dredge

LOW

maintainer ShawnMcCool 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The npm install is used to locally install a specific version of pnpm (a package manager) as a build tool, not to install external runtime dependencies, and is part of a standard, reproducible build process from the project's own source.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The npm install is used to locally install a specific version of pnpm (a package manager) as a build tool, not to install external runtime dependencies, and is part of a standard, reproducible build process from the project's own source.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:38 npm install -g --prefix "$pnpm_home" pnpm@9 >/dev/null

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Shawn McCool <shawn@mccool.email>
    
      2pkgname=dredge
    
      3pkgver=0.16.0
    
      4pkgrel=1
    
      5pkgdesc="Ear-first practice looper: loop sections, slow them down pitch-preserving, drill passages"
    
      6arch=('x86_64')
    
      7url="https://github.com/ShawnMcCool/dredge"
    
      8# MIT for dredge itself; the binaries bundle Rubber Band (GPL-2.0-or-later),
    
      9# so the distributed work is GPL-governed.
    
      10license=('MIT AND GPL-2.0-or-later')
    
      11depends=('pipewire' 'webkit2gtk-4.1' 'gtk3')
    
      12makedepends=('rust' 'nodejs' 'npm' 'just' 'clang' 'pkgconf' 'git')
    
      13optdepends=('ffmpeg: MP3 export, extra container formats, and demucs stem export'
    
      14            'uv: bootstrap the analyze/songformer ML venvs (beats, sections)'
    
      15            'python: ML analysis runtime'
    
      16            'demucs: 4-stem separation (vocals/drums/bass/other)')
    
      17provides=('dredge')
    
      18conflicts=('dredge-looper-bin')
    
      19# rusqlite bundles + cc-compiles sqlite3.c; makepkg's default LTO makes that a
    
      20# GCC LTO object that Rust's lld can't link (undefined sqlite3_* symbols).
    
      21options=('!lto')
    
      22source=("git+https://github.com/ShawnMcCool/dredge.git#tag=v${pkgver}")
    
      23sha256sums=('SKIP')
    
      24
    
      25build() {
    
      26  cd "${srcdir}/${pkgname}"
    
      27  # Headless daemon.
    
      28  cargo build -p server --release
    
      29  # Desktop app — install frontend deps, then build without OS bundling
    
      30  # (we install the raw binaries ourselves below).
    
      31  cd apps/desktop
    
      32  # Pin pnpm to the version the project builds against (lockfile is v9, CI uses
    
      33  # pnpm 9) instead of the host's pnpm. Arch's rolling pnpm (>=10) requires
    
      34  # Node >=22.13 (it uses the node:sqlite builtin), so on a box with an older
    
      35  # system Node it crashes before installing anything. pnpm 9 runs across
    
      36  # Node 18-26+, so this builds regardless of the host's Node version.
    
      37  local pnpm_home="${srcdir}/.pnpm"
    
      38  npm install -g --prefix "$pnpm_home" pnpm@9 >/dev/null
    
      39  export PATH="$pnpm_home/bin:$PATH"
    
      40  pnpm install --frozen-lockfile
    
      41  pnpm tauri build --no-bundle
    
      42}
    
      43
    
      44package() {
    
      45  cd "${srcdir}/${pkgname}"
    
      46  install -Dm755 target/release/dredge                       "${pkgdir}/usr/bin/dredge"
    
      47  install -Dm755 target/release/dredged                      "${pkgdir}/usr/bin/dredged"
    
      48  install -Dm755 scripts/analyze                              "${pkgdir}/usr/bin/dredge-analyze"
    
      49  install -Dm755 scripts/dredge-enable-ml                    "${pkgdir}/usr/bin/dredge-enable-ml"
    
      50  install -Dm755 scripts/dredge-doctor                       "${pkgdir}/usr/bin/dredge-doctor"
    
      51  install -Dm644 scripts/analyze_impl.py                      "${pkgdir}/usr/lib/dredge/analyze_impl.py"
    
      52  install -Dm644 scripts/songformer_impl.py                   "${pkgdir}/usr/lib/dredge/songformer_impl.py"
    
      53  install -Dm644 dredge.desktop                              "${pkgdir}/usr/share/applications/dredge.desktop"
    
      54  install -Dm644 apps/desktop/src-tauri/icons/128x128@2x.png  "${pkgdir}/usr/share/icons/hicolor/256x256/apps/dredge.png"
    
      55}
    
      56

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2