folo-git
The package builds from a legitimate project source (GitHub) and uses standard development tools; the variable-named package installation occurs within a controlled, local build environment for a project-owned dependency, posing no supply-chain risk.
Triggered rules
llm_review
The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it LOW (confidence 95%): The package builds from a legitimate project source (GitHub) and uses standard development tools; the variable-named package installation occurs within a controlled, local build environment for a project-owned dependency, posing no supply-chain risk.
-
PKGBUILD:96
npm install -g "pnpm@${_pnpmver}" --prefix "${HOME}/.pnpm" \
PKGBUILD
1 offending line(s) highlighted# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
pkgname=folo-git
_pkgname=Folo
pkgver=0.6.1.r2.gb3c75ca
_electronversion=44
_nodeversion=24
pkgrel=1
pkgdesc="Organizes content into one timeline, keeping you updated on what matters, noise-free. Share lists, explore collections, and enjoy distraction-free browsing."
arch=('any')
url="https://app.folo.is/"
_ghurl="https://github.com/RSSNext/Folo"
license=('GPL-3.0-only')
conflicts=("${pkgname%-git}")
provides=("${pkgname%-git}=${pkgver%.r*}")
depends=(
"electron${_electronversion}"
)
makedepends=(
'npm'
'nvm'
'gendesk'
'git'
'pnpm'
'python-setuptools'
'jq'
'zip'
)
source=(
"${pkgname//-/.}::git+${_ghurl}"
"${pkgname%-git}.sh"
)
sha256sums=('SKIP'
'dfcd6603d29c7b8d88e019b517a2e5c1a7b5ab905a0961a8b81adfa508b258b8')
_get_project_dir() {
local d
while IFS= read -r d; do
find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
}
pkgver() {
cd "$(_get_project_dir)"
set -o pipefail
git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g;s/.*\///' ||
printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
}
_ensure_local_nvm() {
local NVM_DIR="${srcdir}/.nvm"
source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
nvm install "${_nodeversion}"
nvm use "${_nodeversion}"
}
_get_app_dir() {
find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -printf '%h\n' 2>/dev/null \
| while read -r d; do [[ -d "${d}/resources" ]] && { echo "$d"; return 0; }; done
}
_get_electron_version() {
_elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
| xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
| grep -oE '[0-9]+' | head -1)
[[ -z "${_elec_ver}" ]] && return 1
(( _elec_ver == _electronversion )) && c=32 || c=31
echo -e "Electron version: \033[1;${c}m${_elec_ver}$([[ $c -eq 31 ]] && echo " (expected ${_electronversion})")\033[0m"
}
_set_build_env() {
export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
export ELECTRON_SKIP_BINARY_DOWNLOAD=1
export ELECTRON_BUILDER_OFFLINE=true
export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
export HOME="${srcdir}/.home"
export XDG_CACHE_HOME="${HOME}/.cache"
export XDG_CONFIG_HOME="${HOME}/.config"
export XDG_DATA_HOME="${HOME}/.local/share"
export XDG_STATE_HOME="${HOME}/.local/state"
export PNPM_HOME="${HOME}/.pnpm/bin"
export pnpm_config_cache_dir="${HOME}/.pnpm_cache"
export pnpm_config_store_dir="${HOME}/.pnpm_store"
export pnpm_config_global_dir="${HOME}/.pnpm/global"
export pnpm_config_state_dir="${HOME}/.pnpm/state"
export pnpm_config_node_linker=hoisted
export pnpm_config_minimum_release_age=0
export pnpm_config_update_notifier=false
export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
export COREPACK_HOME="${HOME}/.corepack"
mkdir -p "${HOME}" "${PNPM_HOME}" "${pnpm_config_cache_dir}" "${pnpm_config_store_dir}" "${pnpm_config_global_dir}" "${pnpm_config_state_dir}" "${COREPACK_HOME}"
export PATH="${PNPM_HOME}:${PATH}"
local _pnpmver=""
local _pkgjson="$(_get_project_dir)/package.json"
if [ -f "${_pkgjson}" ]; then
_pnpmver="$(grep -o '"packageManager"[^,]*' "${_pkgjson}" 2>/dev/null | grep -oE 'pnpm@[^"+]+' | head -n1 | sed 's/^pnpm@//')"
if [ -z "${_pnpmver}" ]; then
_pnpmver="$(grep -oE '"pnpm"[[:space:]]*:[[:space:]]*"[^"]+"' "${_pkgjson}" 2>/dev/null | grep -oE '[0-9][0-9.]*' | head -n1)"
fi
fi
if [ -n "${_pnpmver}" ]; then
npm install -g "pnpm@${_pnpmver}" --prefix "${HOME}/.pnpm" \
--registry "${COREPACK_NPM_REGISTRY}"
fi
}
_use_local_electron_for_forge() {
local _arch=$([[ "${CARCH}" == "aarch64" ]] && echo arm64 || [[ "${CARCH}" == "armv7h" ]] && echo armv7l || echo x64)
local _zd="${srcdir}/electron-zips"
local _zf="${_zd}/electron-v${SYSTEM_ELECTRON_VERSION}-linux-${_arch}.zip"
mkdir -p "${_zd}"
rm -f "${_zf}"
( cd "${ELECTRON_DIST}" && find . \( -type f -o -type l \) -readable -print | zip -@ -0 -q -y "${_zf}" )
[[ -s "${_zf}" ]] || { echo "ERROR: Failed to generate electron zip (directory not readable?)"; return 1; }
find . -name "forge.config.*" ! -path "*/node_modules/*" -print0 | while IFS= read -r -d '' _cfg; do
sed -i "/packagerConfig:[[:space:]]*{/a\\ electronZipDir: '${_zd}'," "${_cfg}"
done
}
prepare() {
cd "$(_get_project_dir)"
_get_electron_version
sed -i -e "
s/@electronversion@/${_electronversion}/g
s/@appname@/${pkgname%-git}/g
" "${srcdir}/${pkgname%-git}.sh"
gendesk -q -f -n \
--pkgname="${pkgname%-git}" \
--pkgdesc="${pkgdesc}" \
--categories="Utility" \
--name="${_pkgname}" \
--exec="${pkgname%-git} %U"
_ensure_local_nvm
_set_build_env
jq --arg ver "${SYSTEM_ELECTRON_VERSION}" '
(.devDependencies.electron // .dependencies.electron) = $ver |
.scripts |= with_entries(
if .value | test("electron-forge make")
then .value = (.value | gsub("electron-forge make"; "electron-forge package"))
else .
end
)
' apps/desktop/package.json > apps/desktop/package.json.tmp && mv apps/desktop/package.json.tmp apps/desktop/package.json
jq '.scripts.prepare = "simple-git-hooks"' package.json > package.json.tmp && mv package.json.tmp package.json
cp apps/desktop/.env.example apps/desktop/.env
export NODE_ENV=development
export SHARP_IGNORE_GLOBAL_LIBVIPS=1
pnpm install
_use_local_electron_for_forge
}
build() {
cd "$(_get_project_dir)/apps/desktop"
_ensure_local_nvm
_set_build_env
export NODE_ENV=production
pnpm update:main-hash
pnpm build:electron-vite
pnpm build:electron-forge
rm -rf "$(_get_app_dir)/resources/default_app.asar"
}
package() {
install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-git}"
cp -a "$(_get_app_dir)/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"
install -Dm644 "$(_get_project_dir)/apps/desktop/resources/icon.png" "${pkgdir}/usr/share/pixmaps/${pkgname%-git}.png"
install -Dm644 "$(_get_project_dir)/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
install -Dm644 "$(_get_project_dir)/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
}
Changes since previous scan
--- PKGBUILD @ 2026-10-20 00:10+++ PKGBUILD @ 2026-11-01 00:21@@ -1,7 +1,7 @@ # Maintainer: zxp19821005 <zxp19821005 at 163 dot com> pkgname=folo-git _pkgname=Folo-pkgver=1.15.0.r16.g0dca01f+pkgver=0.6.1.r2.gb3c75ca _electronversion=44 _nodeversion=24 pkgrel=1@@ -30,84 +30,84 @@ "${pkgname%-git}.sh" ) sha256sums=('SKIP'- 'bd5358d8f323d3c2c2f0733364ee4ea55f551dd86ba0be2a76846210b60897fc')+ 'dfcd6603d29c7b8d88e019b517a2e5c1a7b5ab905a0961a8b81adfa508b258b8')+_get_project_dir() {+ local d+ while IFS= read -r d; do+ find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }+ done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')+} pkgver() {- cd "$(_get_project_dir)"- set -o pipefail- git describe --long --abbrev=7 2>/dev/null | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/mobile\@//g;s/desktop@//g' ||- printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"+ cd "$(_get_project_dir)"+ set -o pipefail+ git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g;s/.*\///' ||+ printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)" } _ensure_local_nvm() {- local NVM_DIR="${srcdir}/.nvm"- source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]- nvm install "${_nodeversion}"- nvm use "${_nodeversion}"-}-_get_project_dir() {- local d- while IFS= read -r d; do- find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }- done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')+ local NVM_DIR="${srcdir}/.nvm"+ source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]+ nvm install "${_nodeversion}"+ nvm use "${_nodeversion}" } _get_app_dir() {- find "${srcdir}" -type f -name "resources.pak" -print 2>/dev/null | while read f; do [ -d "${f%/*}/resources" ] && echo "${f%/*}" && break; done+ find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -printf '%h\n' 2>/dev/null \+ | while read -r d; do [[ -d "${d}/resources" ]] && { echo "$d"; return 0; }; done } _get_electron_version() {- _elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \- | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \- | grep -v '^$' | sed 's/^[^0-9]*//' | head -1)- [[ -z "${_elec_ver}" ]] && return 1- echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"+ _elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \+ | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \+ | grep -oE '[0-9]+' | head -1)+ [[ -z "${_elec_ver}" ]] && return 1+ (( _elec_ver == _electronversion )) && c=32 || c=31+ echo -e "Electron version: \033[1;${c}m${_elec_ver}$([[ $c -eq 31 ]] && echo " (expected ${_electronversion})")\033[0m" } _set_build_env() {- export ELECTRON_DIST="/usr/lib/electron${_electronversion}"- export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"- export ELECTRON_SKIP_BINARY_DOWNLOAD=1- export ELECTRON_BUILDER_OFFLINE=true- export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"- export HOME="${srcdir}/.home"- export XDG_CACHE_HOME="${HOME}/.cache"- export XDG_CONFIG_HOME="${HOME}/.config"- export XDG_DATA_HOME="${HOME}/.local/share"- export XDG_STATE_HOME="${HOME}/.local/state"- export PNPM_HOME="${HOME}/.pnpm/bin"- export pnpm_config_cache_dir="${HOME}/.pnpm_cache"- export pnpm_config_store_dir="${HOME}/.pnpm_store"- export pnpm_config_global_dir="${HOME}/.pnpm/global"- export pnpm_config_state_dir="${HOME}/.pnpm/state"- export pnpm_config_node_linker=hoisted- export pnpm_config_minimum_release_age=0- export pnpm_config_update_notifier=false- export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"- export COREPACK_HOME="${HOME}/.corepack"- mkdir -p "${HOME}" "${PNPM_HOME}" "${pnpm_config_cache_dir}" "${pnpm_config_store_dir}" "${pnpm_config_global_dir}" "${pnpm_config_state_dir}" "${COREPACK_HOME}"- export PATH="${PNPM_HOME}:${PATH}"- local _pnpmver=""- local _pkgjson="$(_get_project_dir)/package.json"- if [ -f "${_pkgjson}" ]; then- _pnpmver="$(grep -o '"packageManager"[^,]*' "${_pkgjson}" 2>/dev/null | grep -oE 'pnpm@[^"+]+' | head -n1 | sed 's/^pnpm@//')"- if [ -z "${_pnpmver}" ]; then- _pnpmver="$(grep -oE '"pnpm"[[:space:]]*:[[:space:]]*"[^"]+"' "${_pkgjson}" 2>/dev/null | grep -oE '[0-9][0-9.]*' | head -n1)"- fi- fi- if [ -n "${_pnpmver}" ]; then- npm install -g "pnpm@${_pnpmver}" --prefix "${HOME}/.pnpm" \- --registry "${COREPACK_NPM_REGISTRY}"- fi+ export ELECTRON_DIST="/usr/lib/electron${_electronversion}"+ export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"+ export ELECTRON_SKIP_BINARY_DOWNLOAD=1+ export ELECTRON_BUILDER_OFFLINE=true+ export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"+ export HOME="${srcdir}/.home"+ export XDG_CACHE_HOME="${HOME}/.cache"+ export XDG_CONFIG_HOME="${HOME}/.config"+ export XDG_DATA_HOME="${HOME}/.local/share"+ export XDG_STATE_HOME="${HOME}/.local/state"+ export PNPM_HOME="${HOME}/.pnpm/bin"+ export pnpm_config_cache_dir="${HOME}/.pnpm_cache"+ export pnpm_config_store_dir="${HOME}/.pnpm_store"+ export pnpm_config_global_dir="${HOME}/.pnpm/global"+ export pnpm_config_state_dir="${HOME}/.pnpm/state"+ export pnpm_config_node_linker=hoisted+ export pnpm_config_minimum_release_age=0+ export pnpm_config_update_notifier=false+ export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"+ export COREPACK_HOME="${HOME}/.corepack"+ mkdir -p "${HOME}" "${PNPM_HOME}" "${pnpm_config_cache_dir}" "${pnpm_config_store_dir}" "${pnpm_config_global_dir}" "${pnpm_config_state_dir}" "${COREPACK_HOME}"+ export PATH="${PNPM_HOME}:${PATH}"+ local _pnpmver=""+ local _pkgjson="$(_get_project_dir)/package.json"+ if [ -f "${_pkgjson}" ]; then+ _pnpmver="$(grep -o '"packageManager"[^,]*' "${_pkgjson}" 2>/dev/null | grep -oE 'pnpm@[^"+]+' | head -n1 | sed 's/^pnpm@//')"+ if [ -z "${_pnpmver}" ]; then+ _pnpmver="$(grep -oE '"pnpm"[[:space:]]*:[[:space:]]*"[^"]+"' "${_pkgjson}" 2>/dev/null | grep -oE '[0-9][0-9.]*' | head -n1)"+ fi+ fi+ if [ -n "${_pnpmver}" ]; then+ npm install -g "pnpm@${_pnpmver}" --prefix "${HOME}/.pnpm" \+ --registry "${COREPACK_NPM_REGISTRY}"+ fi } _use_local_electron_for_forge() {- local _v="${SYSTEM_ELECTRON_VERSION}"- local _zd="${srcdir}/electron-zips"- case "${CARCH}" in- aarch64) _arch=arm64 ;;- x86_64) _arch=x64 ;;- esac- local _zf="${_zd}/electron-v${_v}-linux-${_arch}.zip"- install -Dm755 -d "${_zd}"- ( cd "${ELECTRON_DIST}" && zip -r -q -0 "${_zf}" . )- find . -name "forge.config.*" ! -path "*/node_modules/*" -print0 | while IFS= read -r -d '' _cfg; do- sed -i "/packagerConfig:[[:space:]]*{/a\\ electronZipDir: '${_zd}'," "${_cfg}"- done+ local _arch=$([[ "${CARCH}" == "aarch64" ]] && echo arm64 || [[ "${CARCH}" == "armv7h" ]] && echo armv7l || echo x64)+ local _zd="${srcdir}/electron-zips"+ local _zf="${_zd}/electron-v${SYSTEM_ELECTRON_VERSION}-linux-${_arch}.zip"+ mkdir -p "${_zd}"+ rm -f "${_zf}"+ ( cd "${ELECTRON_DIST}" && find . \( -type f -o -type l \) -readable -print | zip -@ -0 -q -y "${_zf}" )+ [[ -s "${_zf}" ]] || { echo "ERROR: Failed to generate electron zip (directory not readable?)"; return 1; }+ find . -name "forge.config.*" ! -path "*/node_modules/*" -print0 | while IFS= read -r -d '' _cfg; do+ sed -i "/packagerConfig:[[:space:]]*{/a\\ electronZipDir: '${_zd}'," "${_cfg}"+ done } prepare() { cd "$(_get_project_dir)"@@ -115,8 +115,6 @@ sed -i -e " s/@electronversion@/${_electronversion}/g s/@appname@/${pkgname%-git}/g- s/@runname@/app.asar/g- s/@cfgdirname@/${pkgname%-git}/g " "${srcdir}/${pkgname%-git}.sh" gendesk -q -f -n \ --pkgname="${pkgname%-git}" \@@ -126,11 +124,16 @@ --exec="${pkgname%-git} %U" _ensure_local_nvm _set_build_env- jq 'del(.scripts.prepare)' package.json > package.json.tmp && mv package.json.tmp package.json jq --arg ver "${SYSTEM_ELECTRON_VERSION}" '- .devDependencies.electron = $ver |- .scripts |= with_entries(if .value == "electron-forge make" then .value = "electron-forge package" else . end)- ' apps/desktop/package.json > package.json.tmp && mv package.json.tmp apps/desktop/package.json+ (.devDependencies.electron // .dependencies.electron) = $ver |+ .scripts |= with_entries(+ if .value | test("electron-forge make")+ then .value = (.value | gsub("electron-forge make"; "electron-forge package"))+ else .+ end+ )+ ' apps/desktop/package.json > apps/desktop/package.json.tmp && mv apps/desktop/package.json.tmp apps/desktop/package.json+ jq '.scripts.prepare = "simple-git-hooks"' package.json > package.json.tmp && mv package.json.tmp package.json cp apps/desktop/.env.example apps/desktop/.env export NODE_ENV=development export SHARP_IGNORE_GLOBAL_LIBVIPS=1@@ -142,19 +145,17 @@ _ensure_local_nvm _set_build_env export NODE_ENV=production- pnpm update:main-hash + pnpm update:main-hash pnpm build:electron-vite pnpm build:electron-forge+ rm -rf "$(_get_app_dir)/resources/default_app.asar" } package() { install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}" install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-git}"- local _app_dir="$(_get_app_dir)"- cp -a "${_app_dir}/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"- rm -rf "${pkgdir}/usr/lib/${pkgname%-git}/default_app.asar"- local _src="$(_get_project_dir)"- install -Dm644 "${_src}/apps/desktop/resources/icon.png" "${pkgdir}/usr/share/pixmaps/${pkgname%-git}.png"- install -Dm644 "${_src}/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"- install -Dm644 "${_src}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"+ cp -a "$(_get_app_dir)/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"+ install -Dm644 "$(_get_project_dir)/apps/desktop/resources/icon.png" "${pkgdir}/usr/share/pixmaps/${pkgname%-git}.png"+ install -Dm644 "$(_get_project_dir)/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"+ install -Dm644 "$(_get_project_dir)/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}" } Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 1 |
| 2026-10-31 00:07:41 | Low | 1 |
| 2026-10-30 00:29:30 | Low | 1 |
| 2026-10-29 00:13:55 | Low | 1 |
| 2026-10-28 00:06:54 | Low | 1 |
| 2026-10-27 00:23:28 | Low | 1 |
| 2026-10-26 00:12:40 | Low | 1 |
| 2026-10-25 00:20:48 | Low | 1 |
| 2026-10-24 00:14:55 | Low | 1 |
| 2026-10-23 00:02:19 | Low | 1 |
| 2026-10-22 00:13:10 | Low | 1 |
| 2026-10-21 00:12:50 | Low | 1 |
| 2026-10-20 03:27:25 | Low | 1 |
| 2026-10-20 00:10:31 | Low | 1 |
| 2026-10-19 00:03:55 | Low | 1 |
| 2026-10-18 00:06:55 | Low | 1 |
| 2026-10-17 00:21:55 | Low | 1 |
| 2026-10-16 00:12:47 | Low | 1 |
| 2026-10-15 00:28:05 | Low | 1 |
| 2026-10-14 00:06:47 | Low | 1 |