dbgate-git

LOW
maintainer zxp19821005 0 votes scanned 2026-10-17 00:21:55.226236
View on AUR
Why flagged

The package builds from a legitimate project source (GitHub) and uses standard development tools; the variable-named package installation is part of a normal, self-contained build process with no evidence of remote code execution or supply-chain risks.

Triggered rules

Low AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it LOW (confidence 95%): The package builds from a legitimate project source (GitHub) and uses standard development tools; the variable-named package installation is part of a normal, self-contained build process with no evidence of remote code execution or supply-chain risks.

  • PKGBUILD:94 npm install -g "@yarnpkg/cli-dist@${_yarnver}" --prefix "${_yarnhome}" --registry "${npm_config_registry}"

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2pkgname=dbgate-git
3_pkgname=DbGate
4_debname="org.${pkgname%-git}.${_pkgname}"
5pkgver=7.3.2.r1.gf82fea1
6_electronversion=38
7_nodeversion=24
8pkgrel=1
9pkgdesc="Database manager for MySQL, PostgreSQL, SQL Server, MongoDB, SQLite and others."
10arch=(
11 'aarch64'
12 'armv7h'
13 'x86_64'
14)
15url="https://www.dbgate.io/"
16_ghurl="https://github.com/dbgate/dbgate"
17license=("GPL-3.0-only")
18conflicts=("${pkgname%-git}")
19provides=("${pkgname%-git}=${pkgver%.r*}")
20depends=(
21 "electron${_electronversion}"
22 'python'
23)
24makedepends=(
25 'npm'
26 'git'
27 'nvm'
28 'gendesk'
29 'yarn'
30 'python'
31 'jq'
32)
33source=(
34 "${pkgname//-/.}::git+${_ghurl}.git"
35 "${pkgname%-git}.sh"
36)
37sha256sums=('SKIP'
38 'cebedc3391cbab6d43f37fbf3a87ddaad16597cb5ea487a4d55b1f478d810082')
39_get_project_dir() {
40 local d
41 while IFS= read -r d; do
42 find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
43 done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
44}
45pkgver() {
46 cd "$(_get_project_dir)"
47 set -o pipefail
48 git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
49 printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
50}
51_ensure_local_nvm() {
52 local NVM_DIR="${srcdir}/.nvm"
53 source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
54 nvm install "${_nodeversion}"
55 nvm use "${_nodeversion}"
56}
57_get_app_dir() {
58 find "${srcdir}" -type f -name "resources.pak" -print 2>/dev/null | while read f; do [ -d "${f%/*}/resources" ] && echo "${f%/*}" && break; done
59}
60_set_build_env() {
61 export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
62 export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
63 export ELECTRON_SKIP_BINARY_DOWNLOAD=1
64 export ELECTRON_BUILDER_OFFLINE=true
65 export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
66 export HOME="${srcdir}/.home"
67 export XDG_CACHE_HOME="${HOME}/.cache"
68 export XDG_CONFIG_HOME="${HOME}/.config"
69 export XDG_DATA_HOME="${HOME}/.local/share"
70 export YARN_CACHE_FOLDER="${HOME}/.yarn/cache"
71 export YARN_NETWORK_CONCURRENCY=32
72 export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
73 export COREPACK_HOME="${HOME}/.corepack"
74 export npm_config_registry="${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}"
75 local _yarnver _yarnmajor=0
76 _yarnver="$(node -p "require('./package.json').packageManager?.split('@')[1]?.split('-')[0] || ''" 2>/dev/null)"
77 _yarnmajor="${_yarnver%%.*}"
78 _yarnmajor="${_yarnmajor:-0}"
79 if [[ "${_yarnmajor}" -ge 2 ]] 2>/dev/null || [[ -f .yarnrc.yml ]]; then
80 export XDG_STATE_HOME="${HOME}/.local/state"
81 export YARN_ENABLE_GLOBAL_CACHE=false
82 export YARN_ENABLE_MIRROR=false
83 export YARN_GLOBAL_FOLDER="${HOME}/.yarn/berry"
84 export YARN_NODE_LINKER=node-modules
85 export YARN_NM_MODE=hardlinks-local
86 export YARN_ENABLE_TELEMETRY=false
87 export YARN_ENABLE_SCRIPTS=true
88 export YARN_HTTP_TIMEOUT=600000
89 export YARN_HTTP_RETRY=5
90 export YARN_NPM_REGISTRY_SERVER="${YARN_NPM_REGISTRY_SERVER:-${NPM_CONFIG_REGISTRY:-https://registry.yarnpkg.com}}"
91 local _yarnhome="${HOME}/.yarn/install"
92 mkdir -p "${HOME}" "${YARN_CACHE_FOLDER}" "${YARN_GLOBAL_FOLDER}" "${COREPACK_HOME}" "${_yarnhome}"
93 if [[ -n "${_yarnver}" ]]; then
94 npm install -g "@yarnpkg/cli-dist@${_yarnver}" --prefix "${_yarnhome}" --registry "${npm_config_registry}"
95 export PATH="${_yarnhome}/bin:${PATH}"
96 fi
97 else
98 export YARN_GLOBAL_FOLDER="${HOME}/.yarn/global"
99 export YARN_LINK_FOLDER="${HOME}/.yarn/link"
100 export YARN_TEMP_FOLDER="${HOME}/.yarn/tmp"
101 export YARN_NETWORK_TIMEOUT=600000
102 export YARN_CHILD_CONCURRENCY="$(nproc)"
103 export YARN_FROZEN_LOCKFILE=true
104 export YARN_IGNORE_ENGINES=true
105 export YARN_PRODUCTION=false
106 mkdir -p "${HOME}" "${YARN_CACHE_FOLDER}" "${YARN_GLOBAL_FOLDER}" "${YARN_LINK_FOLDER}" "${YARN_TEMP_FOLDER}" "${COREPACK_HOME}"
107 fi
108 local _reg="${NPM_CONFIG_REGISTRY:-https://registry.yarnpkg.com}"
109 _reg="${_reg%/}"
110 if [[ -f .yarnrc ]]; then
111 sed -i "s|^registry .*|registry \"${_reg}\"|" .yarnrc
112 fi
113 if [[ -f yarn.lock ]] && grep -q 'resolved "https://registry.yarnpkg.com' yarn.lock; then
114 sed -i "s|https://registry.yarnpkg.com/|${_reg}/|g" yarn.lock
115 fi
116}
117_get_electron_version() {
118 _elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
119 | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
120 | grep -v '^$' | sed 's/^[^0-9]*//' | head -1)
121 [[ -z "${_elec_ver}" ]] && return 1
122 echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
123}
124prepare() {
125 cd "$(_get_project_dir)"
126 _get_electron_version
127 sed -i -e "
128 s/@electronversion@/${_electronversion}/g
129 s/@appname@/${pkgname%-git}/g
130 s/@runname@/app.asar/g
131 " "${srcdir}/${pkgname%-git}.sh"
132 gendesk -q -f -n \
133 --pkgname="${pkgname%-git}" \
134 --pkgdesc="${pkgdesc}" \
135 --categories="Development;Database" \
136 --name="${_pkgname}" \
137 --exec="${pkgname%-git} %U"
138 _ensure_local_nvm
139 _set_build_env
140 jq --arg ver "${SYSTEM_ELECTRON_VERSION}" '.devDependencies.electron = $ver' package.json > package.json.tmp && mv package.json.tmp package.json
141 export NODE_ENV=development
142 node adjustPackageJson --community
143 yarn install
144 find . -type d -path "*/node_modules/@types/minimatch" -exec rm -rf {} + 2>/dev/null || true
145 cd "${srcdir}/${pkgname//-/.}/app"
146 yarn install
147 cd "${srcdir}/${pkgname//-/.}/packages/api"
148 yarn install
149 cd "${srcdir}/${pkgname//-/.}/packages/web"
150 yarn install
151}
152build() {
153 cd "$(_get_project_dir)"
154 _ensure_local_nvm
155 _set_build_env
156 export NODE_ENV=production
157 yarn fillPackagedPlugins
158 yarn plugins:copydist
159 cd "$(_get_project_dir)/packages/api"
160 yarn run build
161 cd "$(_get_project_dir)/packages/web"
162 yarn run build
163 cd "$(_get_project_dir)/app"
164 yarn electron-builder --linux dir -c.electronDist="${ELECTRON_DIST}"
165 local _app_dir="$(_get_app_dir)"
166 case "${CARCH}" in
167 aarch64) _arch_rem="x64" ;;
168 x86_64) _arch_rem="arm64" ;;
169 esac
170 find "${_app_dir}/resources" -depth \
171 \( -name "*darwin*" -o -name "*win32*" -o -name "*${_arch_rem}*" \) \
172 -exec rm -rf {} +
173}
174package() {
175 install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
176 install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-git}"
177 local _app_dir="$(_get_app_dir)"
178 cp -a "${_app_dir}/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"
179 rm -rf "${pkgdir}/usr/lib/${pkgname%-git}/default_app.asar"
180 local _src="$(_get_project_dir)"
181 _icon_sizes=(16x16 32x32 48x48 64x64 128x128 256x256 512x512)
182 for _icons in "${_icon_sizes[@]}";do
183 install -Dm644 "${_src}/app/icons/${_icons}.png" \
184 "${pkgdir}/usr/share/icons/hicolor/${_icons}/apps/${pkgname%-git}.png"
185 done
186 install -Dm644 "${_src}/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
187 install -Dm644 "${_src}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
188}
189

