ghost-chat-git

MEDIUM
maintainer zxp19821005 0 votes scanned 2026-11-01 00:21:48.120785
View on AUR
Why flagged

The PKGBUILD installs pnpm and wails3 from npm and Go repositories using version-dynamic commands, which may pull unverified external code; however, these are build tools required for the project and used in a controlled environment.

Triggered rules

Medium External install via pipx/uv/poetry/cargo/go/gem alt_pkg_manager_install

A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.

  • PKGBUILD:109 go install github.com/wailsapp/wails/v3/cmd/wails3@latest
Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 85%): The PKGBUILD installs pnpm and wails3 from npm and Go repositories using version-dynamic commands, which may pull unverified external code; however, these are build tools required for the project and used in a controlled environment.

  • PKGBUILD:93 npm install -g "pnpm@${_pnpmver}" --prefix "${HOME}/.pnpm" \

PKGBUILD

2 offending line(s) highlighted
1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2pkgname=ghost-chat-git
3_pkgname=GhostChat
4pkgver=4.9.0.r0.g94030dd
5_nodeversion=24
6pkgrel=1
7pkgdesc="A Standalone chat overlay for Twitch, Kick, YouTube and other streaming platforms."
8arch=('any')
9url="https://github.com/Enubia/ghost-chat"
10license=('LicenseRef-DBAD')
11conflicts=("${pkgname%-git}")
12provides=("${pkgname%-git}=${pkgver%.r*}")
13depends=(
14 'webkitgtk-6.0'
15 'gtk3'
16)
17makedepends=(
18 'pnpm'
19 'gendesk'
20 'go'
21 'nvm'
22 'git'
23)
24source=(
25 "${pkgname%-git}.git::git+${url}.git"
26 "modifiers_linux.go"
27)
28sha256sums=('SKIP'
29 '4e4f974f65a6cc7bdf11f4182d5f183e5831ebfd5ef9fae9814b617639440b35')
30pkgver() {
31 cd "$(_get_project_dir)"
32 set -o pipefail
33 git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
34 printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
35}
36_get_project_dir() {
37 local d
38 while IFS= read -r d; do
39 find "$d" -name "go.mod" -o -name "go.sum" 2>/dev/null | grep -q . && { echo "$d"; return; }
40 done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
41}
42_ensure_local_nvm() {
43 local NVM_DIR="${srcdir}/.nvm"
44 source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
45 nvm install "${_nodeversion}"
46 nvm use "${_nodeversion}"
47}
48_set_go_build_env() {
49 export HOME="${srcdir}/.home"
50 export GOPATH="${HOME}/go"
51 export GOCACHE="${HOME}/go-build"
52 export GOENV="${HOME}/go/env"
53 export XDG_CONFIG_HOME="${HOME}/.config"
54 export XDG_CACHE_HOME="${HOME}/.cache"
55 export CGO_CPPFLAGS="${CPPFLAGS}"
56 export CGO_CFLAGS="${CFLAGS}"
57 export CGO_CXXFLAGS="${CXXFLAGS}"
58 export CGO_LDFLAGS="${LDFLAGS}"
59 export GOFLAGS="-buildmode=pie -trimpath -ldflags=-linkmode=external -mod=readonly -modcacherw"
60 export GOTOOLCHAIN=local
61 export GOWORK=off
62 mkdir -p "${HOME}" "${GOCACHE}" "${XDG_CONFIG_HOME}" "${XDG_CACHE_HOME}" "$(dirname "${GOENV}")"
63 : > "${GOENV}"
64 export PATH="${GOPATH}/bin:${PATH}"
65}
66_set_pnpm_build_env() {
67 export HOME="${srcdir}/.home"
68 export XDG_CACHE_HOME="${HOME}/.cache"
69 export XDG_CONFIG_HOME="${HOME}/.config"
70 export XDG_DATA_HOME="${HOME}/.local/share"
71 export XDG_STATE_HOME="${HOME}/.local/state"
72 export PNPM_HOME="${HOME}/.pnpm/bin"
73 export pnpm_config_cache_dir="${HOME}/.pnpm_cache"
74 export pnpm_config_store_dir="${HOME}/.pnpm_store"
75 export pnpm_config_global_dir="${HOME}/.pnpm/global"
76 export pnpm_config_state_dir="${HOME}/.pnpm/state"
77 export pnpm_config_node_linker=hoisted
78 export pnpm_config_minimum_release_age=0
79 export pnpm_config_update_notifier=false
80 export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
81 export COREPACK_HOME="${HOME}/.corepack"
82 mkdir -p "${HOME}" "${PNPM_HOME}" "${pnpm_config_cache_dir}" "${pnpm_config_store_dir}" "${pnpm_config_global_dir}" "${pnpm_config_state_dir}" "${COREPACK_HOME}"
83 export PATH="${PNPM_HOME}:${PATH}"
84 local _pnpmver=""
85 local _pkgjson="$(_get_project_dir)/package.json"
86 if [ -f "${_pkgjson}" ]; then
87 _pnpmver="$(grep -o '"packageManager"[^,]*' "${_pkgjson}" 2>/dev/null | grep -oE 'pnpm@[^"+]+' | head -n1 | sed 's/^pnpm@//')"
88 if [ -z "${_pnpmver}" ]; then
89 _pnpmver="$(grep -oE '"pnpm"[[:space:]]*:[[:space:]]*"[^"]+"' "${_pkgjson}" 2>/dev/null | grep -oE '[0-9][0-9.]*' | head -n1)"
90 fi
91 fi
92 if [ -n "${_pnpmver}" ]; then
93 npm install -g "pnpm@${_pnpmver}" --prefix "${HOME}/.pnpm" \
94 --registry "${COREPACK_NPM_REGISTRY}"
95 fi
96}
97prepare() {
98 cd "$(_get_project_dir)"
99 gendesk -f -n -q \
100 --pkgname="${pkgname}" \
101 --pkgdesc="${pkgdesc}" \
102 --categories="Utility" \
103 --name="${_pkgname}" \
104 --exec="${pkgname} %U"
105 _ensure_local_nvm
106 _set_pnpm_build_env
107 _set_go_build_env
108 install "${srcdir}/modifiers_linux.go" -t internal/hotkey
109 go install github.com/wailsapp/wails/v3/cmd/wails3@latest
110 cd "$(_get_project_dir)/frontend"
111 export NODE_ENV=development
112 pnpm install
113}
114build() {
115 cd "$(_get_project_dir)/build"
116 _ensure_local_nvm
117 _set_pnpm_build_env
118 _set_go_build_env
119 go mod tidy
120 wails3 generate bindings -f '-tags production -trimpath -buildvcs=false -ldflags="-w -s -X main.version=v4.0.1"' -clean=true -ts
121 cd "$(_get_project_dir)/frontend"
122 export NODE_ENV=production
123 pnpm run build
124 cd "$(_get_project_dir)"
125 go build -tags production -trimpath -buildvcs=false -ldflags="-w -s -X main.version=v4.0.1" -o "bin/${pkgname%-git}"
126}
127package() {
128 install -Dm644 "$(_get_project_dir)/bin/${pkgname%-git}" -t "${pkgdir}/usr/bin"
129 install -Dm644 "$(_get_project_dir)/build/appicon.png" "${pkgdir}/usr/share/icons/hicolor/256x256/apps/${pkgname%-git}.png"
130 install -Dm644 "$(_get_project_dir)/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
131 install -Dm644 "$(_get_project_dir)/LICENSE.md" -t "${pkgdir}/usr/share/licenses/${pkgname}"
132}
133

Changes since previous scan

--- PKGBUILD @ 2026-10-30 00:29
+++ PKGBUILD @ 2026-11-01 00:21
@@ -1,7 +1,7 @@
# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
pkgname=ghost-chat-git
_pkgname=GhostChat
-pkgver=4.8.0.r0.g1b86996
+pkgver=4.9.0.r0.g94030dd
_nodeversion=24
pkgrel=1
pkgdesc="A Standalone chat overlay for Twitch, Kick, YouTube and other streaming platforms."
@@ -45,12 +45,25 @@
nvm install "${_nodeversion}"
nvm use "${_nodeversion}"
}
-_set_build_env() {
- export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
- export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
- export ELECTRON_SKIP_BINARY_DOWNLOAD=1
- export ELECTRON_BUILDER_OFFLINE=true
- export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
+_set_go_build_env() {
+ export HOME="${srcdir}/.home"
+ export GOPATH="${HOME}/go"
+ export GOCACHE="${HOME}/go-build"
+ export GOENV="${HOME}/go/env"
+ export XDG_CONFIG_HOME="${HOME}/.config"
+ export XDG_CACHE_HOME="${HOME}/.cache"
+ export CGO_CPPFLAGS="${CPPFLAGS}"
+ export CGO_CFLAGS="${CFLAGS}"
+ export CGO_CXXFLAGS="${CXXFLAGS}"
+ export CGO_LDFLAGS="${LDFLAGS}"
+ export GOFLAGS="-buildmode=pie -trimpath -ldflags=-linkmode=external -mod=readonly -modcacherw"
+ export GOTOOLCHAIN=local
+ export GOWORK=off
+ mkdir -p "${HOME}" "${GOCACHE}" "${XDG_CONFIG_HOME}" "${XDG_CACHE_HOME}" "$(dirname "${GOENV}")"
+ : > "${GOENV}"
+ export PATH="${GOPATH}/bin:${PATH}"
+}
+_set_pnpm_build_env() {
export HOME="${srcdir}/.home"
export XDG_CACHE_HOME="${HOME}/.cache"
export XDG_CONFIG_HOME="${HOME}/.config"
@@ -80,21 +93,6 @@
npm install -g "pnpm@${_pnpmver}" --prefix "${HOME}/.pnpm" \
--registry "${COREPACK_NPM_REGISTRY}"
fi
- export GOPATH="${HOME}/go"
- export GOCACHE="${HOME}/go-build"
- export GOENV="${HOME}/go/env"
- export XDG_CONFIG_HOME="${HOME}/.config"
- export XDG_CACHE_HOME="${HOME}/.cache"
- export CGO_CPPFLAGS="${CPPFLAGS}"
- export CGO_CFLAGS="${CFLAGS}"
- export CGO_CXXFLAGS="${CXXFLAGS}"
- export CGO_LDFLAGS="${LDFLAGS}"
- export GOFLAGS="-buildmode=pie -trimpath -ldflags=-linkmode=external -mod=readonly -modcacherw"
- export GOTOOLCHAIN=local
- export GOWORK=off
- export PATH="${PATH}:$(go env GOPATH)/bin"
- mkdir -p "${HOME}" "${GOCACHE}" "${XDG_CONFIG_HOME}" "${XDG_CACHE_HOME}" "$(dirname "${GOENV}")"
- : > "${GOENV}"
}
prepare() {
cd "$(_get_project_dir)"
@@ -105,8 +103,9 @@
--name="${_pkgname}" \
--exec="${pkgname} %U"
_ensure_local_nvm
- _set_build_env
- cp "${srcdir}/modifiers_linux.go" internal/hotkey/modifiers_linux.go
+ _set_pnpm_build_env
+ _set_go_build_env
+ install "${srcdir}/modifiers_linux.go" -t internal/hotkey
go install github.com/wailsapp/wails/v3/cmd/wails3@latest
cd "$(_get_project_dir)/frontend"
export NODE_ENV=development
@@ -115,7 +114,8 @@
build() {
cd "$(_get_project_dir)/build"
_ensure_local_nvm
- _set_build_env
+ _set_pnpm_build_env
+ _set_go_build_env
go mod tidy
wails3 generate bindings -f '-tags production -trimpath -buildvcs=false -ldflags="-w -s -X main.version=v4.0.1"' -clean=true -ts
cd "$(_get_project_dir)/frontend"

Scan history

Scanned at (UTC)SeverityRules
2026-11-01 00:21:48 Medium 2
2026-10-31 00:07:41 Medium 2
2026-10-30 07:55:24 Medium 2
2026-10-30 00:29:30 Low 2
2026-10-29 00:13:55 Low 2
2026-10-28 00:06:54 Low 2
2026-10-27 00:23:28 Low 2
2026-10-26 00:12:40 Low 2
2026-10-25 00:20:48 Low 2
2026-10-24 00:14:55 Low 2
2026-10-23 00:02:19 Low 2
2026-10-22 00:13:10 Low 2
2026-10-21 00:12:50 Low 2
2026-10-20 00:10:31 Low 2
2026-10-19 00:03:55 Low 2
2026-10-18 00:06:55 Low 2
2026-10-17 00:21:55 Low 2
2026-10-16 00:12:47 Low 2
2026-10-15 00:28:05 Low 2
2026-10-14 13:20:15 Medium 1

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion