dashbeam

LOW

maintainer IuseAURBTW 2 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

The flagged 'external install' is a development tool (wasm-bindgen-cli) installed via cargo during prepare(), which is a normal part of building a Rust/WASM-based desktop app and does not execute untrusted remote code.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The flagged 'external install' is a development tool (wasm-bindgen-cli) installed via cargo during prepare(), which is a normal part of building a Rust/WASM-based desktop app and does not execute untrusted remote code.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium External install via pipx/uv/poetry/cargo/go/gem alt_pkg_manager_install

A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.

PKGBUILD:64 cargo install wasm-bindgen-cli \

PKGBUILD

1 offending line(s) highlighted

      1pkgname=dashbeam
    
      2pkgver=0.7.2
    
      3pkgrel=1
    
      4pkgdesc="Peer-to-peer file and folder transfer app without cloud storage"
    
      5arch=('x86_64' 'aarch64')
    
      6url="https://github.com/tonyantony300/dashbeam"
    
      7license=('AGPL-3.0-only')
    
      8
    
      9depends=(
    
      10  'cairo'
    
      11  'gdk-pixbuf2'
    
      12  'glib2'
    
      13  'gtk3'
    
      14  'hicolor-icon-theme'
    
      15  'libappindicator-gtk3'
    
      16  'pango'
    
      17  'webkit2gtk-4.1'
    
      18)
    
      19
    
      20makedepends=(
    
      21  'cargo'
    
      22  'clang'
    
      23  'librsvg'
    
      24  'nodejs>=22.12.0'
    
      25  'pnpm'
    
      26  'rust-wasm'
    
      27)
    
      28
    
      29optdepends=(
    
      30  'xdg-utils'
    
      31)
    
      32
    
      33provides=(
    
      34  "alt-sendme=${pkgver}"
    
      35)
    
      36
    
      37conflicts=(
    
      38  'alt-sendme'
    
      39  'alt-sendme-bin'
    
      40  'alt-sendme-git'
    
      41  'dashbeam-bin'
    
      42  'dashbeam-git'
    
      43)
    
      44
    
      45replaces=(
    
      46  'alt-sendme'
    
      47)
    
      48
    
      49source=(
    
      50  "${pkgname}-${pkgver}.tar.gz::${url}/archive/refs/tags/v${pkgver}.tar.gz"
    
      51)
    
      52
    
      53sha256sums=(
    
      54  'c6bbb2100127ea7b8c6ba3bfda3ca7573c71764ff46522a92dd3b05361f14141'
    
      55)
    
      56
    
      57prepare() {
    
      58  cd "${srcdir}/${pkgname}-${pkgver}"
    
      59
    
      60  export CARGO_HOME="${srcdir}/cargo-home"
    
      61  export CARGO_HTTP_CAINFO=/etc/ssl/cert.pem
    
      62  export npm_config_cache="${srcdir}/npm-cache"
    
      63
    
      64  cargo install wasm-bindgen-cli \
    
      65    --version 0.2.126 \
    
      66    --locked \
    
      67    --root "${srcdir}/wasm-bindgen-cli"
    
      68
    
      69  cargo fetch --manifest-path wasm-bridge/Cargo.toml --target wasm32-unknown-unknown
    
      70  cargo fetch --manifest-path src-tauri/Cargo.toml
    
      71
    
      72  pnpm install --frozen-lockfile --store-dir "${srcdir}/pnpm-store"
    
      73}
    
      74
    
      75build() {
    
      76  cd "${srcdir}/${pkgname}-${pkgver}"
    
      77
    
      78  export PATH="${srcdir}/wasm-bindgen-cli/bin:${PATH}"
    
      79  export CARGO_HOME="${srcdir}/cargo-home"
    
      80  export CARGO_HTTP_CAINFO=/etc/ssl/cert.pem
    
      81  export npm_config_cache="${srcdir}/npm-cache"
    
      82  export CI=true
    
      83  export TAURI_LINUX_AYATANA_APPINDICATOR=1
    
      84
    
      85  export CC=clang
    
      86  export CXX=clang++
    
      87  export CC_wasm32_unknown_unknown=clang
    
      88  export CXX_wasm32_unknown_unknown=clang++
    
      89  export CFLAGS=
    
      90  export CXXFLAGS=
    
      91  export CPPFLAGS=
    
      92  export LDFLAGS=
    
      93  export CFLAGS_wasm32_unknown_unknown="-O2"
    
      94  export CXXFLAGS_wasm32_unknown_unknown="-O2"
    
      95
    
      96  pnpm run tauri build --no-bundle
    
      97}
    
      98
    
      99package() {
    
      100  cd "${srcdir}/${pkgname}-${pkgver}"
    
      101
    
      102  local _built_bin="src-tauri/target/release/DashBeam"
    
      103  if [[ ! -x "${_built_bin}" ]]; then
    
      104    echo "Could not find built binary at ${_built_bin}" >&2
    
      105    return 1
    
      106  fi
    
      107  install -Dm755 "${_built_bin}" "${pkgdir}/usr/bin/${pkgname}"
    
      108
    
      109  install -Dm644 LICENSE \
    
      110    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      111
    
      112  install -Dm644 src-tauri/icons/32x32.png \
    
      113    "${pkgdir}/usr/share/icons/hicolor/32x32/apps/${pkgname}.png"
    
      114  install -Dm644 src-tauri/icons/128x128.png \
    
      115    "${pkgdir}/usr/share/icons/hicolor/128x128/apps/${pkgname}.png"
    
      116  install -Dm644 src-tauri/icons/128x128@2x.png \
    
      117    "${pkgdir}/usr/share/icons/hicolor/256x256/apps/${pkgname}.png"
    
      118
    
      119  install -dm755 "${pkgdir}/usr/share/applications"
    
      120  cat >"${pkgdir}/usr/share/applications/${pkgname}.desktop" <<EOF
    
      121[Desktop Entry]
    
      122Type=Application
    
      123Name=Dashbeam
    
      124Comment=Send files and folders anywhere in the world without storing in cloud - any size, any format, no accounts, no restrictions (previously Altsendme)
    
      125Exec=${pkgname}
    
      126Icon=${pkgname}
    
      127Terminal=false
    
      128Categories=Network;FileTransfer;
    
      129Keywords=file;folder;transfer;send;receive;p2p;peer-to-peer;
    
      130StartupNotify=true
    
      131StartupWMClass=dashbeam
    
      132EOF
    
      133}
    
      134

Changes since previous scan

--- PKGBUILD @ 2026-09-27 07:16
+++ PKGBUILD @ 2026-10-17 00:21
@@ -1,11 +1,10 @@
 pkgname=dashbeam
-pkgver=0.7.1
+pkgver=0.7.2
 pkgrel=1
 pkgdesc="Peer-to-peer file and folder transfer app without cloud storage"
 arch=('x86_64' 'aarch64')
 url="https://github.com/tonyantony300/dashbeam"
-license=('AGPL3')
-options=('!lto')
+license=('AGPL-3.0-only')
 
 depends=(
   'cairo'
@@ -22,10 +21,9 @@
   'cargo'
   'clang'
   'librsvg'
-  'nodejs>=20'
+  'nodejs>=22.12.0'
   'pnpm'
   'rust-wasm'
-  'wasm-bindgen'
 )
 
 optdepends=(
@@ -53,7 +51,7 @@
 )
 
 sha256sums=(
-  '7644f6669d44be4ef9b91aab270103fc5b3f3964f997f46b80d37c02a6660e5b'
+  'c6bbb2100127ea7b8c6ba3bfda3ca7573c71764ff46522a92dd3b05361f14141'
 )
 
 prepare() {
@@ -62,6 +60,11 @@
   export CARGO_HOME="${srcdir}/cargo-home"
   export CARGO_HTTP_CAINFO=/etc/ssl/cert.pem
   export npm_config_cache="${srcdir}/npm-cache"
+
+  cargo install wasm-bindgen-cli \
+    --version 0.2.126 \
+    --locked \
+    --root "${srcdir}/wasm-bindgen-cli"
 
   cargo fetch --manifest-path wasm-bridge/Cargo.toml --target wasm32-unknown-unknown
   cargo fetch --manifest-path src-tauri/Cargo.toml
@@ -72,6 +75,7 @@
 build() {
   cd "${srcdir}/${pkgname}-${pkgver}"
 
+  export PATH="${srcdir}/wasm-bindgen-cli/bin:${PATH}"
   export CARGO_HOME="${srcdir}/cargo-home"
   export CARGO_HTTP_CAINFO=/etc/ssl/cert.pem
   export npm_config_cache="${srcdir}/npm-cache"

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 23:21:11	Medium	1
2026-09-27 07:16:53	Clean	0
2026-08-24 00:17:16	Clean	2
2026-08-23 11:20:29	Low	1
2026-08-18 00:03:42	Clean	2
2026-08-17 13:36:23	Low	1