gdevelop-git
maintainer arthuro555
· 5 votes
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The npm install and npx commands are used to build the project from its own source, which is cloned from the official GitHub repository; the dependencies are declared in the project's package.json, not arbitrary external packages, and no untrusted remote code is executed.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The npm install and npx commands are used to build the project from its own source, which is cloned from the official GitHub repository; the dependencies are declared in the project's package.json, not arbitrary external packages, and no untrusted remote code is executed.
2 higher static findings superseded - not the current verdict (shown for transparency)
MEDIUM
npm/yarn/pnpm install of an undeclared external package
npm_install_external
Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.
-
PKGBUILD:53
npm install --no-audit --no-fund --prefer-offline --include dev -
PKGBUILD:58
npm install --no-audit --no-fund --prefer-offline --include dev -
PKGBUILD:67
npm install --no-audit --no-fund --prefer-offline --include dev
MEDIUM
npx/bunx/deno executes a remote package
remote_code_tool
`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.
-
PKGBUILD:59
NODE_ENV='development' npx -y update-browserslist-db@latest
PKGBUILD
4 offending line(s) highlighted
1
# Maintainer: Arthur Pacaud <arthur.pacaud@hotmail.fr>
2
# Contributor: JKA Network <contacto@jkanetwork.com>
3
# Contributor: Todor Imreorov for github <blurymind@gmail.com>
4
5
pkgname=gdevelop-git
6
pkgver=v5.6.273.r11.g04119d2
7
pkgrel=1
8
pkgdesc="A full-featured, open source game engine, allowing to create HTML5 with powerful visual scripting."
9
arch=(x86_64 armv7l arm64)
10
url=https://gdevelop.io
11
license=('MIT')
12
provides=("gdevelop=${pkgver}")
13
conflicts=('gdevelop-bin' 'gdevelop')
14
makedepends=('npm' 'git' 'clang')
15
_electron='electron41'
16
_emsdk='3.1.21'
17
depends=("$_electron")
18
source=("gdevelop::git+https://github.com/4ian/GDevelop.git"
19
'emsdk::git+https://github.com/emscripten-core/emsdk.git'
20
'gdevelop.desktop')
21
sha256sums=('SKIP'
22
'SKIP'
23
'64fb52411e4fbc00237c589424d520d26e42199ed9a7b7e64d9dd375c6904e5c')
24
25
pkgver() {
26
cd gdevelop
27
git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g'
28
}
29
30
prepare() {
31
"$srcdir/emsdk/emsdk" install $_emsdk
32
"$srcdir/emsdk/emsdk" activate $_emsdk
33
}
34
35
build() {
36
EMSDK_QUIET=1 source "$srcdir/emsdk/emsdk_env.sh"
37
38
# Set basic build variables
39
export NODE_ENV='production' # Enables optimisations in JS build tools
40
export NODE_OPTIONS="--max-old-space-size=8192" # Allows NodeJS VM to allocate enough RAM to build the IDE
41
export CC=$(which clang)
42
export CXX=$(which clang++)
43
# Arch's clang package contains a patch that changes clang's default flags: https://wiki.archlinux.org/title/Clang#Stack_protector
44
# We disable this change, since this breaks emscripten.
45
export CXXFLAGS="-fno-stack-protector -w"
46
export CFLAGS="-fno-stack-protector -w"
47
# Arch sets default linker flags which are incompatible with wasm-ld.
48
export LDFLAGS=""
49
# Try to build despite the CMake file being written for a deprecated CMake version.
50
export CMAKE_POLICY_VERSION_MINIMUM="3.5"
51
52
cd "$srcdir/gdevelop/GDevelop.js"
53
npm install --no-audit --no-fund --prefer-offline --include dev
54
npm run build
55
56
cd "$srcdir/gdevelop/newIDE/app"
57
58
npm install --no-audit --no-fund --prefer-offline --include dev
59
NODE_ENV='development' npx -y update-browserslist-db@latest
60
61
cd "$srcdir/gdevelop/newIDE/electron-app"
62
63
local electronVer
64
electronVer="$(</usr/lib/$_electron/version)"
65
npm pkg set dependencies.electron=$electronVer
66
npm pkg set devDependencies.electron=$electronVer
67
npm install --no-audit --no-fund --prefer-offline --include dev
68
npm run build -- --linux dir --"${!CARCH}" -c.electronDist="/usr/lib/$_electron" -c.electronVersion="$electronVer"
69
}
70
71
package() {
72
mkdir -p "${pkgdir}/usr/share/gdevelop/"
73
cp -a --no-preserve=ownership "$srcdir/gdevelop/newIDE/electron-app/dist/linux-unpacked/resources/." "${pkgdir}/usr/share/gdevelop/"
74
chmod -R 755 "${pkgdir}/usr/share/gdevelop/"
75
76
mkdir -p "${pkgdir}/usr/bin/"
77
cat >>"${pkgdir}/usr/bin/gdevelop" <<EOD
78
#! /usr/bin/sh
79
ELECTRON_IS_DEV=0 exec $_electron /usr/share/gdevelop/app.asar "\$@"
80
EOD
81
chmod 755 "${pkgdir}/usr/bin/gdevelop"
82
83
install -Dm644 "$srcdir/gdevelop.desktop" "${pkgdir}/usr/share/applications/gdevelop.desktop"
84
install -Dm644 "$srcdir/gdevelop/newIDE/app/public/android-chrome-192x192.png" "$pkgdir/usr/share/pixmaps/gdevelop.png"
85
}
86
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 3 |
| 2026-08-02 00:16:08 | LOW | 3 |
| 2026-08-01 00:11:18 | LOW | 3 |
| 2026-07-31 00:14:10 | LOW | 3 |
| 2026-07-30 00:17:23 | LOW | 3 |
| 2026-07-29 00:25:53 | LOW | 3 |
| 2026-07-28 00:07:28 | LOW | 3 |
| 2026-07-27 00:24:32 | LOW | 3 |
| 2026-07-26 00:07:32 | LOW | 3 |
| 2026-07-25 00:13:44 | LOW | 3 |
| 2026-07-24 00:02:28 | LOW | 3 |
| 2026-07-23 00:14:47 | LOW | 4 |
| 2026-07-22 00:29:32 | LOW | 4 |
| 2026-07-21 00:24:15 | LOW | 4 |
| 2026-07-20 00:19:49 | LOW | 4 |
| 2026-07-19 00:17:08 | LOW | 4 |
| 2026-07-18 00:14:48 | LOW | 4 |
| 2026-07-17 00:06:16 | LOW | 4 |
| 2026-07-16 00:05:41 | LOW | 4 |
| 2026-07-15 00:09:25 | LOW | 4 |