Changes since previous scan

--- PKGBUILD @ 2026-09-29 09:23
+++ PKGBUILD @ 2026-10-17 00:21
@@ -2,7 +2,7 @@
pkgname=dbgate-git
_pkgname=DbGate
_debname="org.${pkgname%-git}.${_pkgname}"
-pkgver=7.3.1.r6.g0a0132a
+pkgver=7.3.2.r1.gf82fea1
_electronversion=38
_nodeversion=24
pkgrel=1
@@ -35,7 +35,7 @@
"${pkgname%-git}.sh"
)
sha256sums=('SKIP'
- 'bd5358d8f323d3c2c2f0733364ee4ea55f551dd86ba0be2a76846210b60897fc')
+ 'cebedc3391cbab6d43f37fbf3a87ddaad16597cb5ea487a4d55b1f478d810082')
_get_project_dir() {
local d
while IFS= read -r d; do
@@ -55,7 +55,7 @@
nvm use "${_nodeversion}"
}
_get_app_dir() {
- find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1
+ find "${srcdir}" -type f -name "resources.pak" -print 2>/dev/null | while read f; do [ -d "${f%/*}/resources" ] && echo "${f%/*}" && break; done
}
_set_build_env() {
export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
@@ -88,7 +88,12 @@
export YARN_HTTP_TIMEOUT=600000
export YARN_HTTP_RETRY=5
export YARN_NPM_REGISTRY_SERVER="${YARN_NPM_REGISTRY_SERVER:-${NPM_CONFIG_REGISTRY:-https://registry.yarnpkg.com}}"
- mkdir -p "${HOME}" "${YARN_CACHE_FOLDER}" "${YARN_GLOBAL_FOLDER}" "${COREPACK_HOME}"
+ local _yarnhome="${HOME}/.yarn/install"
+ mkdir -p "${HOME}" "${YARN_CACHE_FOLDER}" "${YARN_GLOBAL_FOLDER}" "${COREPACK_HOME}" "${_yarnhome}"
+ if [[ -n "${_yarnver}" ]]; then
+ npm install -g "@yarnpkg/cli-dist@${_yarnver}" --prefix "${_yarnhome}" --registry "${npm_config_registry}"
+ export PATH="${_yarnhome}/bin:${PATH}"
+ fi
else
export YARN_GLOBAL_FOLDER="${HOME}/.yarn/global"
export YARN_LINK_FOLDER="${HOME}/.yarn/link"
@@ -110,10 +115,11 @@
fi
}
_get_electron_version() {
- _elec_ver=$(find "$(_get_project_dir)" -maxdepth 5 -name "package.json" ! -path "*/node_modules/*" \
- -exec grep -l '"electron"' {} + | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null | head -1)
- [[ -z "${_elec_ver}" ]] && return 1
- echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
+ _elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
+ | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
+ | grep -v '^$' | sed 's/^[^0-9]*//' | head -1)
+ [[ -z "${_elec_ver}" ]] && return 1
+ echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
}
prepare() {
cd "$(_get_project_dir)"
@@ -122,7 +128,6 @@
s/@electronversion@/${_electronversion}/g
s/@appname@/${pkgname%-git}/g
s/@runname@/app.asar/g
- s/@cfgdirname@/${_pkgname}/g
" "${srcdir}/${pkgname%-git}.sh"
gendesk -q -f -n \
--pkgname="${pkgname%-git}" \
@@ -132,10 +137,11 @@
--exec="${pkgname%-git} %U"
_ensure_local_nvm
_set_build_env
- sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g" app/package.json
+ jq --arg ver "${SYSTEM_ELECTRON_VERSION}" '.devDependencies.electron = $ver' package.json > package.json.tmp && mv package.json.tmp package.json
export NODE_ENV=development
node adjustPackageJson --community
yarn install
+ find . -type d -path "*/node_modules/@types/minimatch" -exec rm -rf {} + 2>/dev/null || true
cd "${srcdir}/${pkgname//-/.}/app"
yarn install
cd "${srcdir}/${pkgname//-/.}/packages/api"
@@ -161,7 +167,7 @@
aarch64) _arch_rem="x64" ;;
x86_64) _arch_rem="arm64" ;;
esac
- find "${_app_dir}/resources" \
+ find "${_app_dir}/resources" -depth \
\( -name "*darwin*" -o -name "*win32*" -o -name "*${_arch_rem}*" \) \
-exec rm -rf {} +
}

Scan history

Scanned at (UTC)SeverityRules
2026-10-17 00:21:55 Low 1
2026-10-16 00:12:47 Low 1
2026-10-15 00:28:05 Low 1
2026-10-14 00:06:47 Low 1
2026-10-13 00:23:45 Low 1
2026-10-12 00:18:51 Low 1
2026-10-11 00:26:05 Low 1
2026-10-10 04:12:59 Low 1
2026-09-29 09:23:18 Clean 0
2026-09-23 23:41:06 Clean 0
2026-09-17 05:24:46 Clean 0
2026-07-21 03:15:42 Clean 0
2026-06-18 16:11:54 Clean 0

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion