drawio-desktop-git

MEDIUM
maintainer zxp19821005 1 votes scanned 2026-09-29 01:22:50.448130
View on AUR
Why flagged

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

Triggered rules

Medium npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

  • PKGBUILD:119 bunx electron-builder --linux dir -c.electronDist="${ELECTRON_DIST}" --config=electron-builder-linux-mac.json

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2_pkgname=draw.io
3pkgname="${_pkgname//./}-desktop-git"
4pkgver=31.5.3.r2.g800a2d0
5_electronversion=44
6_nodeversion=24
7pkgrel=1
8pkgdesc="A diagramming and whiteboarding desktop app based on Electron that wraps the core draw.io editor."
9arch=('any')
10url="https://www.diagrams.net/"
11_ghurl="https://github.com/jgraph/drawio-desktop"
12license=('Apache-2.0')
13provides=("${pkgname%-git}=${pkgver}")
14conflicts=("${pkgname%-git}")
15depends=(
16 "electron${_electronversion}"
17)
18makedepends=(
19 'gendesk'
20 'git'
21 'bun'
22 'nvm'
23 'libicns'
24 'imagemagick'
25 'jq'
26)
27source=(
28 "${pkgname%-git}.git::git+${_ghurl}.git"
29 "${pkgname%-git}.xml"
30 "${pkgname%-git}.sh"
31)
32sha256sums=('SKIP'
33 'a4e054e91cdbea6fe37c0767460816a951bc7876b5855752898f6575d15f23e6'
34 'bd5358d8f323d3c2c2f0733364ee4ea55f551dd86ba0be2a76846210b60897fc')
35_get_project_dir() {
36 local d
37 while IFS= read -r d; do
38 find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
39 done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
40}
41pkgver() {
42 cd "$(_get_project_dir)"
43 set -o pipefail
44 git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
45 printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
46}
47_ensure_local_nvm() {
48 local NVM_DIR="${srcdir}/.nvm"
49 source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
50 nvm install "${_nodeversion}"
51 nvm use "${_nodeversion}"
52}
53_get_app_dir() {
54 find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1
55}
56_set_build_env() {
57 export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
58 export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
59 export ELECTRON_SKIP_BINARY_DOWNLOAD=1
60 export ELECTRON_BUILDER_OFFLINE=true
61 export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
62 export HOME="${srcdir}/.home"
63 export XDG_CACHE_HOME="${HOME}/.cache"
64 export XDG_CONFIG_HOME="${HOME}/.config"
65 export XDG_DATA_HOME="${HOME}/.local/share"
66 export BUN_INSTALL_CACHE_DIR="${HOME}/.bun/cache"
67 export BUN_INSTALL_GLOBAL_DIR="${HOME}/.bun/global"
68 export BUN_INSTALL_BIN="${HOME}/.bun/bin"
69 export BUN_CONFIG_SKIP_SAVE_LOCKFILE=1
70 export BUN_CONFIG_SKIP_LOAD_LOCKFILE=1
71 export BUN_DISABLE_DOTENV=1
72 export DO_NOT_TRACK=1
73 export BUN_JOBS="$(nproc)"
74 mkdir -p "${HOME}" "${BUN_INSTALL_CACHE_DIR}" "${BUN_INSTALL_GLOBAL_DIR}" "${BUN_INSTALL_BIN}"
75}
76_get_electron_version() {
77 _elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
78 | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
79 | grep -v '^$' | sed 's/^[^0-9]*//' | head -1)
80 [[ -z "${_elec_ver}" ]] && return 1
81 echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
82}
83prepare() {
84 cd "$(_get_project_dir)"
85 _get_electron_version
86 sed -i -e "
87 s/@electronversion@/${_electronversion}/g
88 s/@appname@/${pkgname%-git}/g
89 s/@runname@/app.asar/g
90 s/@cfgdirname@/${_pkgname}/g
91 " "${srcdir}/${pkgname%-git}.sh"
92 gendesk -q -f -n \
93 --pkgname="${pkgname%-git}" \
94 --pkgdesc="${pkgdesc}" \
95 --categories="Graphics" \
96 --name="${_pkgname}" \
97 --exec="${pkgname%-git} %U" \
98 --mimetypes="application/vnd.jgraph.mxfile;application/vnd.ms-visio.drawing.main+xml"
99 _set_build_env
100 _ensure_local_nvm
101 sed -i "/StartupWMClass/d" electron-builder-linux-mac.json
102 sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g" package.json
103 git submodule update --depth=1 --init --recursive
104 cd "$(_get_project_dir)/drawio"
105 rm -rf docs etc src/main/java src/main/webapp/connect src/main/webapp/service-worker* src/main/webapp/workbox-*
106 cd "$(_get_project_dir)/drawio/src/main/webapp/js"
107 rm -rf atlas-viewer.min.js atlas.min.js cryptojs deflate dropbox embed* freehand integrate.min.js jquery jszip \
108 mermaid onedrive orgchart reader.min.js rough sanitizer shapes.min.js simplepeer spin viewer-static.min.js viewer.min.js
109 cd "$(_get_project_dir)"
110 export NODE_ENV=development
111 bun install
112}
113build() {
114 cd "$(_get_project_dir)"
115 _set_build_env
116 _ensure_local_nvm
117 export NODE_ENV=development
118 bun run sync
119 bunx electron-builder --linux dir -c.electronDist="${ELECTRON_DIST}" --config=electron-builder-linux-mac.json
120}
121package() {
122 install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
123 install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-git}"
124 local _app_dir=$(_get_app_dir)
125 cp -a "${_app_dir}/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"
126 local _src="$(_get_project_dir)"
127 install -Dm644 "${_src}/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
128 _icon_sizes=(16x16 32x32 48x48 64x64 96x96 128x128 192x192 256x256 512x512 720x720 1024x1024)
129 for _icons in "${_icon_sizes[@]}";do
130 install -Dm644 "${_src}/build/${_icons}.png" \
131 "${pkgdir}/usr/share/icons/hicolor/${_icons}/apps/${pkgname%-git}.png"
132 done
133 install -Dm644 "${_src}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
134 install -Dm644 "${srcdir}/${pkgname%-git}.xml" -t "${pkgdir}/usr/share/mime/packages"
135}
136

Changes since previous scan

--- PKGBUILD @ 2026-09-17 07:25
+++ PKGBUILD @ 2026-09-29 01:22
@@ -1,7 +1,7 @@
# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
_pkgname=draw.io
pkgname="${_pkgname//./}-desktop-git"
-pkgver=31.4.5.r1.gf5cc222
+pkgver=31.5.3.r2.g800a2d0
_electronversion=44
_nodeversion=24
pkgrel=1
@@ -18,12 +18,10 @@
makedepends=(
'gendesk'
'git'
- 'pnpm'
- 'npm'
+ 'bun'
'nvm'
'libicns'
'imagemagick'
- 'curl'
'jq'
)
source=(
@@ -33,9 +31,15 @@
)
sha256sums=('SKIP'
'a4e054e91cdbea6fe37c0767460816a951bc7876b5855752898f6575d15f23e6'
- 'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
+ 'bd5358d8f323d3c2c2f0733364ee4ea55f551dd86ba0be2a76846210b60897fc')
+_get_project_dir() {
+ local d
+ while IFS= read -r d; do
+ find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
+ done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
+}
pkgver() {
- cd "${srcdir}/${pkgname%-git}.git"
+ cd "$(_get_project_dir)"
set -o pipefail
git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
@@ -53,28 +57,31 @@
export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
export ELECTRON_SKIP_BINARY_DOWNLOAD=1
- _ev="$(electron${_electronversion} -v)"
- export SYSTEM_ELECTRON_VERSION="${_ev#v}"
- export HOME="${srcdir}/.electron-gyp"
- export XDG_CACHE_HOME="${srcdir}/.cache"
- export XDG_CONFIG_HOME="${srcdir}/.config"
- export XDG_DATA_HOME="${srcdir}/.local/share"
- export npm_config_cache="${srcdir}/.npm_cache"
- export npm_config_maxsockets=32
- export npm_config_audit=false
- export npm_config_fund=false
- export npm_config_progress=false
- export NODE_OPTIONS="--max-old-space-size=4096"
- export npm_config_node_options="--max-old-space-size=4096"
+ export ELECTRON_BUILDER_OFFLINE=true
+ export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
+ export HOME="${srcdir}/.home"
+ export XDG_CACHE_HOME="${HOME}/.cache"
+ export XDG_CONFIG_HOME="${HOME}/.config"
+ export XDG_DATA_HOME="${HOME}/.local/share"
+ export BUN_INSTALL_CACHE_DIR="${HOME}/.bun/cache"
+ export BUN_INSTALL_GLOBAL_DIR="${HOME}/.bun/global"
+ export BUN_INSTALL_BIN="${HOME}/.bun/bin"
+ export BUN_CONFIG_SKIP_SAVE_LOCKFILE=1
+ export BUN_CONFIG_SKIP_LOAD_LOCKFILE=1
+ export BUN_DISABLE_DOTENV=1
+ export DO_NOT_TRACK=1
+ export BUN_JOBS="$(nproc)"
+ mkdir -p "${HOME}" "${BUN_INSTALL_CACHE_DIR}" "${BUN_INSTALL_GLOBAL_DIR}" "${BUN_INSTALL_BIN}"
}
_get_electron_version() {
- _elec_ver=$(find "${srcdir}" -maxdepth 5 -name "package.json" ! -path "*/node_modules/*" \
- -exec grep -l '"electron"' {} + | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null | head -1)
- [[ -z "${_elec_ver}" ]] && return 1
- echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
+ _elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
+ | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
+ | grep -v '^$' | sed 's/^[^0-9]*//' | head -1)
+ [[ -z "${_elec_ver}" ]] && return 1
+ echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
}
prepare() {
- cd "${srcdir}/${pkgname%-git}.git"
+ cd "$(_get_project_dir)"
_get_electron_version
sed -i -e "
s/@electronversion@/${_electronversion}/g
@@ -94,33 +101,36 @@
sed -i "/StartupWMClass/d" electron-builder-linux-mac.json
sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g" package.json
git submodule update --depth=1 --init --recursive
- cd "${srcdir}/${pkgname%-git}.git/drawio"
+ cd "$(_get_project_dir)/drawio"
rm -rf docs etc src/main/java src/main/webapp/connect src/main/webapp/service-worker* src/main/webapp/workbox-*
- cd "${srcdir}/${pkgname%-git}.git/drawio/src/main/webapp/js"
+ cd "$(_get_project_dir)/drawio/src/main/webapp/js"
rm -rf atlas-viewer.min.js atlas.min.js cryptojs deflate dropbox embed* freehand integrate.min.js jquery jszip \
mermaid onedrive orgchart reader.min.js rough sanitizer shapes.min.js simplepeer spin viewer-static.min.js viewer.min.js
- cd "${srcdir}/${pkgname%-git}.git"
- NODE_ENV=development npm install --legacy-peer-deps
+ cd "$(_get_project_dir)"
+ export NODE_ENV=development
+ bun install
}
build() {
- cd "${srcdir}/${pkgname%-git}.git"
+ cd "$(_get_project_dir)"
_set_build_env
_ensure_local_nvm
- NODE_ENV=development npm run sync
- NODE_ENV=production npm exec -c "electron-builder --linux dir -c.electronDist=${ELECTRON_DIST} --config=electron-builder-linux-mac.json"
+ export NODE_ENV=development
+ bun run sync
+ bunx electron-builder --linux dir -c.electronDist="${ELECTRON_DIST}" --config=electron-builder-linux-mac.json
}
package() {
install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-git}"
local _app_dir=$(_get_app_dir)
cp -a "${_app_dir}/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"
- install -Dm644 "${srcdir}/${pkgname%-git}.git/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
+ local _src="$(_get_project_dir)"
+ install -Dm644 "${_src}/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
_icon_sizes=(16x16 32x32 48x48 64x64 96x96 128x128 192x192 256x256 512x512 720x720 1024x1024)
for _icons in "${_icon_sizes[@]}";do
- install -Dm644 "${srcdir}/${pkgname%-git}.git/build/${_icons}.png" \
+ install -Dm644 "${_src}/build/${_icons}.png" \
"${pkgdir}/usr/share/icons/hicolor/${_icons}/apps/${pkgname%-git}.png"
done
- install -Dm644 "${srcdir}/${pkgname%-git}.git/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
+ install -Dm644 "${_src}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
install -Dm644 "${srcdir}/${pkgname%-git}.xml" -t "${pkgdir}/usr/share/mime/packages"
}

Scan history

Scanned at (UTC)SeverityRules
2026-09-29 01:22:50 Medium 1
2026-09-17 07:25:15 Clean 0
2026-06-18 16:11:54 Clean 0

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion