ferdium-nightly

LOW

maintainer cedricroijakkers 0 votes scanned 2026-08-19 07:41:23.651733

View on AUR

Why flagged

The package builds from the project's own git repository, uses locked dependencies via version files (.nvmrc, package.json), and installs only project-related code; the variable-named package manager installs refer to version-pinned internal tooling (npm/pnpm), not untrusted external packages.

Triggered rules

Low AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it LOW (confidence 95%): The package builds from the project's own git repository, uses locked dependencies via version files (.nvmrc, package.json), and installs only project-related code; the variable-named package manager installs refer to version-pinned internal tooling (npm/pnpm), not untrusted external packages.

PKGBUILD:122 npm i -gf npm@${expected_npm_version}
PKGBUILD:126 npm i -gf pnpm@${expected_pnpm_version}

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Cedric Roijakkers <cedric [the at sign goes here] roijakkers [the dot sign goes here] be>.
    
      2# Inspired from the PKGBUILD for ferdi-git.
    
      3
    
      4_pkgname='ferdium'
    
      5pkgname="ferdium-nightly"
    
      6_electron='electron43'
    
      7_electronpackage='electron43'
    
      8pkgver='7.1.3.nightly.17'
    
      9apptag='v7.1.3-nightly.17'
    
      10pkgrel=0
    
      11pkgdesc='A messaging browser that allows you to combine your favorite messaging services into one application (git build from latest nightly release).'
    
      12arch=('x86_64' 'i686' 'armv7h' 'aarch64')
    
      13url="https://ferdium.org/"
    
      14license=('Apache')
    
      15depends=('nss' 'atk' 'at-spi2-atk' 'libcups' 'libdrm' 'gdk-pixbuf2' 'gtk3' 'alsa-lib' 'c-ares' 'ffmpeg' 'libevent' 'libxkbfile' 'libxslt' 'minizip' 're2' 'snappy' "$_electronpackage")
    
      16makedepends=('nvm' 'git' 'python' 'libxcrypt-compat' 'asar')
    
      17options=(!strip !debug)
    
      18provides=(
    
      19    'ferdium'
    
      20)
    
      21conflicts=(
    
      22    'ferdium'
    
      23    'ferdium-bin'
    
      24    'ferdium-nightly-bin'
    
      25    'ferdium-beta-bin'
    
      26    'ferdium-beta'
    
      27    'ferdium-git'
    
      28    'ferdium-electron'
    
      29)
    
      30source=(
    
      31	"$pkgname::git+https://github.com/ferdium/ferdium-app#tag=${apptag}"
    
      32)
    
      33sha512sums=('SKIP')
    
      34
    
      35_sourcedirectory="$pkgname"
    
      36
    
      37case "$CARCH" in
    
      38	i686)
    
      39		_electronbuilderarch='ia32'
    
      40	;;
    
      41	armv7h)
    
      42		_electronbuilderarch='armv7l'
    
      43	;;
    
      44	aarch64)
    
      45		_electronbuilderarch='arm64'
    
      46	;;
    
      47	*)
    
      48		_electronbuilderarch='x64'
    
      49	;;
    
      50esac
    
      51
    
      52prepare() {
    
      53	# Due to patches and sed's, reset the code to upstream before starting
    
      54	cd "$srcdir/$_sourcedirectory/"
    
      55	git reset --hard "refs/tags/${apptag}"
    
      56
    
      57	# Initialise the recipes submodule
    
      58	git submodule init
    
      59	cd "$srcdir/$_sourcedirectory/recipes"
    
      60	git reset --hard
    
      61	cd "$srcdir/$_sourcedirectory/"
    
      62	git submodule update --init --recursive
    
      63
    
      64	# Specify path for autostart file
    
      65	if [ -f src/stores/AppStore.ts ]
    
      66	then
    
      67		sed -i -e "s#path: executablePath,#path: '/usr/bin/ferdium',#g" src/stores/AppStore.ts
    
      68	fi
    
      69	if [ -f src/stores/AppStore.js ]
    
      70	then
    
      71		sed -i -e "s#path: executablePath,#path: '/usr/bin/ferdium',#g" src/stores/AppStore.js
    
