i "s/registry.npmjs.org/registry.npmmirror.com/g" {} +
- fi
+ _ensure_local_nvm
+ _set_electron_build_env
+ _set_npm_build_env
sed -i -e "
s/const mainWindow/mainWindow/g
s/..\/..\/build\/icon.ico/.\/icon.png/g
/process.platform ===/d
" src/main/index.js
- sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g" package.json
- NODE_ENV=development npm install
+ jq --arg ver "${SYSTEM_ELECTRON_VERSION}" '.devDependencies.electron = $ver' package.json > package.json.tmp && mv package.json.tmp package.json
+ export NODE_ENV=development
+ npm install
+ npm add yauzl
}
build() {
- cd "${srcdir}/${pkgname%-git}.git"
- local electronDist="/usr/lib/electron${_electronversion}"
- NODE_ENV=production npm run build
- NODE_ENV=production npm exec -c "electron-builder --linux dir -c.electronDist=${electronDist} --config electron-builder.yml"
+ cd "$(_get_project_dir)"
+ _ensure_local_nvm
+ _set_electron_build_env
+ _set_npm_build_env
+ export NODE_ENV=production
+ npm run build
+ npm exec -c "electron-builder --linux dir -c.electronDist=${ELECTRON_DIST} --config electron-builder.yml"
+ rm -rf "$(_get_app_dir)/resources/default_app.asar"
}
package() {
install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
- install -Dm644 "${srcdir}/${pkgname%-git}.git/dist/linux-"*/resources/app.asar -t "${pkgdir}/usr/lib/${pkgname%-git}"
- install -Dm644 "${srcdir}/${pkgname%-git}.git/build/icon.png" -t "${pkgdir}/usr/lib/${pkgname%-git}"
- install -Dm644 "${srcdir}/${pkgname%-git}.git/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
- install -Dm644 "${srcdir}/${pkgname%-git}.git/build/icon.png" "${pkgdir}/usr/share/pixmaps/${pkgname%-git}.png"
- install -Dm644 "${srcdir}/${pkgname%-git}.git/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
+ install -Dm644 "${srcdir}/${pkgname%-git}.js" -t "${pkgdir}/usr/lib/${pkgname%-git}"
+ cp -a "$(_get_app_dir)/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"
+ install -Dm644 "$(_get_project_dir)/build/icon.png" -t "${pkgdir}/usr/lib/${pkgname%-git}"
+ install -Dm644 "$(_get_project_dir)/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
+ install -Dm644 "$(_get_project_dir)/build/icon.png" "${pkgdir}/usr/share/icons/512x512/apps/${pkgname%-git}.png"
+ install -Dm644 "$(_get_project_dir)/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
}
+

Scan history

Scanned at (UTC)SeverityRules
2026-11-02 18:02:51 Medium 1
2026-06-18 16:11:54 Clean 0

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion