dsh-desktop-git
LOW
maintainer Keep-Silence
0 votes
scanned 2026-10-31 00:07:41.364992
Why flagged
The npx commands execute project-local tools from the source repository, not remote code; the package builds from a fixed tag of the official upstream source with vendored patches for Linux support, posing no supply-chain risk.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The npx commands execute project-local tools from the source repository, not remote code; the package builds from a fixed tag of the official upstream source with vendored patches for Linux support, posing no supply-chain risk.
2 higher static findings superseded - not the current verdict (shown for transparency)
Medium
npx/bunx/deno executes a remote package
remote_code_tool
`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.
-
PKGBUILD:145
npx electron-vite build -
PKGBUILD:147
npx electron-builder --linux dir --x64 --publish never \
Medium
Recently orphaned & re-adopted
orphaned_readopted
This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.
PKGBUILD
2 offending line(s) highlighted
1
# Maintainer: Keep-Silence <keep137950@163.com>
2
# Contributor: xuewuerduo <xuewuerudo@gmail.com>
3
#
4
# dsh-desktop-git — DeepSeek Harness 的桌面客户端（从源码构建，Arch 原生打包）
5
# ===========================================================================
6
# 上游 Linux 说明：dataelement/dsh-desktop 只发布 macOS/Windows 安装包，README
7
# 明确标注 Linux“Not currently supported”。自 v0.11.0 起，构建链中的 Office
8
# 运行时准备（office:prepare）与打包后校验（afterPack）只接受 macOS/Windows，
9
# 直接 `npm run build` 会在 Linux 上报：
10
# Office runtime: unsupported native target linux/x64
11
#
12
# 本 PKGBUILD 因此不执行上游 `npm run build`，而是分步执行，并采用社区 Linux
13
# 打包工程 ethanrise/dsh-desktop（MIT）的两个适配脚本（按固定版本随包提供，
14
# 不修改上游源码）：
15
# - dsh-linux-patch-deps.mjs：修复 libreoffice-kit 在 asar 下的探测，
16
# 让 Linux 能走 WASM 回退；
17
# - dsh-linux-after-pack.cjs：替换上游 afterPack，跳过 Office 运行时校验。
18
#
19
# 由于上游未提供 Linux 版 Office Python 载荷，本包**不包含 Office 运行时**，
20
# DOCX/PPTX/XLSX 技能不可用；PPT 编辑/渲染仍可用。
21
#
22
# 版本策略：跟随上游最新 release tag（v 前缀，如 v0.12.0），排除带 - 后缀的
23
# test/rc/preview/beta 等预发布 tag；
24
# 构建时 prepare() 检出该 tag，保证打出的包与版本号严格对应同一份源码。
25
#
26
# 构建流程：
27
# 1. npm ci 安装依赖；postinstall 完成补丁、品牌资源注入
28
# 与 Electron 43 二进制下载
29
# 2. ppt:build electron-vite 构建前的模板/运行时就绪
30
# 3. electron-vite build 编译主进程、preload、renderer 与插件
31
# 4. electron-builder --linux dir => dist/linux-unpacked/
32
# 5. package() 安装 linux-unpacked 到 /opt/dsh-desktop，
33
# 写入 /usr/bin 软链、.desktop、hicolor 图标
34
#
35
# 依赖锁定在仓库的 package-lock.json（resolved 指向 npmmirror，公开镜像全球可访问），
36
# 直接按 lockfile 安装即可。注意：不要用 replace-registry-host=always 强改 registry，
37
# 否则 file: 本地依赖的路径会被误改写成 registry URL 导致 404。
38
39
40
pkgname=dsh-desktop-git
41
pkgver=0.12.1
42
pkgrel=1
43
pkgdesc='Cross-platform desktop shell for DeepSeek Harness: local Agent runtime, model providers, mobile phone pairing, editable PPTX generation (Linux build without the bundled Office runtime)'
44
arch=('x86_64')
45
url='https://github.com/dataelement/dsh-desktop'
46
license=('MIT')
47
install=dsh-desktop-git.install
48
49
depends=('alsa-lib'
50
'at-spi2-core'
51
'brotli'
52
'c-ares'
53
'flac'
54
'fontconfig'
55
'freetype2'
56
'gcc-libs'
57
'glibc'
58
'gtk3'
59
'harfbuzz'
60
'libdrm'
61
'libevent'
62
'libffi'
63
'libjpeg-turbo'
64
'libnotify'
65
'libpulse'
66
'libsecret'
67
'libxcomposite'
68
'libxdamage'
69
'libxkbcommon'
70
'libxrandr'
71
'libxss'
72
'libxtst'
73
'libxml2'
74
'libxslt'
75
'minizip'
76
'nss'
77
'opus'
78
'util-linux'
79
'xdg-utils'
80
'zlib')
81
makedepends=('git'
82
'imagemagick'
83
'nodejs>=22'
84
'npm')
85
optdepends=('libappindicator-gtk3: system tray icon support'
86
'pipewire: WebRTC desktop sharing under Wayland')
87
provides=('dsh-desktop')
88
conflicts=('dsh-desktop')
89
# Electron/Chromium 二进制不能被 strip，否则可能无法启动
90
options=('!strip')
91
92
source=("$pkgname::git+https://github.com/dataelement/dsh-desktop.git"
93
'dsh-desktop.desktop'
94
'dsh-linux-after-pack.cjs'
95
'dsh-linux-patch-deps.mjs')
96
sha256sums=('SKIP'
97
'e61601b9dff6b609c097bc1af53c7c9b684472cb382ff840200040f0e355dfea'
98
'8683aefb28c9a23f29acc58dd9269b4cbc288ff754315b507a7d9120574aafb6'
99
'cdddf8134576a201f8cdca2f4b707b95bed0859a5891b9690e013cab5272d806')
100
101
# 最新 v 前缀 release tag（按版本号降序取第一个）
102
_latest_tag() {
103
local tag
104
# 带 - 的 tag（v0.10.0-beta、v0.9.0-test 等）是预发布版本，一律排除
105
tag=$(git for-each-ref --sort=-v:refname --format='%(refname:short)' 'refs/tags/v[0-9]*' \
106
| grep -v -- '-' | head -1)
107
if [[ -z "$tag" ]]; then
108
# 兜底：没有任何 v 前缀 tag 时退回 HEAD 短哈希
109
tag="v0.0.0.r$(git rev-list --count HEAD).g$(git rev-parse --short=7 HEAD)"
110
fi
111
printf '%s' "$tag"
112
}
113
114
pkgver() {
115
cd "$srcdir/$pkgname"
116
local tag
117
tag=$(_latest_tag)
118
printf '%s' "${tag#v}"
119
}
120
121
prepare() {
122
cd "$srcdir/$pkgname"
123
# 检出最新 release tag，保证构建的源码与版本号一致
124
git checkout -q -f "$(_latest_tag)"
125
}
126
127
build() {
128
cd "$srcdir/$pkgname"
129
130
export npm_config_audit=false
131
export npm_config_fund=false
132
133
npm ci
134
135
# 上游 office:prepare / afterPack 仅支持 macOS/Windows，见文件头说明。
136
node "$srcdir/dsh-linux-patch-deps.mjs" .
137
138
# 不打包 Office 运行时（上游无 Linux 载荷）；空目录用于满足 extraResources
139
rm -rf .build/office-runtime
140
mkdir -p .build/office-runtime
141
export LINUX_NO_OFFICE_RUNTIME=1
142
143
# 依次执行上游 `npm run build` 的各步骤，跳过 office:prepare
144
npm run --if-present ppt:build
145
npx electron-vite build
146
147
npx electron-builder --linux dir --x64 --publish never \
148
-c.electronDist="$PWD/node_modules/electron/dist" \
149
-c.afterPack="$srcdir/dsh-linux-after-pack.cjs"
150
}
151
152
package() {
153
cd "$srcdir/$pkgname"
154
155
local appdir="$pkgdir/opt/dsh-desktop"
156
[[ -d dist/linux-unpacked ]] || { echo "error: dist/linux-unpacked not found" >&2; exit 1; }
157
158
# 应用本体（cp -r 而非 cp -a：所有权由 fakeroot 统一记为 root:root）
159
install -d "$appdir"
160
cp -r dist/linux-unpacked/. "$appdir/"
161
162
# 命令行入口
163
