dredge

maintainer ShawnMcCool · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The npm install is used to locally install pnpm@9 for building the project's own frontend, not to install arbitrary external packages; this is a legitimate build step from the project's source, not a supply-chain risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The npm install is used to locally install pnpm@9 for building the project's own frontend, not to install arbitrary external packages; this is a legitimate build step from the project's source, not a supply-chain risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:36 npm install -g --prefix "$pnpm_home" pnpm@9 >/dev/null

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Shawn McCool <shawn@mccool.email>
    
      2pkgname=dredge
    
      3pkgver=0.15.0
    
      4pkgrel=1
    
      5pkgdesc="Ear-first practice looper: loop sections, slow them down pitch-preserving, drill passages"
    
      6arch=('x86_64')
    
      7url="https://github.com/ShawnMcCool/dredge"
    
      8license=('MIT')
    
      9depends=('rubberband' 'pipewire' 'webkit2gtk-4.1' 'gtk3')
    
      10makedepends=('rust' 'nodejs' 'npm' 'just' 'clang' 'pkgconf' 'git')
    
      11optdepends=('ffmpeg: MP3 export, extra container formats, and demucs stem export'
    
      12            'uv: bootstrap the analyze/songformer ML venvs (beats, sections)'
    
      13            'python: ML analysis runtime'
    
      14            'demucs: 4-stem separation (vocals/drums/bass/other)')
    
      15provides=('dredge')
    
      16conflicts=('dredge-looper-bin')
    
      17# rusqlite bundles + cc-compiles sqlite3.c; makepkg's default LTO makes that a
    
      18# GCC LTO object that Rust's lld can't link (undefined sqlite3_* symbols).
    
      19options=('!lto')
    
      20source=("git+https://github.com/ShawnMcCool/dredge.git#tag=v${pkgver}")
    
      21sha256sums=('SKIP')
    
      22
    
      23build() {
    
      24  cd "${srcdir}/${pkgname}"
    
      25  # Headless daemon.
    
      26  cargo build -p server --release
    
      27  # Desktop app — install frontend deps, then build without OS bundling
    
      28  # (we install the raw binaries ourselves below).
    
      29  cd apps/desktop
    
      30  # Pin pnpm to the version the project builds against (lockfile is v9, CI uses
    
      31  # pnpm 9) instead of the host's pnpm. Arch's rolling pnpm (>=10) requires
    
      32  # Node >=22.13 (it uses the node:sqlite builtin), so on a box with an older
    
      33  # system Node it crashes before installing anything. pnpm 9 runs across
    
      34  # Node 18-26+, so this builds regardless of the host's Node version.
    
      35  local pnpm_home="${srcdir}/.pnpm"
    
      36  npm install -g --prefix "$pnpm_home" pnpm@9 >/dev/null
    
      37  export PATH="$pnpm_home/bin:$PATH"
    
      38  pnpm install --frozen-lockfile
    
      39  pnpm tauri build --no-bundle
    
      40}
    
      41
    
      42package() {
    
      43  cd "${srcdir}/${pkgname}"
    
      44  install -Dm755 target/release/dredge                       "${pkgdir}/usr/bin/dredge"
    
      45  install -Dm755 target/release/dredged                      "${pkgdir}/usr/bin/dredged"
    
      46  install -Dm755 scripts/analyze                              "${pkgdir}/usr/bin/dredge-analyze"
    
      47  install -Dm755 scripts/dredge-enable-ml                    "${pkgdir}/usr/bin/dredge-enable-ml"
    
      48  install -Dm755 scripts/dredge-doctor                       "${pkgdir}/usr/bin/dredge-doctor"
    
      49  install -Dm644 scripts/analyze_impl.py                      "${pkgdir}/usr/lib/dredge/analyze_impl.py"
    
      50  install -Dm644 scripts/songformer_impl.py                   "${pkgdir}/usr/lib/dredge/songformer_impl.py"
    
      51  install -Dm644 dredge.desktop                              "${pkgdir}/usr/share/applications/dredge.desktop"
    
      52  install -Dm644 apps/desktop/src-tauri/icons/128x128@2x.png  "${pkgdir}/usr/share/icons/hicolor/256x256/apps/dredge.png"
    
      53}
    
      54

Changes since previous scan

--- PKGBUILD @ 2026-07-29 00:25
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,6 +1,6 @@
 # Maintainer: Shawn McCool <shawn@mccool.email>
 pkgname=dredge
-pkgver=0.14.2
+pkgver=0.15.0
 pkgrel=1
 pkgdesc="Ear-first practice looper: loop sections, slow them down pitch-preserving, drill passages"
 arch=('x86_64')

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 13:11:48	MEDIUM	1
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 21:55:56	MEDIUM	1
2026-07-17 00:06:16	LOW	2