guiman

maintainer Junaid433 · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The npm install and npx tauri build commands are used to build the project from its own source code checked out from the declared GitHub repository, which is a normal and legitimate practice for AUR packages; the tools are not executing arbitrary remote code but building the package's own declared source.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The npm install and npx tauri build commands are used to build the project from its own source code checked out from the declared GitHub repository, which is a normal and legitimate practice for AUR packages; the tools are not executing arbitrary remote code but building the package's own declared source.

2 higher static findings superseded - not the current verdict (shown for transparency)

MEDIUM npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:63 npm install --silent @tauri-apps/cli

MEDIUM npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:65 npx tauri build || {

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Junaid Rahman <junaid.cloud2@gmail.com>
    
      2pkgname=guiman
    
      3pkgver=1.6.0
    
      4pkgrel=1
    
      5pkgdesc="The Ultimate Arch Linux Package Manager - GUI with 100% pacman & AUR feature parity"
    
      6arch=('x86_64')
    
      7url="https://github.com/Junaid433/guiman"
    
      8license=('MIT')
    
      9depends=(
    
      10    'webkit2gtk'
    
      11    'gtk3'
    
      12    'libayatana-appindicator'
    
      13    'pacman'
    
      14    'sudo'
    
      15)
    
      16makedepends=(
    
      17    'nodejs'
    
      18    'npm'
    
      19    'git'
    
      20    'ffmpeg'
    
      21    'pkgconf'
    
      22    'openssl'
    
      23    'rust'
    
      24    'cargo'
    
      25    'base-devel'
    
      26)
    
      27optdepends=(
    
      28    'yay: AUR helper support'
    
      29    'paru: AUR helper support'
    
      30    'reflector: Mirror management'
    
      31    'polkit: Password-free operations'
    
      32)
    
      33provides=('guiman')
    
      34conflicts=('guiman-bin' 'guiman-git')
    
      35source=("git+$url.git")
    
      36sha256sums=('SKIP')
    
      37
    
      38pkgver() {
    
      39    cd "$srcdir/guiman"
    
      40    git describe --tags --abbrev=0 | sed 's/^v//'
    
      41}
    
      42
    
      43prepare() {
    
      44    cd "$srcdir/guiman"
    
      45
    
      46    if [ -f "src-tauri/icons/icon.png" ]; then
    
      47        ffmpeg -y -loglevel error -i src-tauri/icons/icon.png -vf "format=rgba,scale=512:512:force_original_aspect_ratio=increase,crop=512:512" src-tauri/icons/icon_rgba.png
    
      48        mv src-tauri/icons/icon_rgba.png src-tauri/icons/icon.png
    
      49        echo "Icon converted to RGBA format and made square"
    
      50    fi
    
      51
    
      52    if [ -f "src-tauri/tauri.conf.json" ]; then
    
      53        sed -i 's/"productName": "GuiMan"/"productName": "guiman"/' src-tauri/tauri.conf.json
    
      54        echo "Fixed productName in tauri.conf.json"
    
      55    fi
    
      56}
    
      57
    
      58build() {
    
      59    cd "$srcdir/guiman"
    
      60
    
      61    npm ci --silent || npm install --silent
    
      62
    
      63    npm install --silent @tauri-apps/cli
    
      64
    
      65    npx tauri build || {
    
      66        echo "Build failed" >&2
    
      67        exit 1
    
      68    }
    
      69}
    
      70
    
      71package() {
    
      72    cd "$srcdir/guiman"
    
      73
    
      74    install -Dm755 /dev/stdin "$pkgdir/usr/bin/$pkgname" << 'EOF'
    
      75#!/bin/bash
    
      76export WEBKIT_DISABLE_COMPOSITING_MODE=0
    
      77export WEBKIT_USE_GPU=1
    
      78export WEBKIT_DISABLE_DMABUF_RENDERER=1
    
      79export GDK_BACKEND=x11
    
      80exec /usr/lib/guiman/guiman "$@"
    
      81EOF
    
      82    
    
      83    install -Dm755 "src-tauri/target/release/$pkgname" "$pkgdir/usr/lib/guiman/$pkgname"
    
      84
    
      85    [ -f "$pkgname.desktop" ] && install -Dm644 "$pkgname.desktop" "$pkgdir/usr/share/applications/$pkgname.desktop"
    
      86
    
      87    [ -f "src-tauri/icons/icon.png" ] && install -Dm644 "src-tauri/icons/icon.png" "$pkgdir/usr/share/pixmaps/$pkgname.png"
    
      88
    
      89    if [ -f "polkit/com.guiman.pkexec.policy" ]; then
    
      90        install -Dm644 "polkit/com.guiman.pkexec.policy" "$pkgdir/usr/share/polkit-1/actions/com.guiman.pkexec.policy"
    
      91    fi
    
      92
    
      93    [ -f LICENSE ] && install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      94    [ -f README.md ] && install -Dm644 README.md "$pkgdir/usr/share/doc/$pkgname/README.md"
    
      95}
    
      96

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	3
2026-08-02 00:16:08	LOW	3
2026-08-01 00:11:18	LOW	3
2026-07-31 00:14:10	LOW	3
2026-07-30 00:17:23	LOW	3
2026-07-29 00:25:53	LOW	3
2026-07-28 00:07:28	LOW	3
2026-07-27 00:24:32	LOW	3
2026-07-26 00:07:32	LOW	3
2026-07-25 00:13:44	LOW	3
2026-07-24 00:02:28	LOW	3
2026-07-23 00:14:47	LOW	3
2026-07-22 00:29:32	LOW	3
2026-07-21 00:24:15	LOW	3
2026-07-20 00:19:49	LOW	3
2026-07-19 00:17:08	LOW	3
2026-07-18 00:14:48	LOW	3
2026-07-17 00:06:16	LOW	3
2026-07-16 00:05:41	LOW	3
2026-07-15 00:09:25	LOW	3