crankshaft-client-git

LOW
maintainer zxp19821005 0 votes scanned 2026-10-07 14:05:47.471701
View on AUR
Why flagged

The package installs a specific version of pnpm from npm based on the project's package.json, which is a normal part of building Node.js applications and not inherently dangerous.

Triggered rules

Low AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it LOW (confidence 95%): The package installs a specific version of pnpm from npm based on the project's package.json, which is a normal part of building Node.js applications and not inherently dangerous.

  • PKGBUILD:77 npm install -g "pnpm@${_pnpmver}" --prefix "${HOME}/.pnpm" \

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2_pkgname=crankshaft
3pkgname="${_pkgname}-client-git"
4_appname=Crankshaft-Client
5pkgver=2.0.2.r1.g297b6c5
6_electronversion=44
7_nodeversion=24
8pkgrel=1
9pkgdesc="A fast, feature-rich krunker client written in typescript."
10arch=('any')
11url="https://github.com/KraXen72/crankshaft"
12license=('GPL-3.0-only')
13provides=("${pkgname%-git}=${pkgver%.r*}")
14conflicts=("${pkgname%-git}")
15depends=(
16 "electron${_electronversion}"
17)
18makedepends=(
19 'pnpm'
20 'nvm'
21 'git'
22 'jq'
23 'zip'
24)
25source=(
26 "${pkgname%-git}.git::git+${url}.git"
27 "${pkgname%-git}.desktop"
28 "${pkgname%-git}.sh"
29)
30sha256sums=('SKIP'
31 '5c2cbe48a63fd1b62c0d33a086219ff14e6ac4607929acaa398780f9da1bfc0d'
32 'bd5358d8f323d3c2c2f0733364ee4ea55f551dd86ba0be2a76846210b60897fc')
33_get_project_dir() {
34 local d
35 while IFS= read -r d; do
36 find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
37 done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
38}
39pkgver() {
40 cd "$(_get_project_dir)"
41 set -o pipefail
42 git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
43 printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
44}
45_set_build_env() {
46 export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
47 export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
48 export ELECTRON_SKIP_BINARY_DOWNLOAD=1
49 export ELECTRON_BUILDER_OFFLINE=true
50 export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
51 export HOME="${srcdir}/.home"
52 export XDG_CACHE_HOME="${HOME}/.cache"
53 export XDG_CONFIG_HOME="${HOME}/.config"
54 export XDG_DATA_HOME="${HOME}/.local/share"
55 export XDG_STATE_HOME="${HOME}/.local/state"
56 export PNPM_HOME="${HOME}/.pnpm/bin"
57 export pnpm_config_cache_dir="${HOME}/.pnpm_cache"
58 export pnpm_config_store_dir="${HOME}/.pnpm_store"
59 export pnpm_config_global_dir="${HOME}/.pnpm/global"
60 export pnpm_config_state_dir="${HOME}/.pnpm/state"
61 export pnpm_config_node_linker=hoisted
62 export pnpm_config_minimum_release_age=0
63 export pnpm_config_update_notifier=false
64 export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
65 export COREPACK_HOME="${HOME}/.corepack"
66 mkdir -p "${HOME}" "${PNPM_HOME}" "${pnpm_config_cache_dir}" "${pnpm_config_store_dir}" "${pnpm_config_global_dir}" "${pnpm_config_state_dir}" "${COREPACK_HOME}"
67 export PATH="${PNPM_HOME}:${PATH}"
68 local _pnpmver=""
69 local _pkgjson="$(_get_project_dir)/package.json"
70 if [ -f "${_pkgjson}" ]; then
71 _pnpmver="$(grep -o '"packageManager"[^,]*' "${_pkgjson}" 2>/dev/null | grep -oE 'pnpm@[^"+]+' | head -n1 | sed 's/^pnpm@//')"
72 if [ -z "${_pnpmver}" ]; then
73 _pnpmver="$(grep -oE '"pnpm"[[:space:]]*:[[:space:]]*"[^"]+"' "${_pkgjson}" 2>/dev/null | grep -oE '[0-9][0-9.]*' | head -n1)"
74 fi
75 fi
76 if [ -n "${_pnpmver}" ]; then
77 npm install -g "pnpm@${_pnpmver}" --prefix "${HOME}/.pnpm" \
78 --registry "${COREPACK_NPM_REGISTRY}"
79 fi
80}
81_ensure_local_nvm() {
82 export NVM_DIR="${srcdir}/.nvm"
83 source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
84 nvm install "${_nodeversion}"
85 nvm use "${_nodeversion}"
86}
87_get_app_dir() {
88 find "${srcdir}" -type f -name "resources.pak" -print 2>/dev/null | while read f; do [ -d "${f%/*}/resources" ] && echo "${f%/*}" && break; done
89}
90_get_electron_version() {
91 _elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
92 | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
93 | grep -v '^$' | sed 's/^[^0-9]*//' | head -1)
94 [[ -z "${_elec_ver}" ]] && return 1
95 echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
96}
97_use_local_electron_for_forge() {
98 local _v="${SYSTEM_ELECTRON_VERSION}"
99 local _zd="${srcdir}/electron-zips"
100 case "${CARCH}" in
101 aarch64) _arch=arm64 ;;
102 x86_64) _arch=x64 ;;
103 esac
104 local _zf="${_zd}/electron-v${_v}-linux-${_arch}.zip"
105 install -Dm755 -d "${_zd}"
106 ( cd "${ELECTRON_DIST}" && zip -r -q -0 "${_zf}" . )
107 find . -name "forge.config.*" ! -path "*/node_modules/*" -print0 | while IFS= read -r -d '' _cfg; do
108 sed -i "/packagerConfig:[[:space:]]*{/a\\ electronZipDir: '${_zd}'," "${_cfg}"
109 done
110}
111prepare() {
112 cd "$(_get_project_dir)"
113 _get_electron_version
114 sed -i -e "
115 s/@electronversion@/${_electronversion}/g
116 s/@appname@/${pkgname%-git}/g
117 s/@runname@/app/g
118 s/@cfgdirname@/${pkgname%-git}/g
119 " "${srcdir}/${pkgname%-git}.sh"
120 _ensure_local_nvm
121 _set_build_env
122 jq --arg ver "${SYSTEM_ELECTRON_VERSION}" '.devDependencies.electron = $ver' package.json > package.json.tmp && mv package.json.tmp package.json
123 rm -f pnpm-lock.yaml
124 export NODE_ENV=development
125 pnpm install --ignore-scripts
126 _use_local_electron_for_forge
127}
128build() {
129 cd "$(_get_project_dir)"
130 _ensure_local_nvm
131 _set_build_env
132 export NODE_ENV=production
133 pnpm -c exec "electron-forge package"
134}
135package() {
136 install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
137 install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-git}"
138 local _app_dir="$(_get_app_dir)"
139 cp -a "${_app_dir}/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"
140 local _src="$(_get_project_dir)"
141 install -Dm644 "${_src}/build/icon.png" "${pkgdir}/usr/share/pixmaps/${pkgname%-git}.png"
142 install -Dm644 "${srcdir}/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
143 install -Dm644 "${_src}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
144}
145

Changes since previous scan

--- PKGBUILD @ 2026-09-10 13:20
+++ PKGBUILD @ 2026-10-07 14:05
@@ -2,11 +2,11 @@
_pkgname=crankshaft
pkgname="${_pkgname}-client-git"
_appname=Crankshaft-Client
-pkgver=2.0.1.r21.gc3a7030
+pkgver=2.0.2.r1.g297b6c5
_electronversion=44
_nodeversion=24
pkgrel=1
-pkgdesc="A fast, feature-rich krunker client written in typescript.(Use syetem-wide electron)"
+pkgdesc="A fast, feature-rich krunker client written in typescript."
arch=('any')
url="https://github.com/KraXen72/crankshaft"
license=('GPL-3.0-only')
@@ -18,7 +18,6 @@
makedepends=(
'pnpm'
'nvm'
- 'curl'
'git'
'jq'
'zip'
@@ -30,36 +29,53 @@
)
sha256sums=('SKIP'
'5c2cbe48a63fd1b62c0d33a086219ff14e6ac4607929acaa398780f9da1bfc0d'
- 'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
+ 'bd5358d8f323d3c2c2f0733364ee4ea55f551dd86ba0be2a76846210b60897fc')
+_get_project_dir() {
+ local d
+ while IFS= read -r d; do
+ find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
+ done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
+}
pkgver() {
- cd "${srcdir}/${pkgname%-git}.git"
+ cd "$(_get_project_dir)"
set -o pipefail
git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
}
_set_build_env() {
export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
+ export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
export ELECTRON_SKIP_BINARY_DOWNLOAD=1
- export NODE_OPTIONS="--max-old-space-size=4096"
- export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/v//g')"
- export HOME="${srcdir}/.electron-gyp"
- export PNPM_LINK_WORKSPACE_PACKAGES=true
- export PNPM_FETCH_RETRY_MAXTIMEOUT=10000
- export PNPM_CACHE_DIR="${srcdir}/.pnpm_cache"
- export PNPM_STORE_DIR="${srcdir}/.pnpm_store"
- export PNPM_VIRTUAL_STORE_DIR="${srcdir}/.pnpm_store"
- export PNPM_SHAMEFULLY_HOIST=true
- export PNPM_VIRTUAL_STORE_DIR_MAX_LENGTH=80
- export PNPM_NODE_LINKER=hoisted
- export PNPM_NETWORK_CONCURRENCY=32
- export npm_config_platform=linux
- export npm_config_arch="${CARCH}"
- if [[ "$(curl -s ipinfo.io/country)" == *"CN"* ]]; then
- export pnpm_config_registry="https://registry.npmmirror.com"
- export npm_config_registry="https://registry.npmmirror.com"
- export NPM_CONFIG_ELECTRON_MIRROR="https://registry.npmmirror.com/-/binary/electron/"
- export NPM_CONFIG_ELECTRON_BUILDER_BINARIES_MIRROR="https://registry.npmmirror.com/-/binary/electron-builder-binaries/"
- export NODEJS_ORG_MIRROR="https://npmmirror.com/mirrors/node"
+ export ELECTRON_BUILDER_OFFLINE=true
+ export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
+ export HOME="${srcdir}/.home"
+ export XDG_CACHE_HOME="${HOME}/.cache"
+ export XDG_CONFIG_HOME="${HOME}/.config"
+ export XDG_DATA_HOME="${HOME}/.local/share"
+ export XDG_STATE_HOME="${HOME}/.local/state"
+ export PNPM_HOME="${HOME}/.pnpm/bin"
+ export pnpm_config_cache_dir="${HOME}/.pnpm_cache"
+ export pnpm_config_store_dir="${HOME}/.pnpm_store"
+ export pnpm_config_global_dir="${HOME}/.pnpm/global"
+ export pnpm_config_state_dir="${HOME}/.pnpm/state"
+ export pnpm_config_node_linker=hoisted
+ export pnpm_config_minimum_release_age=0
+ export pnpm_config_update_notifier=false
+ export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
+ export COREPACK_HOME="${HOME}/.corepack"
+ mkdir -p "${HOME}" "${PNPM_HOME}" "${pnpm_config_cache_dir}" "${pnpm_config_store_dir}" "${pnpm_config_global_dir}" "${pnpm_config_state_dir}" "${COREPACK_HOME}"
+ export PATH="${PNPM_HOME}:${PATH}"
+ local _pnpmver=""
+ local _pkgjson="$(_get_project_dir)/package.json"
+ if [ -f "${_pkgjson}" ]; then
+ _pnpmver="$(grep -o '"packageManager"[^,]*' "${_pkgjson}" 2>/dev/null | grep -oE 'pnpm@[^"+]+' | head -n1 | sed 's/^pnpm@//')"
+ if [ -z "${_pnpmver}" ]; then
+ _pnpmver="$(grep -oE '"pnpm"[[:space:]]*:[[:space:]]*"[^"]+"' "${_pkgjson}" 2>/dev/null | grep -oE '[0-9][0-9.]*' | head -n1)"
+ fi
+ fi
+ if [ -n "${_pnpmver}" ]; then
+ npm install -g "pnpm@${_pnpmver}" --prefix "${HOME}/.pnpm" \
+ --registry "${COREPACK_NPM_REGISTRY}"
fi
}
_ensure_local_nvm() {
@@ -69,16 +85,31 @@
nvm use "${_nodeversion}"
}
_get_app_dir() {
- find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1
+ find "${srcdir}" -type f -name "resources.pak" -print 2>/dev/null | while read f; do [ -d "${f%/*}/resources" ] && echo "${f%/*}" && break; done
}
_get_electron_version() {
- _elec_ver=$(find "${srcdir}" -maxdepth 5 -name "package.json" ! -path "*/node_modules/*" \
- -exec grep -l '"electron"' {} + | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null | head -1)
- [[ -z "${_elec_ver}" ]] && return 1
- echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
+ _elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
+ | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
+ | grep -v '^$' | sed 's/^[^0-9]*//' | head -1)
+ [[ -z "${_elec_ver}" ]] && return 1
+ echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
+}
+_use_local_electron_for_forge() {
+ local _v="${SYSTEM_ELECTRON_VERSION}"
+ local _zd="${srcdir}/electron-zips"
+ case "${CARCH}" in
+ aarch64) _arch=arm64 ;;
+ x86_64) _arch=x64 ;;
+ esac
+ local _zf="${_zd}/electron-v${_v}-linux-${_arch}.zip"
+ install -Dm755 -d "${_zd}"
+ ( cd "${ELECTRON_DIST}" && zip -r -q -0 "${_zf}" . )
+ find . -name "forge.config.*" ! -path "*/node_modules/*" -print0 | while IFS= read -r -d '' _cfg; do
+ sed -i "/packagerConfig:[[:space:]]*{/a\\ electronZipDir: '${_zd}'," "${_cfg}"
+ done
}
prepare() {
- cd "${srcdir}/${pkgname%-git}.git"
+ cd "$(_get_project_dir)"
_get_electron_version
sed -i -e "
s/@electronversion@/${_electronversion}/g
@@ -86,34 +117,29 @@
s/@runname@/app/g
s/@cfgdirname@/${pkgname%-git}/g
" "${srcdir}/${pkgname%-git}.sh"
+ _ensure_local_nvm
_set_build_env
- _ensure_local_nvm
- sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g" package.json
+ jq --arg ver "${SYSTEM_ELECTRON_VERSION}" '.devDependencies.electron = $ver' package.json > package.json.tmp && mv package.json.tmp package.json
rm -f pnpm-lock.yaml
- NODE_ENV=development pnpm install --ignore-scripts
- local _v="${SYSTEM_ELECTRON_VERSION}"
- local _zd="${srcdir}/electron-zips"
- case "${CARCH}" in
- aarch64) _arch=arm64 ;;
- x86_64) _arch=x64 ;;
- esac
- local _zf="${_zd}/electron-v${_v}-linux-${_arch}.zip"
- install -Dm755 -d "${_zd}"
- ( cd "${ELECTRON_DIST}" && zip -r -q -0 "${_zf}" . )
- sed -i "/packagerConfig:[[:space:]]*{/a\\ electronZipDir: '${_zd}'," forge.config.*
+ export NODE_ENV=development
+ pnpm install --ignore-scripts
+ _use_local_electron_for_forge
}
build() {
- cd "${srcdir}/${pkgname%-git}.git"
+ cd "$(_get_project_dir)"
+ _ensure_local_nvm
_set_build_env
- _ensure_local_nvm
- NODE_ENV=production pnpm -c exec "electron-forge package"
+ export NODE_ENV=production
+ pnpm -c exec "electron-forge package"
}
package() {
install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-git}"
- local _app_dir=$(_get_app_dir)
- cp -a "${_app_dir}/resources/"* "${pkgdir}/usr/lib/${pkgname%-git}/"
- install -Dm644 "${srcdir}/${pkgname%-git}.git/build/icon.png" "${pkgdir}/usr/share/pixmaps/${pkgname%-git}.png"
+ local _app_dir="$(_get_app_dir)"
+ cp -a "${_app_dir}/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"
+ local _src="$(_get_project_dir)"
+ install -Dm644 "${_src}/build/icon.png" "${pkgdir}/usr/share/pixmaps/${pkgname%-git}.png"
install -Dm644 "${srcdir}/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
- install -Dm644 "${srcdir}/${pkgname%-git}.git/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
+ install -Dm644 "${_src}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
}
+

Scan history

Scanned at (UTC)SeverityRules
2026-10-07 14:05:47 Low 1
2026-09-10 13:20:36 Clean 0
2026-07-29 01:40:32 Clean 0
2026-06-18 16:11:54 Clean 0

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion