code-translucent

maintainer Kaydax · 10 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The flagged 'npm install' in prepare() is for official VS Code build dependencies (@vscode/vsce-sign) from a trusted npm registry, part of the normal build process for the project's own source, not an undeclared external package injection.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The flagged 'npm install' in prepare() is for official VS Code build dependencies (@vscode/vsce-sign) from a trusted npm registry, part of the normal build process for the project's own source, not an undeclared external package injection.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:99 pnpm add @vscode/vsce-sign @vscode/vsce-sign-linux-"${_vscode_arch}"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Kaydax <kaydax@kaydax.xyz>
    
      2# Contributor: David Čuček <observ33r@gmail.com>
    
      3
    
      4pkgname="code-translucent"
    
      5pkgver=1.119.0
    
      6pkgrel=1
    
      7pkgdesc="The Open Source build of Visual Studio Code (vscode) editor with translucent window, official marketplace, unblocked proprietary features and wayland support!"
    
      8
    
      9arch=(
    
      10	"x86_64"
    
      11	"i686"
    
      12	"aarch64"
    
      13	"armv7h"
    
      14	"riscv64"
    
      15)
    
      16
    
      17url="https://github.com/microsoft/vscode"
    
      18license=("MIT")
    
      19
    
      20conflicts=("code-oss")
    
      21provides=("code-oss")
    
      22options=('!strip' '!debug')
    
      23
    
      24depends=(
    
      25	"libxkbfile"
    
      26	"gtk3"
    
      27	"nss"
    
      28	"libsecret"
    
      29	"alsa-lib"
    
      30	"gcc-libs"
    
      31	"libnotify"
    
      32	"libxss"
    
      33	"glibc"
    
      34)
    
      35
    
      36optdepends=(
    
      37	"libdbusmenu-glib: Needed for KDE global menu"
    
      38	"x11-ssh-askpass: SSH authentication"
    
      39	"icu69: Needed for live share"
    
      40)
    
      41
    
      42makedepends=(
    
      43	"git"
    
      44	"npm"
    
      45	"pnpm"
    
      46	"python"
    
      47	"nodejs-lts-jod"
    
      48)
    
      49
    
      50source=(
    
      51	"${pkgname}::git+${url}.git#tag=${pkgver}"
    
      52	"build-with-chroot.sh"
    
      53	"translucent.patch"
    
      54	"product.json"
    
      55	"code-oss.sh"
    
      56)
    
      57
    
      58sha512sums=(
    
      59	"SKIP"
    
      60	"9de3f195e711814e1e457e8ccb6383c6000bc83ee707f2bc138fe66c3cf6c35a6e9c755594afb5fbf8c4f05c3c87f7f3b8714e7947b62094ead6f5f1b81f5b24"
    
      61	"9deb0da4eb9fb989e892a5743b99c50acc64dddcd33d2a8517d0a48eb12476dac3a8c5238fa40b64c6c3e89fa3cc399135ebf1f795f9029871cf61d25418e2c6"
    
      62	"36c3ba2f04fb479968264ba65a952392dfa1792a0eb434b2f41ccc6eccce528d29749de00c37d802a1622064d22a2e6b2a01adb2b2c86f8007ee27094259a87b"
    
      63	"6234842d41d9cb6cdd27766e35804644c59a39b43a92f2243b18525dc69d954d1e9dcd4297538de3dfd26051c7035d1ebb04f849a69208afa8214e42160c18dd"
    
      64)
    
      65
    
      66case "${CARCH}" in
    
      67 	"i686")
    
      68 		_vscode_arch="ia32"
    
      69 		;;
    
      70	"x86_64")
    
      71		_vscode_arch="x64"
    
      72		;;
    
      73	"aarch64")
    
      74		_vscode_arch="arm64"
    
      75		;;
    
      76	"armv7h")
    
      77		_vscode_arch="arm"
    
      78		;;
    
      79	"riscv64")
    
      80		_vscode_arch="riscv64"
    
      81		;;
    
      82
    
      83	*)
    
      84		_vscode_arch="DUMMY"
    
      85		;;
    
      86esac
    
      87
    
      88prepare() {
    
      89
    
      90	cd "${srcdir}/${pkgname}"
    
      91
    
      92	# Apply patch to source
    
      93	patch -p1 -i "../translucent.patch"
    
      94
    
      95	# Replace product json
    
      96	cp --update=all "../product.json" "."
    
