ghost-chat-git
LOW
maintainer zxp19821005
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package installs 'wails3' via 'go install' from a public module, which is a common build step for Go-based projects and not inherently malicious, though it relies on remote code execution during build.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package installs 'wails3' via 'go install' from a public module, which is a common build step for Go-based projects and not inherently malicious, though it relies on remote code execution during build.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
External install via pipx/uv/poetry/cargo/go/gem
alt_pkg_manager_install
A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.
-
PKGBUILD:82
go install github.com/wailsapp/wails/v3/cmd/wails3@latest
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2
pkgname=ghost-chat-git
3
_pkgname=GhostChat
4
pkgver=4.5.0.r2.g1b3a9e6
5
_nodeversion=24
6
pkgrel=1
7
pkgdesc="A Standalone chat overlay for Twitch, Kick, YouTube and other streaming platforms."
8
arch=('any')
9
url="https://github.com/Enubia/ghost-chat"
10
license=('LicenseRef-DBAD')
11
conflicts=("${pkgname%-git}")
12
provides=("${pkgname%-git}=${pkgver%.r*}")
13
depends=(
14
'webkitgtk-6.0'
15
'gtk3'
16
)
17
makedepends=(
18
'pnpm'
19
'gendesk'
20
'go'
21
'nvm'
22
'curl'
23
'git'
24
)
25
source=(
26
"${pkgname%-git}.git::git+${url}.git"
27
"modifiers_linux.go"
28
)
29
sha256sums=('SKIP'
30
'b7f2400b0e956887b1e0d8cf4419c82726617503142b81b5c7ef3acbb1fc6798')
31
pkgver() {
32
cd "${srcdir}/${pkgname%-git}.git"
33
set -o pipefail
34
git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
35
printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
36
}
37
_ensure_local_nvm() {
38
local NVM_DIR="${srcdir}/.nvm"
39
source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
40
nvm install "${_nodeversion}"
41
nvm use "${_nodeversion}"
42
}
43
_set_build_env() {
44
export HOME="${srcdir}/.electron-gyp"
45
export PATH="${HOME}/go/bin:$PATH"
46
export CGO_ENABLED=1
47
export GO111MODULE=on
48
export GOOS=linux
49
export GOCACHE="${srcdir}/go-build"
50
export GOMODCACHE="${srcdir}/go/pkg/mod"
51
{
52
export PNPM_LINK_WORKSPACE_PACKAGES=true
53
export PNPM_FETCH_RETRY_MAXTIMEOUT=10000
54
export PNPM_CACHE_DIR="${srcdir}/.pnpm_cache"
55
export PNPM_STORE_DIR="${srcdir}/.pnpm_store"
56
export PNPM_VIRTUAL_STORE_DIR="${srcdir}/.pnpm_store"
57
export PNPM_SHAMEFULLY_HOIST=true
58
export PNPM_VIRTUAL_STORE_DIR_MAX_LENGTH=80
59
export PNPM_NODE_LINKER=hoisted
60
export PNPM_NETWORK_CONCURRENCY=32
61
}
62
if [[ "$(curl -s ipinfo.io/country)" == *"CN"* ]]; then
63
{
64
export pnpm_config_registry="https://registry.npmmirror.com"
65
export npm_config_registry="https://registry.npmmirror.com"
66
export NODEJS_ORG_MIRROR="https://npmmirror.com/mirrors/node"
67
export GOPROXY=https://goproxy.cn,direct
68
}
69
fi
70
}
71
prepare() {
72
cd "${srcdir}/${pkgname%-git}.git"
73
gendesk -f -n -q \
74
--pkgname="${pkgname%-git}" \
75
--pkgdesc="${pkgdesc}" \
76
--categories="Utility" \
77
--name="${_pkgname}" \
78
--exec="${pkgname%-git} %U"
79
_set_build_env
80
_ensure_local_nvm
81
cp "${srcdir}/modifiers_linux.go" internal/hotkey/modifiers_linux.go
82
go install github.com/wailsapp/wails/v3/cmd/wails3@latest
83
cd "${srcdir}/${pkgname%-git}.git/frontend"
84
NODE_ENV=development pnpm install --frozen-lockfile
85
}
86
build() {
87
_set_build_env
88
_ensure_local_nvm
89
cd "${srcdir}/${pkgname%-git}.git/build"
90
go mod tidy
91
wails3 generate bindings -f '-tags production -trimpath -buildvcs=false -ldflags="-w -s -X main.version=v4.0.1"' -clean=true -ts
92
cd "${srcdir}/${pkgname%-git}.git/frontend"
93
NODE_ENV=production pnpm run build
94
cd "${srcdir}/${pkgname%-git}.git"
95
go build -tags production -trimpath -buildvcs=false -ldflags="-w -s -X main.version=v4.0.1" -o "bin/${pkgname%-git}"
96
}
97
package() {
98
install -Dm644 "${srcdir}/${pkgname%-git}.git/bin/${pkgname%-git}" -t "${pkgdir}/usr/bin"
99
install -Dm644 "${srcdir}/${pkgname%-git}.git/build/appicon.png" "${pkgdir}/usr/share/pixmaps/${pkgname%-git}.png"
100
install -Dm644 "${srcdir}/${pkgname%-git}.git/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
101
install -Dm644 "${srcdir}/${pkgname%-git}.git/LICENSE.md" -t "${pkgdir}/usr/share/licenses/${pkgname}"
102
}
103
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |