girpe-v2

LOW

maintainer Maravedis 0 votes scanned 2026-10-18 15:24:34.576931

View on AUR

Why flagged

Legitimate repackaging of an official FFTT Electron app from the project's own domain; npm packages used (electron, electron-rebuild, electron-builder) are standard well-known tools, though fetching them at build time from npm without pinned versions is a minor supply-chain concern.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): Legitimate repackaging of an official FFTT Electron app from the project's own domain; npm packages used (electron, electron-rebuild, electron-builder) are standard well-known tools, though fetching them at build time from npm without pinned versions is a minor supply-chain concern.

3 higher static findings superseded - not the current verdict (shown for transparency)

Medium npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:29 npm install --no-save electron electron-rebuild

Medium npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:30 npx --yes electron-builder --linux dir

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source=("$pkgname-$pkgver.zip::https://www.fftt.com/deploiements/girpe-v2/downloads/Girpe%20V2-$pkgver.zip"

PKGBUILD

3 offending line(s) highlighted

      1# Maintainer: Clément Malaingre malaingreclement@gmail.com
    
      2pkgname=girpe-v2
    
      3pkgver=2.2.3
    
      4pkgrel=1
    
      5pkgdesc='Application Electron/React de gestion des feuilles de rencontre FFTT'
    
      6arch=('x86_64')
    
      7url="https://www.fftt.com/deploiements/girpe-v2/#support"
    
      8licence=('MIT')
    
      9depends=()
    
      10makedepends=('npm' '7zip' 'asar' 'jq')
    
      11optdepends=()
    
      12provides=('girpe-v2')
    
      13options=(!strip)
    
      14source=("$pkgname-$pkgver.zip::https://www.fftt.com/deploiements/girpe-v2/downloads/Girpe%20V2-$pkgver.zip"
    
      15        "girpe-v2.desktop"
    
      16        "girpe-v2")
    
      17sha512sums=('d122d27b703253c84a9c95b0f9d190e7652454b7d6ccc58842b8d46fe49d025d8ef0ce7f9bc50c53ffca095bbb12aa0feab04df913f81d1b9dffcc2bb553c843'
    
      18            'bf16ea80bf5a593f25afcdc92aee4ed295ce377c911de75a96a39438f9fb8f0386fa1fc9445a48b0d2b0761acc3277cd4144d33cc3af3453875f326ffa37ee3c'
    
      19            'f4771027bc967ffedc29ad98bdb28539527bdc3414d9f6f3b15946cf47bbb57a58c189c87080694bfe2e56d3a9e601d613efb4d8ddc9ba956e893b790dca8827')
    
      20
    
      21build() {
    
      22    7z x "Girpe V2 $pkgver.exe"
    
      23    7z x '$PLUGINSDIR/app-64.7z'
    
      24    asar extract resources/app.asar unpacked_app
    
      25    cd unpacked_app
    
      26    find . -name "*.node" -exec rm -vf {} \;
    
      27    jq '.["desktopName"]="girpe-v2"|.["linux"].["syncDesktopName"]=true' package.json > package-new.json \
    
      28        && mv package-new.json package.json
    
      29    npm install --no-save electron electron-rebuild
    
      30    npx --yes electron-builder --linux dir
    
      31}
    
      32
    
      33package() {
    
      34    install -Dm644 -t "$pkgdir/usr/share/applications" girpe-v2.desktop
    
      35    install -Dm755 -t "$pkgdir/usr/bin" girpe-v2
    
      36
    
      37    install -dm755 "$pkgdir/usr/lib/$pkgname"
    
      38
    
      39    cd ${srcdir}/unpacked_app
    
      40    install -Dm644 -T src/out/assets/girpe-logo-Dojx6l73.png "$pkgdir/usr/share/pixmaps/girpe-v2-logo.png" 
    
      41    cp -rt "$pkgdir/usr/lib/$pkgname" dist/linux-unpacked/*
    
      42}
    
      43

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-18 15:24:34	Low	5
2026-10-18 15:22:20	Medium	5