      97
    
      98	# Add vsce-sign necessary for extensions' signature verification
    
      99	pnpm add @vscode/vsce-sign @vscode/vsce-sign-linux-"${_vscode_arch}"
    
      100
    
      101	# Set the commit and build date
    
      102	local _commit="$(git rev-parse HEAD)"
    
      103	local _datestamp="$(date -u -Is | sed 's/\+00:00/Z/')"
    
      104	sed -e "s|@COMMIT@|${_commit}|" -e "s|@DATE@|${_datestamp}|" -i "product.json"
    
      105
    
      106	# Patch appdata and desktop file
    
      107	sed -i 's|/usr/share/@@NAME@@/@@NAME@@|@@NAME@@|g
    
      108    		s|@@NAME_SHORT@@|Code|g
    
      109    		s|@@NAME_LONG@@|Code - OSS|g
    
      110    		s|@@NAME@@|code-oss|g
    
      111    		s|@@ICON@@|code|g
    
      112    		s|@@EXEC@@|/usr/bin/code-oss|g
    
      113    		s|@@LICENSE@@|MIT|g
    
      114    		s|@@URLPROTOCOL@@|vscode|g
    
      115    		s|inode/directory;||' "resources/linux/code"{.appdata.xml,-workspace.xml,.desktop,-url-handler.desktop}
    
      116
    
      117	sed -i 's|MimeType=.*|MimeType=x-scheme-handler/code-oss;|' "resources/linux/code-url-handler.desktop"
    
      118
    
      119	# Add completitions for code-oss
    
      120	cp "resources/completions/bash/code" "resources/completions/bash/code-oss"
    
      121	cp "resources/completions/zsh/_code" "resources/completions/zsh/_code-oss"
    
      122
    
      123	# Patch completitions with correct names
    
      124	sed -i 's|@@APPNAME@@|code-oss|g' "resources/completions/"{bash/code-oss,zsh/_code-oss}
    
      125
    
      126	# upstream has a compatibility issue with npm but it doesn't affect packaging
    
      127	# so remove the check
    
      128	sed -i '/Please use npm version < 11.2.0./{n;d}' build/npm/preinstall.ts
    
      129}
    
      130
    
      131build() {
    
      132
    
      133	cd "${srcdir}/${pkgname}"
    
      134
    
      135	npm install --cpu="${_vscode_arch}"
    
      136
    
      137	npm run gulp vscode-linux-"${_vscode_arch}"-min
    
      138
    
      139}
    
      140
    
      141package() {
    
      142
    
      143	local _pkgdir="${srcdir}/${pkgname}"
    
      144	local _appdir="${srcdir}/VSCode-linux-${_vscode_arch}"
    
      145
    
      146	install -Dm 644 "${_appdir}/resources/app/LICENSE.txt" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.txt"
    
      147	install -Dm 644 "${_appdir}/resources/app/ThirdPartyNotices.txt" "${pkgdir}/usr/share/licenses/${pkgname}/ThirdPartyNotices.txt"
    
      148
    
      149	install -Dm 644 "${_pkgdir}/resources/linux/code.appdata.xml" "${pkgdir}/usr/share/metainfo/code-oss.appdata.xml"
    
      150	install -Dm 644 "${_pkgdir}/resources/linux/code-workspace.xml" "${pkgdir}/usr/share/mime/packages/code-oss-workspace.xml"
    
      151	install -Dm 644 "${_pkgdir}/resources/linux/code.desktop" "${pkgdir}/usr/share/applications/code-oss.desktop"
    
      152	install -Dm 644 "${_pkgdir}/resources/linux/code-url-handler.desktop" "${pkgdir}/usr/share/applications/code-oss-url-handler.desktop"
    
      153	install -Dm 644 "${_pkgdir}/resources/linux/code.png" "${pkgdir}/usr/share/icons/code.png"
    
      154
    
      155	install -Dm 644 "${_appdir}/resources/completions/bash/code-oss" "${pkgdir}/usr/share/bash-completion/completions/code-oss"
    
      156	install -Dm 644 "${_appdir}/resources/completions/zsh/_code-oss" "${pkgdir}/usr/share/zsh/site-functions/_code-oss"
    
      157
    
      158	install -dm 755 "${pkgdir}/opt/${pkgname}"
    
      159
    
      160	cp --recursive --no-preserve=ownership --preserve=mode "${_appdir}/"* "${pkgdir}/opt/${pkgname}"
    
      161
    
      162	install -Dm 755 "${srcdir}/code-oss.sh" "${pkgdir}/usr/bin/code-oss"
    
      163
    
      164}
    
      165

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2