deepseek-harness-git

maintainer Aromatic · 0 votes · scanned 2026-08-18 01:38:17.845211

LOW

Why flagged The package builds from the project's own GitHub repository and uses standard build tools; the low severity is due to unverifiable source (SKIP'd checksum) and few recent votes, but it does not execute untrusted remote code or install prebuilt binaries from swappable hosts.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from the project's own GitHub repository and uses standard build tools; the low severity is due to unverifiable source (SKIP'd checksum) and few recent votes, but it does not execute untrusted remote code or install prebuilt binaries from swappable hosts.

PKGBUILD

      1pkgname=deepseek-harness-git
    
      2pkgver=0.1.0rc.5.r12225.g47f9438
    
      3pkgrel=3
    
      4pkgdesc='DeepSeek Harness CLI and agent harness (git)'
    
      5arch=('x86_64')
    
      6url='https://github.com/deepseek-ai/deepseek-harness'
    
      7license=('MIT')
    
      8depends=('nodejs' 'pnpm')
    
      9makedepends=('git' 'npm')
    
      10options=('!strip')
    
      11provides=('deepseek-harness')
    
      12conflicts=('deepseek-harness' 'deepseek-harness-bin')
    
      13source=('git+https://github.com/deepseek-ai/deepseek-harness.git' 'aur-package.mjs')
    
      14sha256sums=('SKIP' 'da872acd5c4c4a047bda1c95f021b9f744e619d8731ef7bd7615f219007e3a81')
    
      15
    
      16pkgver() {
    
      17  cd "$srcdir/deepseek-harness"
    
      18  local _ver
    
      19  _ver=$(node -p "require('./apps/cli/package.json').version.replace('-rc.', 'rc.')")
    
      20  printf '%s.r%s.g%s' "$_ver" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
    
      21}
    
      22
    
      23prepare() {
    
      24  cd "$srcdir/deepseek-harness"
    
      25
    
      26  # This hook only manages development git hooks and breaks production packing.
    
      27  node -e "const fs=require('fs'); const p=JSON.parse(fs.readFileSync('package.json','utf8')); delete p.scripts.postinstall; fs.writeFileSync('package.json', JSON.stringify(p,null,2)+'\\n')"
    
      28  pnpm install --frozen-lockfile
    
      29}
    
      30
    
      31build() {
    
      32  cd "$srcdir/deepseek-harness"
    
      33  pnpm run build
    
      34
    
      35  rm -rf dist/aur-dsh dist/aur-vendor
    
      36  pnpm exec tsx scripts/release/pack.ts --family vendor --out dist/aur-vendor
    
      37  pnpm exec tsx scripts/release/pack.ts --family dsh --out dist/aur-dsh
    
      38
    
      39  node "$srcdir/aur-package.mjs" "$srcdir"
    
      40
    
      41  cd "$srcdir/npm-root"
    
      42  npm install --omit=optional --no-audit --no-fund --package-lock=false
    
      43  node node_modules/@deepseek-ai/dsh/lib/bin.js --version
    
      44}
    
      45
    
      46package() {
    
      47  install -d "$pkgdir/usr/lib/deepseek-harness" "$pkgdir/usr/bin"
    
      48  cp -a "$srcdir/npm-root/node_modules" "$pkgdir/usr/lib/deepseek-harness/"
    
      49  ln -s ../lib/deepseek-harness/node_modules/@deepseek-ai/dsh/lib/bin.js "$pkgdir/usr/bin/dsh"
    
      50  install -Dm644 "$srcdir/deepseek-harness/LICENSE" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      51  find "$pkgdir/usr" -type d -exec chmod 755 {} +
    
      52  chown -R root:root "$pkgdir"
    
      53}
    
      54

Changes since previous scan

--- PKGBUILD @ 2026-08-18 00:03
+++ PKGBUILD @ 2026-08-18 01:38
@@ -1,22 +1,22 @@
 pkgname=deepseek-harness-git
-pkgver=0.1.0.rc.5.r12225.g47f9438
-pkgrel=1
+pkgver=0.1.0rc.5.r12225.g47f9438
+pkgrel=3
 pkgdesc='DeepSeek Harness CLI and agent harness (git)'
 arch=('x86_64')
 url='https://github.com/deepseek-ai/deepseek-harness'
 license=('MIT')
-depends=('nodejs>=22.19.0')
-makedepends=('git' 'npm' 'pnpm>=11')
+depends=('nodejs' 'pnpm')
+makedepends=('git' 'npm')
 options=('!strip')
-provides=('deepseek-harness' 'dsh')
+provides=('deepseek-harness')
 conflicts=('deepseek-harness' 'deepseek-harness-bin')
-source=('git+https://github.com/deepseek-ai/deepseek-harness.git')
-sha256sums=('SKIP')
+source=('git+https://github.com/deepseek-ai/deepseek-harness.git' 'aur-package.mjs')
+sha256sums=('SKIP' 'da872acd5c4c4a047bda1c95f021b9f744e619d8731ef7bd7615f219007e3a81')
 
 pkgver() {
   cd "$srcdir/deepseek-harness"
   local _ver
-  _ver=$(node -p "require('./apps/cli/package.json').version.replace(/-/g, '.')")
+  _ver=$(node -p "require('./apps/cli/package.json').version.replace('-rc.', 'rc.')")
   printf '%s.r%s.g%s' "$_ver" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
 }
 
@@ -36,39 +36,10 @@
   pnpm exec tsx scripts/release/pack.ts --family vendor --out dist/aur-vendor
   pnpm exec tsx scripts/release/pack.ts --family dsh --out dist/aur-dsh
 
-  node - "$srcdir/runtime-tarballs.txt" <<'NODE'
-const fs = require('fs')
-const path = require('path')
-const cp = require('child_process')
-const packages = new Map()
-for (const dir of ['dist/aur-vendor', 'dist/aur-dsh']) {
-  for (const file of fs.readdirSync(dir).filter(file => file.endsWith('.tgz'))) {
-    const full = path.resolve(dir, file)
-    const manifest = JSON.parse(cp.execFileSync('bsdtar', ['-xOf', full, 'package/package.json'], { encoding: 'utf8' }))
-    packages.set(manifest.name, { file: full, manifest })
-  }
-}
-const seen = new Set()
-function visit(name) {
-  if (seen.has(name)) return
-  const entry = packages.get(name)
-  if (entry === undefined) return
-  seen.add(name)
-  for (const section of ['dependencies', 'peerDependencies']) {
-    for (const dependency of Object.keys(entry.manifest[section] ?? {})) visit(dependency)
-  }
-}
-visit('@deepseek-ai/dsh')
-const tarballs = [...seen].sort().map(name => packages.get(name).file)
-fs.writeFileSync(process.argv[2], `${tarballs.join('\n')}\n`)
-NODE
+  node "$srcdir/aur-package.mjs" "$srcdir"
 
-  rm -rf "$srcdir/npm-root"
-  mkdir -p "$srcdir/npm-root"
   cd "$srcdir/npm-root"
-  printf '%s\n' '{"name":"deepseek-harness-aur-build","version":"0.0.0","private":true}' > package.json
-  mapfile -t _tarballs < "$srcdir/runtime-tarballs.txt"
-  npm install --no-save --omit=optional --no-audit --no-fund --package-lock=false "${_tarballs[@]}"
+  npm install --omit=optional --no-audit --no-fund --package-lock=false
   node node_modules/@deepseek-ai/dsh/lib/bin.js --version
 }
 
@@ -76,6 +47,8 @@
   install -d "$pkgdir/usr/lib/deepseek-harness" "$pkgdir/usr/bin"
   cp -a "$srcdir/npm-root/node_modules" "$pkgdir/usr/lib/deepseek-harness/"
   ln -s ../lib/deepseek-harness/node_modules/@deepseek-ai/dsh/lib/bin.js "$pkgdir/usr/bin/dsh"
-  chmod -R u+rwX,go+rX,go-w "$pkgdir/usr/lib/deepseek-harness"
+  install -Dm644 "$srcdir/deepseek-harness/LICENSE" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
+  find "$pkgdir/usr" -type d -exec chmod 755 {} +
+  chown -R root:root "$pkgdir"
 }
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 01:38:17	LOW	2
2026-08-18 00:03:42	LOW	2
2026-08-17 00:18:29	LOW	2
2026-08-16 00:03:42	LOW	2
2026-08-15 00:26:13	LOW	2
2026-08-14 00:03:41	LOW	2
2026-08-13 15:26:23	LOW	2