      72	fi
    
      73	# Set noUnusedLocals to false to avoid compilation error in AppStore.ts
    
      74	sed -i -e 's#"noUnusedLocals": true#"noUnusedLocals": false#g' tsconfig.json
    
      75}
    
      76
    
      77pkgver() {
    
      78	cd "$srcdir/$_sourcedirectory/"
    
      79	printf "%s" "$(git describe --tags | sed 's/\([^-]*-\)g/r\1/;s/-/./g' | sed 's/^v//')"
    
      80}
    
      81
    
      82build() {
    
      83	# Prepare recipes
    
      84	cd "$srcdir/$_sourcedirectory/"
    
      85
    
      86	# Set environment variables needed for NodeJS/Electron
    
      87    export CI=true
    
      88
    
      89    # Deactivate any pre-loaded nvm, and make sure we use our own in the current source directory
    
      90    which nvm >/dev/null 2>&1 && nvm deactivate && nvm unload
    
      91    export NVM_DIR="${srcdir}/.nvm"
    
      92    source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
    
      93
    
      94	# Install the correct version of NodeJS (read from .nvmrc)
    
      95	nvm install $(cat .nvmrc)
    
      96    nvm use
    
      97
    
      98    # Extract the correct versions of tools from the package.json file
    
      99    expected_node_version=$(node -p 'require("./package.json").engines.node' | sed -e 's/\^//g')
    
      100    expected_npm_version=$(node -p 'require("./package.json").engines.npm' | sed -e 's/\^//g')
    
      101    expected_pnpm_version=$(node -p 'require("./package.json").engines.pnpm' | sed -e 's/\^//g')
    
      102
    
      103    # If pnpm is not found in the package.json, get it from recipes/package.json (old style)
    
      104    if [[ "${expected_pnpm_version}" == "undefined" ]]
    
      105    then
    
      106    	expected_pnpm_version=$(node -p 'require("./recipes/package.json").engines.pnpm')
    
      107	fi
    
      108
    
      109    # Cross-check if all versions of node match
    
      110    if [[ "$(node --version)" != "v${expected_node_version}" || "$(node --version)" != "v$(cat .nvmrc)" || "v${expected_node_version}" != "v$(cat .nvmrc)" ]]
    
      111    then
    
      112    	echo "Version mismatch in NodeJS! Version in .nvmrc is [v$(cat .nvmrc)], version in package.json is [v${expected_node_version}], and used version is ["$(node --version)"]."
    
      113    	exit 1
    
      114    fi
    
      115
    
      116    # Empty the cache before building to avoid issues with packages not being found
    
      117    npm cache clean --force
    
      118
    
      119	# Install the correct version of npm and/or pnpm, depending on the contents of package.json
    
      120	if [[ "${expected_npm_version}" != "undefined" ]]
    
      121	then
    
      122		npm i -gf npm@${expected_npm_version}
    
      123	fi
    
      124	if [[ "${expected_pnpm_version}" != "undefined" ]]
    
      125	then
    
      126		npm i -gf pnpm@${expected_pnpm_version}
    
      127	fi
    
      128
    
      129	# This is useful if we move from 'npm' to 'pnpm' for the main repo as well
    
      130    if [[ -s 'pnpm-lock.yaml' ]]; then
    
      131		BASE_CMD=pnpm
    
      132    else
    
      133		BASE_CMD=npm
    
      134    fi
    
      135
    
      136	# Build recipe archives, from here on switch to pnpm
    
      137	$BASE_CMD i
    
      138	$BASE_CMD run prepare-code || true # Ignore errors, because there is a false error causing the build to break
    
      139
    
      140	# Run the package script
    
      141	pushd recipes
    
      142    pnpm i
    
      143    pnpm run package
    
      144    popd
    
      145
    
      146	# Make sure the internal version of electron-builder is being used by prefixing it to the $PATH
    
      147	export PATH=./node_modules/.bin/:$PATH
    
      148
    
      149	# When passing arguments downstream, npm needs an extra "--" while pnpm does not
    
      150	extra_cli_args=""
    
      151	if [[ "${BASE_CMD}" == "npm" ]]
    
      152	then
    
      153		extra_cli_args="--"
    
      154	fi
    
      155
    
      156	# Run the electron build script,
    
      157	# passing parameters "-l dir" to only build for Linux and the dir target (which we will use later in function package() to make the Arch package),
    
      158	# and "--${_electronbuilderarch}" to only build for the current architecture, saving build time
    
      159	NODE_ENV='production' $BASE_CMD run build ${extra_cli_args} --publish never -l dir --${_electronbuilderarch} -c.electronDist="/usr/lib/$_electron" -c.electronVersion="$(cat "/usr/lib/$_electron/version" | sed -e 's/^v//')"
    
      160}
    
      161
    
      162package() {
    
      163	cd "$srcdir/$_sourcedirectory/"
    
      164
    
      165	# Determine where the unpacked output directory is located
    
      166	local _outpath='out/linux'
    
      167	if [ "$_electronbuilderarch" != 'x64' ]; then
    
      168		_outpath="$_outpath-$_electronbuilderarch"
    
      169	fi
    
      170	_outpath="$_outpath-unpacked"
    
      171
    
      172	# Create a shell script to start Ferdium with Electron
    
      173	install -d -m755 "${pkgdir}/usr/bin/"
    
      174	cat > "$pkgdir/usr/bin/$_pkgname" <<EOF
    
      175#!/bin/sh
    
      176ELECTRON_IS_DEV=0 exec /usr/bin/$_electron /opt/$pkgname/ "\$@"
    
      177EOF
    
      178	chmod +x "$pkgdir/usr/bin/ferdium"
    
      179
    
      180	# Extract the asar package to the system
    
      181	install -d -m755 "${pkgdir}/opt/$pkgname/"
    
      182	asar e "$_outpath/resources/app.asar" "${pkgdir}/opt/$pkgname/"
    
      183
    
      184    # Create a .desktop file
    
      185	install -dm755 "$pkgdir/usr/share/applications/"
    
      186	cat << EOF > "$pkgdir/usr/share/applications/$_pkgname.desktop"
    
      187[Desktop Entry]
    
      188Name=${_pkgname^}
    
      189Exec=/usr/bin/$_pkgname %U
    
      190Terminal=falseparu
    
      191Type=Application
    
      192Icon=ferdium
    
      193StartupWMClass=Ferdium
    
      194Comment=Ferdium is your messaging app / former heir to the throne of Austria-Hungary and combines chat & messaging services into one application. Ferdium currently supports Slack, WhatsApp, Gmail, Facebook Messenger, Telegram, Google Hangouts, GroupMe, Skype and many more. You can download Ferdium for free for Mac, Windows, and Linux.
    
      195MimeType=x-scheme-handler/ferdium;
    
      196Categories=Network;InstantMessaging;
    
      197EOF
    
      198
    
      199	# Fix the path of the application in the auto-start package to make it launch Ferdium instead of bare Electron which it autodetects
    
      200	sed -i -e "s#path = arg.path;#path = '/usr/bin/${_pkgname}';#" "${pkgdir}/opt/$pkgname/node_modules/auto-launch/dist/index.js"
    
      201
    
      202	# Install the icons
    
      203	for _size in 16 24 32 48 64 96 128 256 512 1024; do
    
      204		install -Dm644 "build-helpers/images/icons/${_size}x${_size}.png" "$pkgdir/usr/share/icons/hicolor/${_size}x${_size}/apps/$_pkgname.png"
    
      205	done
    
      206}
    
      207

Changes since previous scan

--- PKGBUILD @ 2026-08-14 15:29
+++ PKGBUILD @ 2026-08-19 07:41
@@ -5,8 +5,8 @@
 pkgname="ferdium-nightly"
 _electron='electron43'
 _electronpackage='electron43'
-pkgver='7.1.3.nightly.12'
-apptag='v7.1.3-nightly.12'
+pkgver='7.1.3.nightly.17'
+apptag='v7.1.3-nightly.17'
 pkgrel=0
 pkgdesc='A messaging browser that allows you to combine your favorite messaging services into one application (git build from latest nightly release).'
 arch=('x86_64' 'i686' 'armv7h' 'aarch64')

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-19 07:41:23	Low	1
2026-08-14 15:29:17	Clean	1
2026-08-14 09:28:24	Clean	1
2026-08-12 09:23:17	Clean	1
2026-06-19 22:34:54	Clean	0