engined-git

MEDIUM

maintainer gissf1 0 votes scanned 2026-10-17 21:19:24.858333

View on AUR

Why flagged

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

Triggered rules

Medium npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:44 BUN_PATH=/usr/bin/bun BUNX_PATH=/usr/bin/bunx DOCKER_PATH=/usr/bin/docker

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Damon Blais <damon.blais@gmail.com>
    
      2
    
      3pkgname=engined-git
    
      4pkgver=0.1.0
    
      5pkgrel=1
    
      6pkgdesc="Local model door: one OpenAI-shaped endpoint that owns every inference container on the box (git)"
    
      7arch=('any')
    
      8url="https://github.com/Rethunk-Tech/engined"
    
      9license=('MIT')
    
      10depends=('bun')
    
      11makedepends=('git')
    
      12optdepends=(
    
      13  'docker: run the inference engines and the Cursor TLS bridge'
    
      14  'bubblewrap: read-only sandbox for the opencode engine'
    
      15)
    
      16install=engined.install
    
      17provides=("engined=$pkgver")
    
      18conflicts=('engined')
    
      19source=("$pkgname::git+$url.git")
    
      20sha256sums=('SKIP')
    
      21
    
      22pkgver() {
    
      23  cd "$pkgname"
    
      24  git describe --long --abbrev=7 --tags | sed 's/^v//;s/\([^-]*-g\)/r\1/;s/-/./g'
    
      25}
    
      26
    
      27build() {
    
      28  cd "$pkgname"
    
      29  # The bundle has no runtime dependencies, so no `bun install` is needed.
    
      30  ENGINED_COMMIT=$(git rev-parse HEAD) bun run build
    
      31}
    
      32
    
      33package() {
    
      34  cd "$pkgname"
    
      35  install -Dm0644 dist/main.js "$pkgdir/usr/lib/engined/main.js"
    
      36  install -Dm0644 deploy/Caddyfile.cursor "$pkgdir/usr/lib/engined/Caddyfile.cursor"
    
      37  cp -r --no-preserve=ownership engines "$pkgdir/usr/lib/engined/engines"
    
      38
    
      39  # install.sh's own renderer, so the packaged units cannot drift from the
    
      40  # templates; only the paths differ. %S is the user's state directory.
    
      41  (
    
      42    source scripts/install.sh
    
      43    resolve_paths
    
      44    BUN_PATH=/usr/bin/bun BUNX_PATH=/usr/bin/bunx DOCKER_PATH=/usr/bin/docker
    
      45    UNIT_INSTALL_DIR=/usr/lib/engined UNIT_STATE_DIR=%S/engined
    
      46    install -d "$pkgdir/usr/lib/systemd/user"
    
      47    for unit in engined.service engined-probe.service engined-probe.timer engined-tls.service; do
    
      48      render_unit_file "$unit.in" "$pkgdir/usr/lib/systemd/user/$unit"
    
      49    done
    
      50  )
    
      51
    
      52  # Not under /usr/share/doc, which NoExtract commonly strips: the install
    
      53  # message tells every user to copy it.
    
      54  install -Dm0644 config.example.toml "$pkgdir/usr/share/engined/config.example.toml"
    
      55  install -Dm0644 HUMANS.md "$pkgdir/usr/share/doc/engined/HUMANS.md"
    
      56  cp -r --no-preserve=ownership docs/. "$pkgdir/usr/share/doc/engined/"
    
      57  install -Dm0644 LICENSE "$pkgdir/usr/share/licenses/engined/LICENSE"
    
      58  install -Dm0644 THIRD_PARTY_NOTICES.md "$pkgdir/usr/share/licenses/engined/THIRD_PARTY_NOTICES.md"
    
      59}
    
      60

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 21:19:24	Medium	2
2026-10-17 07:18:45	Clean	3
2026-10-17 07:17:15	Medium	2