deepseek-harness-desktop
LOW
maintainer harryloong
0 votes
scanned 2026-09-26 03:13:55.736981
Why flagged
The package builds from the official upstream Git repository with a pinned tag, applies minor Linux-specific patches, and bundles runtimes pinned by SHA-256; while some sources are not checksummed directly in the PKGBUILD, they are integrity-verified by the build system, and the final artifact is a self-contained Electron app with no remote code execution or exfiltration observed.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Low
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from the official upstream Git repository with a pinned tag, applies minor Linux-specific patches, and bundles runtimes pinned by SHA-256; while some sources are not checksummed directly in the PKGBUILD, they are integrity-verified by the build system, and the final artifact is a self-contained Electron app with no remote code execution or exfiltration observed.
PKGBUILD
1
# Maintainer: HarryLoong <xiangzelong@radxa.com>
2
#
3
# Builds the DeepSeek Harness *desktop* application from the upstream repository.
4
# Upstream publishes desktop releases for macOS and Windows only, although the
5
# sources already contain the packaging target and the shell's Linux behaviour
6
# (wayland app id, native menus, DOM shortcut dispatch, non-portal folder dialogs);
7
# only the target wiring, the release settings for an unsigned build, and the two
8
# Linux-only runtime adjustments in linux-desktop.patch were missing. The installed
9
# result is the same shape as the macOS and Windows releases: the Electron shell plus
10
# a complete dsh runtime, with Node.js, pnpm, CPython and the Office libraries
11
# bundled, so nothing is required from the system at runtime beyond the shared
12
# libraries listed below.
13
#
14
# The build downloads the pinned Electron distribution, the Node.js and CPython
15
# runtimes, and the Python wheels the bundled payload locks (scripts/primary-runtime/
16
# lock.json). Those are unlisted sources this PKGBUILD cannot checksum; the
17
# repository pins every one of them by SHA-256 and the runtime downloader enforces
18
# the digest before use. A source build takes roughly 15-25 minutes and about 6 GB of
19
# scratch space.
20
#
21
# makepkg reports references to $srcdir inside resources/app.asar. Those are CSS-module
22
# virtual paths the client bundler writes into `//#region` comments; the same comments
23
# carry the packaging host's paths in the macOS and Windows releases. Nothing resolves
24
# them at runtime -- the application locates every file relative to its own directory.
25
26
pkgname=deepseek-harness-desktop
27
_tag=dsh-v0.1.7-rc.2
28
pkgver=0.1.7rc.2
29
pkgrel=1
30
pkgdesc='DeepSeek Harness desktop application (Electron shell and bundled dsh runtime)'
31
arch=('x86_64')
32
url='https://github.com/deepseek-ai/deepseek-harness'
33
license=('MIT')
34
depends=(
35
'alsa-lib' 'at-spi2-core' 'cairo' 'dbus' 'expat' 'glib2' 'gtk3' 'libcups'
36
'libx11' 'libxcb' 'libxcomposite' 'libxdamage' 'libxext' 'libxfixes'
37
'libxkbcommon' 'libxrandr' 'mesa' 'nss' 'pango' 'systemd-libs' 'xdg-utils'
38
)
39
optdepends=(
40
'zenity: native directory dialogs for local directory selection'
41
'kdialog: native directory dialogs on Plasma'
42
)
43
makedepends=('git' 'nodejs' 'pnpm' 'python')
44
options=('!strip' '!debug')
45
source=(
46
"$pkgname::git+https://github.com/deepseek-ai/deepseek-harness.git#tag=$_tag"
47
'linux-desktop.patch'
48
'deepseek-harness-linux.env'
49
)
50
sha256sums=(
51
'SKIP'
52
'a089870dbfb2a5bbc7e19ffc06bedeeba6d0220a4b11d69c3bebbe37a7846763'
53
'c9783ffd57bf481f89ec59beb6047c7cf40098e4790c6098bf60370c408a4c7d'
54
)
55
56
prepare() {
57
cd "$pkgname"
58
59
# makepkg reuses this working copy for a re-run (and --noextract skips the reset):
60
# restore the tracked files and drop the file the patch adds, so the patch below
61
# always applies to a clean tree.
62
git checkout -- .
63
rm -f apps/desktop/scripts/linux-runtime-adjustments.ts
64
65
# Linux desktop target, unsigned release settings, and the Electron-safe sharp
66
# build plus the LibreOfficeKit engine probe fix the ASAR layout needs.
67
patch -Np1 --no-backup-if-mismatch -i "$srcdir/linux-desktop.patch"
68
69
# The Linux target reads its release settings from a dotenv file beside the app.
70
install -Dm644 "$srcdir/deepseek-harness-linux.env" apps/desktop/.env.linux
71
}
72
73
build() {
74
cd "$pkgname"
75
76
# The repository pins its own pnpm through packageManager; the system package bootstraps it.
77
pnpm install --frozen-lockfile
78
79
# Assemble the unpacked application: the Electron shell, the dsh runtime with its
80
# production dependency closure, and the bundled Node.js/pnpm/CPython payload. The
81
# target runs its own packed-runtime smoke checks -- native module loading, a real
82
# image decode, a PTY, ripgrep, and a DOCX/XLSX/PPTX to PDF conversion through the
83
# bundled Python -- and fails the build when any of them fails.
84
pnpm --filter @deepseek-ai/dsh-desktop run package:dir
85
}
86
87
package() {
88
cd "$pkgname"
89
local appdir=apps/desktop/.desktop-build/targets/linux-x64/artifacts/linux-unpacked
90
local desktop=deepseek-ai-dsh-desktop
91
92
# Arch layout: private application payload under /usr/lib, entry point in /usr/bin.
93
install -d "$pkgdir/usr/lib/$pkgname" "$pkgdir/usr/bin"
94
cp -a "$appdir/." "$pkgdir/usr/lib/$pkgname/"
95
96
install -Dm755 /dev/stdin "$pkgdir/usr/bin/$pkgname" <<'EOF'
97
#!/bin/sh
98
# Chromium's sandbox uses unprivileged user namespaces, which Arch enables by default;
99
# pass --no-sandbox only if the kernel reports them as unavailable.
100
exec /usr/lib/deepseek-harness-desktop/deepseek-harness "$@"
101
EOF
102
103
# The file name matches the application's Wayland app id, so desktop shells and
104
# window lists can map a running window back to this entry and its icon.
105
install -Dm644 /dev/stdin "$pkgdir/usr/share/applications/$desktop.desktop" <<EOF
106
[Desktop Entry]
107
Type=Application
108
Name=DeepSeek Harness
109
Comment=DeepSeek Harness desktop application
110
Exec=$pkgname %U
111
Icon=deepseek-harness
112
Terminal=false
113
StartupNotify=true
114
StartupWMClass=$desktop
115
Categories=Development;
116
Keywords=AI;agent;deepseek;harness;dsh;
117
MimeType=x-scheme-handler/dsh;
118
EOF
119
120
install -Dm644 apps/desktop/resources/icon.png \
121
"$pkgdir/usr/share/icons/hicolor/512x512/apps/deepseek-harness.png"
122
# The same artwork as a vector, which is what icon themes prefer at every size.
123
install -Dm644 apps/desktop/resources/icon.svg \
124
"$pkgdir/usr/share/icons/hicolor/scalable/apps/deepseek-harness.svg"
125
126
install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
127
}
128
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-26 03:13:55 | Low | 2 |