install -d "$pkgdir/usr/bin"
164
ln -s /opt/dsh-desktop/dsh-desktop "$pkgdir/usr/bin/dsh-desktop"
165
166
# .desktop 启动项
167
install -Dm644 "$srcdir/dsh-desktop.desktop" \
168
"$pkgdir/usr/share/applications/dsh-desktop.desktop"
169
170
# hicolor 图标：上游未提交 Linux 图标，从 build/app-icon.png 现场生成
171
local size icon
172
for size in 16 32 48 64 128 256 512; do
173
icon="$pkgdir/usr/share/icons/hicolor/${size}x${size}/apps/dsh-desktop.png"
174
install -d "$(dirname "$icon")"
175
magick build/app-icon.png -resize "${size}x${size}" "$icon"
176
done
177
178
# 许可证
179
install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
180
}
181
Changes since previous scan
--- PKGBUILD @ 2026-10-26 11:44+++ PKGBUILD @ 2026-10-31 00:07@@ -1,23 +1,35 @@-# Maintainer: xuewuerduo <xuewuerudo@gmail.com>+# Maintainer: Keep-Silence <keep137950@163.com>+# Contributor: xuewuerduo <xuewuerudo@gmail.com> # # dsh-desktop-git — DeepSeek Harness 的桌面客户端（从源码构建，Arch 原生打包） # ===========================================================================-# DSH Desktop 官方没有发布 Linux 二进制（Linux 包一直是“从源码本地构建”），-# 因此本 PKGBUILD 直接克隆官方源仓库，按官方流程构建出 Electron 应用本体，-# 再以 Arch 原生布局安装（/opt/dsh-desktop + .desktop + hicolor 图标），+# 上游 Linux 说明：dataelement/dsh-desktop 只发布 macOS/Windows 安装包，README+# 明确标注 Linux“Not currently supported”。自 v0.11.0 起，构建链中的 Office+# 运行时准备（office:prepare）与打包后校验（afterPack）只接受 macOS/Windows，+# 直接 `npm run build` 会在 Linux 上报：+# Office runtime: unsupported native target linux/x64 #-# 版本策略：跟随上游最新 release tag（v 前缀，如 v0.9.0），排除 test/rc/preview tag；+# 本 PKGBUILD 因此不执行上游 `npm run build`，而是分步执行，并采用社区 Linux+# 打包工程 ethanrise/dsh-desktop（MIT）的两个适配脚本（按固定版本随包提供，+# 不修改上游源码）：+# - dsh-linux-patch-deps.mjs：修复 libreoffice-kit 在 asar 下的探测，+# 让 Linux 能走 WASM 回退；+# - dsh-linux-after-pack.cjs：替换上游 afterPack，跳过 Office 运行时校验。+#+# 由于上游未提供 Linux 版 Office Python 载荷，本包**不包含 Office 运行时**，+# DOCX/PPTX/XLSX 技能不可用；PPT 编辑/渲染仍可用。+#+# 版本策略：跟随上游最新 release tag（v 前缀，如 v0.12.0），排除带 - 后缀的+# test/rc/preview/beta 等预发布 tag； # 构建时 prepare() 检出该 tag，保证打出的包与版本号严格对应同一份源码。 # # 构建流程：-# 1. npm ci 安装依赖；postinstall 自动完成-# - patch-package 补丁-# - 品牌资源注入-# - 下载 Electron 43 二进制（GitHub Releases）-# - 安装捆绑的 Node.js 运行时（nodejs.org）-# 2. npm run package:dir electron-vite build + electron-builder --dir-# => dist/linux-unpacked/（应用本体）-# 3. package() 安装 linux-unpacked 到 /opt/dsh-desktop，+# 1. npm ci 安装依赖；postinstall 完成补丁、品牌资源注入+# 与 Electron 43 二进制下载+# 2. ppt:build electron-vite 构建前的模板/运行时就绪+# 3. electron-vite build 编译主进程、preload、renderer 与插件+# 4. electron-builder --linux dir => dist/linux-unpacked/+# 5. package() 安装 linux-unpacked 到 /opt/dsh-desktop， # 写入 /usr/bin 软链、.desktop、hicolor 图标 # # 依赖锁定在仓库的 package-lock.json（resolved 指向 npmmirror，公开镜像全球可访问），@@ -26,12 +38,13 @@ pkgname=dsh-desktop-git-pkgver=0.9.0-pkgrel=2-pkgdesc='Cross-platform desktop shell for DeepSeek Harness: local Agent runtime, model providers, mobile phone pairing, editable PPTX generation'+pkgver=0.12.1+pkgrel=1+pkgdesc='Cross-platform desktop shell for DeepSeek Harness: local Agent runtime, model providers, mobile phone pairing, editable PPTX generation (Linux build without the bundled Office runtime)' arch=('x86_64') url='https://github.com/dataelement/dsh-desktop' license=('MIT')+install=dsh-desktop-git.install depends=('alsa-lib' 'at-spi2-core'@@ -73,15 +86,24 @@ 'pipewire: WebRTC desktop sharing under Wayland') provides=('dsh-desktop') conflicts=('dsh-desktop')+# Electron/Chromium 二进制不能被 strip，否则可能无法启动+options=('!strip')+ source=("$pkgname::git+https://github.com/dataelement/dsh-desktop.git"- 'dsh-desktop.desktop')+ 'dsh-desktop.desktop'+ 'dsh-linux-after-pack.cjs'+ 'dsh-linux-patch-deps.mjs') sha256sums=('SKIP'- 'e61601b9dff6b609c097bc1af53c7c9b684472cb382ff840200040f0e355dfea')+ 'e61601b9dff6b609c097bc1af53c7c9b684472cb382ff840200040f0e355dfea'+ '8683aefb28c9a23f29acc58dd9269b4cbc288ff754315b507a7d9120574aafb6'+ 'cdddf8134576a201f8cdca2f4b707b95bed0859a5891b9690e013cab5272d806') # 最新 v 前缀 release tag（按版本号降序取第一个） _latest_tag() { local tag- tag=$(git for-each-ref --sort=-v:refname --format='%(refname:short)' 'refs/tags/v[0-9]*' | head -1)+ # 带 - 的 tag（v0.10.0-beta、v0.9.0-test 等）是预发布版本，一律排除+ tag=$(git for-each-ref --sort=-v:refname --format='%(refname:short)' 'refs/tags/v[0-9]*' \+ | grep -v -- '-' | head -1) if [[ -z "$tag" ]]; then # 兜底：没有任何 v 前缀 tag 时退回 HEAD 短哈希 tag="v0.0.0.r$(git rev-list --count HEAD).g$(git rev-parse --short=7 HEAD)"@@ -99,7 +121,7 @@ prepare() { cd "$srcdir/$pkgname" # 检出最新 release tag，保证构建的源码与版本号一致- git checkout -q "$(_latest_tag)"+ git checkout -q -f "$(_latest_tag)" } build() {@@ -108,10 +130,23 @@ export npm_config_audit=false export npm_config_fund=false - # Electron 二进制按官方默认源下载（GitHub）+ npm ci - npm ci- npm run package:dir+ # 上游 office:prepare / afterPack 仅支持 macOS/Windows，见文件头说明。+ node "$srcdir/dsh-linux-patch-deps.mjs" .++ # 不打包 Office 运行时（上游无 Linux 载荷）；空目录用于满足 extraResources+ rm -rf .build/office-runtime+ mkdir -p .build/office-runtime+ export LINUX_NO_OFFICE_RUNTIME=1++ # 依次执行上游 `npm run build` 的各步骤，跳过 office:prepare+ npm run --if-present ppt:build+ npx electron-vite build++ npx electron-builder --linux dir --x64 --publish never \+ -c.electronDist="$PWD/node_modules/electron/dist" \+ -c.afterPack="$srcdir/dsh-linux-after-pack.cjs" } package() {Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-31 00:07:41 | Low | 3 |
| 2026-10-30 00:29:30 | Low | 3 |
| 2026-10-29 00:13:55 | Low | 3 |
| 2026-10-28 13:50:29 | Medium | 2 |
| 2026-10-28 00:06:54 | Low | 3 |
| 2026-10-27 00:23:28 | Low | 3 |
| 2026-10-26 15:45:54 | Medium | 2 |
| 2026-10-26 11:44:54 | Medium | 1 |
| 2026-10-01 00:02:06 | Clean | 0 |
| 2026-09-30 00:20:07 | Low | 2 |
| 2026-09-29 00:07:46 | Low | 2 |
| 2026-09-28 00:28:32 | Low | 2 |
| 2026-09-27 00:07:07 | Low | 2 |
| 2026-09-26 00:12:15 | Low | 2 |
| 2026-09-25 00:03:36 | Low | 2 |
| 2026-09-24 00:24:14 | Low | 2 |
| 2026-09-23 00:28:13 | Low | 2 |
| 2026-09-22 00:15:14 | Low | 2 |
| 2026-09-21 00:26:32 | Low | 2 |
| 2026-09-20 00:25:31 | Low | 2 |