garuda-toolbox-git

LOW

maintainer dr460nf1r3 0 votes scanned 2026-08-29 17:40:20.882297

View on AUR

Why flagged

The package builds from the project's own Git repository, uses system Electron, and installs only project files; the low severity is due to SKIP'd checksum and recent upload with few votes, but no malicious behavior is present.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from the project's own Git repository, uses system Electron, and installs only project files; the low severity is due to SKIP'd checksum and recent upload with few votes, but no malicious behavior is present.

PKGBUILD

      1# Maintainer: dr460nf1r3 <root at dr460nf1r3 dot org>
    
      2
    
      3pkgname=garuda-toolbox-git
    
      4pkgver=4.0.1.r15.g6e78199
    
      5pkgrel=1
    
      6_electronversion=43
    
      7_pkgname=garuda-toolbox
    
      8pkgdesc="Garuda Toolbox - A collection of useful tools to manage your Garuda Linux system"
    
      9arch=('any')
    
      10url="https://gitlab.com/garuda-linux/applications/toolbox"
    
      11license=('GPL-3.0-or-later')
    
      12depends=('bash' 'curl' "electron${_electronversion}" 'pacman-contrib' 'garuda-libs>=1.6.0' 'archlinux-appstream-data' 'util-linux')
    
      13makedepends=('git' 'base-devel' 'nodejs' 'pnpm')
    
      14optdepends=('paru: show pending AUR updates'
    
      15  'meld: compare pacdiff files via a GUI on GTK systems'
    
      16  'pace: manage Pacman repositories via a GUI'
    
      17  'reflector-simple: update Arch mirrorlists interactively'
    
      18  'btrfs-assistant: easily manage Btrfs snapshots and further settings')
    
      19provides=('garuda-toolbox')
    
      20conflicts=('garuda-toolbox')
    
      21replaces=('garuda-rani-git')
    
      22options=('!strip' '!emptydirs' '!debug')
    
      23source=("toolbox::git+$url.git")
    
      24sha256sums=('SKIP')
    
      25
    
      26pkgver() {
    
      27  cd toolbox || exit
    
      28  git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g'
    
      29}
    
      30
    
      31prepare() {
    
      32  cd toolbox || exit
    
      33
    
      34  # Verbose by default as preview version
    
      35  sed -i 's/logLevel = LogLevel.INFO/logLevel = LogLevel.VERBOSE/g' "$srcdir/toolbox/packages/renderer/src/app/logging/logging.ts"
    
      36
    
      37  sed -i -e "
    
      38        s/@electronversion@/${_electronversion}/g
    
      39        s/@appname@/${_pkgname}/g
    
      40        s/@runname@/app.asar/g
    
      41        s/@cfgdirname@/${_pkgname}/g
    
      42        s/@options@/env ELECTRON_OZONE_PLATFORM_HINT=auto --disable-vulkan/g
    
      43    " "${srcdir}/toolbox/assets/garuda-toolbox.sh"
    
      44
    
      45  export ELECTRON_SKIP_BINARY_DOWNLOAD=1
    
      46  export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/v//g')"
    
      47  export ELECTRON_OVERRIDE_DIST_PATH="/usr/lib/electron${_electronversion}"
    
      48  export CI=true
    
      49
    
      50  HOME="${srcdir}/.electron-gyp"
    
      51  mkdir -p "${srcdir}/.electron-gyp"
    
      52  sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g" package.json
    
      53  NODE_ENV=development pnpm -r install --no-frozen-lockfile --force
    
      54}
    
      55
    
      56build() {
    
      57  cd toolbox || exit
    
      58  local electronDist="/usr/lib/electron${_electronversion}"
    
      59
    
      60  NODE_ENV=production pnpm run build
    
      61  NODE_ENV=production pnpm exec electron-builder --linux dir \
    
      62    --config electron-builder.mjs \
    
      63    -c.electronDist="${electronDist}" \
    
      64    -c.electronVersion="${SYSTEM_ELECTRON_VERSION}"
    
      65}
    
      66
    
      67package() {
    
      68  install -Dm755 "${srcdir}/toolbox/assets/garuda-toolbox.sh" "${pkgdir}/usr/bin/${_pkgname}"
    
      69  install -Dm755 "${srcdir}/toolbox/assets/garuda-toolbox-pty-wrapper" "${pkgdir}/usr/libexec/garuda-toolbox-pty-wrapper"
    
      70  install -Dm644 "${srcdir}/toolbox/dist/linux-unpacked/resources/app.asar" -t "${pkgdir}/usr/lib/${_pkgname}"
    
      71  install -Dm644 "${srcdir}/toolbox/assets/${_pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
    
      72  install -Dm644 "${srcdir}/toolbox/LICENSE" -t "${pkgdir}/usr/share/licenses/${_pkgname}"
    
      73  install -Dm644 "${srcdir}/toolbox/assets/images/garuda-purple.svg" "${pkgdir}/usr/share/icons/${_pkgname}.svg"
    
      74  install -Dm644 "${srcdir}/toolbox/assets/images/garuda-purple.svg" "${pkgdir}/usr/share/icons/hicolor/scalable/apps/${pkgname}.svg"
    
      75  install -Dm644 "${srcdir}/toolbox/assets/org.garudalinux.toolbox.policy" "${pkgdir}/usr/share/polkit-1/actions/org.garudalinux.toolbox.policy"
    
      76}
    
      77

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-29 17:40:20	Low	2