dsh-desktop-git

LOW

maintainer xuewuerduo 0 votes scanned 2026-09-16 03:21:15.990005

View on AUR

Why flagged

Package builds from official source via git, uses locked dependencies and checksums; only risk is low-severity due to SKIP'd source integrity check on git repo, but build process is transparent and follows upstream release tags.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): Package builds from official source via git, uses locked dependencies and checksums; only risk is low-severity due to SKIP'd source integrity check on git repo, but build process is transparent and follows upstream release tags.

PKGBUILD

      1# Maintainer: xuewuerduo <xuewuerudo@gmail.com>
    
      2#
    
      3# dsh-desktop-git — DeepSeek Harness 的桌面客户端（从源码构建，Arch 原生打包）
    
      4# ===========================================================================
    
      5# DSH Desktop 官方没有发布 Linux 二进制（Linux 包一直是“从源码本地构建”），
    
      6# 因此本 PKGBUILD 直接克隆官方源仓库，按官方流程构建出 Electron 应用本体，
    
      7# 再以 Arch 原生布局安装（/opt/dsh-desktop + .desktop + hicolor 图标），
    
      8# 不经过 .deb/fpm。
    
      9#
    
      10# 版本策略：跟随上游最新 release tag（v 前缀，如 v0.9.0），排除 test/rc/preview tag；
    
      11# 构建时 prepare() 检出该 tag，保证打出的包与版本号严格对应同一份源码。
    
      12#
    
      13# 构建流程：
    
      14#   1. npm ci                安装依赖；postinstall 自动完成
    
      15#                             - patch-package 补丁
    
      16#                             - 品牌资源注入
    
      17#                             - 下载 Electron 43 二进制（GitHub Releases）
    
      18#                             - 安装捆绑的 Node.js 运行时（nodejs.org）
    
      19#   2. npm run package:dir   electron-vite build + electron-builder --dir
    
      20#                             => dist/linux-unpacked/（应用本体）
    
      21#   3. package()              安装 linux-unpacked 到 /opt/dsh-desktop，
    
      22#                             写入 /usr/bin 软链、.desktop、hicolor 图标
    
      23#
    
      24# 依赖锁定在仓库的 package-lock.json（resolved 指向 npmmirror，公开镜像全球可访问），
    
      25# 直接按 lockfile 安装即可。注意：不要用 replace-registry-host=always 强改 registry，
    
      26# 否则 file: 本地依赖的路径会被误改写成 registry URL 导致 404。
    
      27# 国内构建：build() 会自动探测 GitHub，不可达时自动用 npmmirror 加速下载 Electron
    
      28# （也可手动覆盖：ELECTRON_MIRROR=... makepkg）。npm 依赖本身已走 lockfile 的 npmmirror。
    
      29
    
      30pkgname=dsh-desktop-git
    
      31pkgver=0.9.0
    
      32pkgrel=1
    
      33pkgdesc='Cross-platform desktop shell for DeepSeek Harness: local Agent runtime, model providers, mobile phone pairing, editable PPTX generation'
    
      34arch=('x86_64')
    
      35url='https://github.com/dataelement/dsh-desktop'
    
      36license=('MIT')
    
      37# 运行时依赖 = 应用自带 Electron/Node 运行时所需的系统库
    
      38# （参照官方 .deb 声明的 Depends + Arch electron 的依赖）
    
      39depends=('alsa-lib'
    
      40         'at-spi2-core'
    
      41         'brotli'
    
      42         'c-ares'
    
      43         'flac'
    
      44         'fontconfig'
    
      45         'freetype2'
    
      46         'gcc-libs'
    
      47         'glibc'
    
      48         'gtk3'
    
      49         'harfbuzz'
    
      50         'libdrm'
    
      51         'libevent'
    
      52         'libffi'
    
      53         'libjpeg-turbo'
    
      54         'libnotify'
    
      55         'libpulse'
    
      56         'libsecret'
    
      57         'libxcomposite'
    
      58         'libxdamage'
    
      59         'libxkbcommon'
    
      60         'libxrandr'
    
      61         'libxss'
    
      62         'libxtst'
    
      63         'libxml2'
    
      64         'libxslt'
    
      65         'minizip'
    
      66         'nss'
    
      67         'opus'
    
      68         'util-linux'
    
      69         'xdg-utils'
    
      70         'zlib')
    
      71makedepends=('curl'
    
      72             'git'
    
      73             'imagemagick'
    
      74             'nodejs>=22'
    
      75             'npm')
    
      76optdepends=('libappindicator-gtk3: system tray icon support'
    
      77            'pipewire: WebRTC desktop sharing under Wayland')
    
      78provides=('dsh-desktop')
    
      79conflicts=('dsh-desktop')
    
      80source=("$pkgname::git+https://github.com/dataelement/dsh-desktop.git"
    
      81        'dsh-desktop.desktop')
    
      82sha256sums=('SKIP'
    
      83            'e61601b9dff6b609c097bc1af53c7c9b684472cb382ff840200040f0e355dfea')
    
      84
    
      85# 最新 v 前缀 release tag（按版本号降序取第一个；v 前缀天然排除 test/rc/preview）
    
      86_latest_tag() {
    
      87  local tag
    
      88  tag=$(git for-each-ref --sort=-v:refname --format='%(refname:short)' 'refs/tags/v[0-9]*' | head -1)
    
      89  if [[ -z "$tag" ]]; then
    
      90    # 兜底：没有任何 v 前缀 tag 时退回 HEAD 短哈希
    
      91    tag="v0.0.0.r$(git rev-list --count HEAD).g$(git rev-parse --short=7 HEAD)"
    
      92  fi
    
      93  printf '%s' "$tag"
    
      94}
    
      95
    
      96pkgver() {
    
      97  cd "$srcdir/$pkgname"
    
      98  local tag
    
      99  tag=$(_latest_tag)
    
      100  printf '%s' "${tag#v}"
    
      101}
    
      102
    
      103prepare() {
    
      104  cd "$srcdir/$pkgname"
    
      105  # 检出最新 release tag，保证构建的源码与版本号一致
    
      106  git checkout -q "$(_latest_tag)"
    
      107}
    
      108
    
      109build() {
    
      110  cd "$srcdir/$pkgname"
    
      111
    
      112  export npm_config_audit=false
    
      113  export npm_config_fund=false
    
      114
    
      115  # 下载加速：Electron 二进制（postinstall 与 electron-builder 都会下载）。
    
      116  # 若未显式指定 ELECTRON_MIRROR，且官方源 GitHub 10 秒内不可达（国内常见），
    
      117  # 自动切换到 npmmirror 国内加速镜像；官方源可达则保持默认。
    
      118  if [[ -z "${ELECTRON_MIRROR:-}" ]] && ! timeout 10 curl -fsI https://github.com >/dev/null 2>&1; then
    
      119    export ELECTRON_MIRROR='https://npmmirror.com/mirrors/electron/'
    
      120    echo "==> GitHub 不可达，Electron 下载已切换到 npmmirror 国内加速镜像"
    
      121    echo "==> 如需官方源可自行: ELECTRON_MIRROR='https://github.com/electron/electron/releases/download/' makepkg"
    
      122  fi
    
      123
    
      124  npm ci
    
      125  npm run package:dir
    
      126}
    
      127
    
      128package() {
    
      129  cd "$srcdir/$pkgname"
    
      130
    
      131  local appdir="$pkgdir/opt/dsh-desktop"
    
      132  [[ -d dist/linux-unpacked ]] || { echo "error: dist/linux-unpacked not found" >&2; exit 1; }
    
      133
    
      134  # 应用本体（cp -r 而非 cp -a：所有权由 fakeroot 统一记为 root:root）
    
      135  install -d "$appdir"
    
      136  cp -r dist/linux-unpacked/. "$appdir/"
    
      137
    
      138  # 命令行入口
    
      139  install -d "$pkgdir/usr/bin"
    
      140  ln -s /opt/dsh-desktop/dsh-desktop "$pkgdir/usr/bin/dsh-desktop"
    
      141
    
      142  # .desktop 启动项
    
      143  install -Dm644 "$srcdir/dsh-desktop.desktop" \
    
      144    "$pkgdir/usr/share/applications/dsh-desktop.desktop"
    
      145
    
      146  # hicolor 图标：上游未提交 Linux 图标，从 build/app-icon.png 现场生成
    
      147  local size icon
    
      148  for size in 16 32 48 64 128 256 512; do
    
      149    icon="$pkgdir/usr/share/icons/hicolor/${size}x${size}/apps/dsh-desktop.png"
    
      150    install -d "$(dirname "$icon")"
    
      151    magick build/app-icon.png -resize "${size}x${size}" "$icon"
    
      152  done
    
      153
    
      154  # 许可证
    
      155  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      156}
    
      157

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-16 03:21:15	Low	2