citronote-git
LOW
maintainer zxp19821005
0 votes
scanned 2026-10-17 00:21:55.226236
Why flagged
The package builds from the project's own Git repository, uses standard npm/electron tooling, and installs only project files; the low severity is due to unverifiable source (SKIP'd checksum) and few votes, but no malicious behavior is present.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Low
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from the project's own Git repository, uses standard npm/electron tooling, and installs only project files; the low severity is due to unverifiable source (SKIP'd checksum) and few votes, but no malicious behavior is present.
PKGBUILD
1
# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2
pkgname=citronote-git
3
_pkgname=Citronote
4
pkgver=2.0.6.r0.gf099fe7
5
_electronversion=39
6
_nodeversion=22
7
pkgrel=1
8
pkgdesc="Note-taking app with many features compatible with Markdown."
9
arch=('any')
10
url="https://github.com/citronote/citronote"
11
license=('MIT')
12
depends=(
13
"electron${_electronversion}-bin"
14
)
15
makedepends=(
16
'npm'
17
'nvm'
18
'git'
19
'jq'
20
'gendesk'
21
)
22
source=(
23
"${pkgname//-/.}::git+${url}.git"
24
"${pkgname%-git}.sh"
25
)
26
sha256sums=('SKIP'
27
'dfcd6603d29c7b8d88e019b517a2e5c1a7b5ab905a0961a8b81adfa508b258b8')
28
_get_project_dir() {
29
local d
30
while IFS= read -r d; do
31
find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
32
done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
33
}
34
pkgver() {
35
cd "$(_get_project_dir)"
36
set -o pipefail
37
git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
38
printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
39
}
40
_ensure_local_nvm() {
41
local NVM_DIR="${srcdir}/.nvm"
42
source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
43
nvm install "${_nodeversion}"
44
nvm use "${_nodeversion}"
45
}
46
_get_app_dir() {
47
find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -print 2>/dev/null | while read f; do [ -d "${f%/*}/resources" ] && echo "${f%/*}" && break; done
48
}
49
_get_electron_version() {
50
_elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
51
| xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
52
| grep -oE '[0-9]+' | head -1)
53
[[ -z "${_elec_ver}" ]] && return 1
54
(( _elec_ver == _electronversion )) && c=32 || c=31
55
echo -e "Electron version: \033[1;${c}m${_elec_ver}$([[ $c -eq 31 ]] && echo " (expected ${_electronversion})")\033[0m"
56
}
57
_set_build_env() {
58
export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
59
export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
60
export ELECTRON_SKIP_BINARY_DOWNLOAD=1
61
export ELECTRON_BUILDER_OFFLINE=true
62
export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
63
export HOME="${srcdir}/.home"
64
export XDG_CACHE_HOME="${HOME}/.cache"
65
export XDG_CONFIG_HOME="${HOME}/.config"
66
export XDG_DATA_HOME="${HOME}/.local/share"
67
export npm_config_cache="${HOME}/.npm_cache"
68
export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
69
export COREPACK_HOME="${HOME}/.corepack"
70
export npm_config_audit=false
71
export npm_config_registry="${NPM_CONFIG_REGISTRY:-${npm_config_registry:-https://registry.npmjs.org}}"
72
mkdir -p "${HOME}" "${npm_config_cache}" "${COREPACK_HOME}"
73
}
74
prepare() {
75
cd "$(_get_project_dir)"
76
_get_electron_version
77
sed -i -e "
78
s/@electronversion@/${_electronversion}/g
79
s/@appname@/${pkgname%-git}/g
80
" -i "${srcdir}/${pkgname%-git}.sh"
81
gendesk -q -f -n \
82
--pkgname="${pkgname%-git}" \
83
--pkgdesc="${pkgdesc}" \
84
--categories="Utility" \
85
--name="${_pkgname}" \
86
--exec="${pkgname%-git} %U"
87
_ensure_local_nvm
88
_set_build_env
89
jq --arg ver "${SYSTEM_ELECTRON_VERSION}" '.devDependencies.electron = $ver' package.json > package.json.tmp && mv package.json.tmp package.json
90
sed -i "s/..\/..\/locales/..\/locales/g" src/main/index.js
91
export NODE_ENV=development
92
npm install --legacy-peer-deps
93
}
94
build() {
95
cd "$(_get_project_dir)"
96
_ensure_local_nvm
97
_set_build_env
98
export NODE_ENV=production
99
npm run build
100
npm exec -c "electron-builder --linux dir -c.electronDist=${ELECTRON_DIST} --config electron-builder.yml"
101
}
102
package() {
103
install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
104
install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-git}"
105
rm -rf "$(_get_app_dir)/resources/default_app.asar"
106
cp -a "$(_get_app_dir)/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"
107
install -Dm644 "$(_get_project_dir)/build/icon.png" "${pkgdir}/usr/share/icons/hicolor/512x512/apps/${pkgname%-git}.png"
108
install -Dm644 "$(_get_project_dir)/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
109
install -Dm644 "$(_get_project_dir)/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
110
}
111
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |
| 2026-10-14 00:06:47 | Low | 2 |
| 2026-10-13 11:16:23 | Low | 2 |