haven-desktop-git
MEDIUM
maintainer HavenSoftware
0 votes
scanned 2026-09-06 05:10:24.165680
Why flagged
Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.
Triggered rules
Medium
npm/yarn/pnpm install of an undeclared external package
npm_install_external
Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.
-
PKGBUILD:80
npm install --global --prefix "$srcdir/yarn-local" yarn@1.22.22 -
PKGBUILD:92
npm install --global --prefix "$srcdir/pnpm-local" pnpm@11.23.0
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
PKGBUILD
2 offending line(s) highlighted
1
# Maintainer: Haven Software <havensoftware@zohomail.com>
2
pkgname=haven-desktop-git
3
pkgver=0.8.5.r0.g8b44496ad3
4
pkgrel=1
5
pkgdesc="Matrix chat and social client, built on Element Web/Desktop (built from source)"
6
arch=('x86_64')
7
url="https://app.haven.software"
8
license=('AGPL-3.0-only')
9
provides=('haven-desktop')
10
conflicts=('haven-desktop')
11
options=('!strip' '!debug')
12
depends=(
13
'gtk3'
14
'nss'
15
'libxss'
16
'libnotify'
17
'libayatana-appindicator'
18
'alsa-lib'
19
'at-spi2-core'
20
'libsecret'
21
'c-ares'
22
'libevent'
23
'libvpx'
24
'libxslt'
25
're2'
26
'snappy'
27
)
28
# HAVEN_SESHAT=0 skips building matrix-seshat (local encrypted-room message search) from
29
# source - on by default, matching every other Haven build/release (arguably the reason to
30
# pick this package over the community element-desktop-git, which never builds it at all).
31
# Skipping it is a real, safe feature tradeoff, not a build-machine workaround: the packaged
32
# app simply lacks local search (falls back to the same "Cannot find package 'matrix-seshat'"
33
# gap every Haven release before 0.8.0 silently shipped with, not a crash or install
34
# failure) - pnpm-workspace.yaml's own matrix-seshat "link:" dependency tolerates its target
35
# directory not existing at all, confirmed by a real fresh-clone build with no .hak/
36
# succeeding well before hak's own build step ever runs.
37
# NOTE for whoever edits this next: .SRCINFO is a static snapshot from `makepkg
38
# --printsrcinfo` - it only reflects whichever branch below is true at generation time (the
39
# default, HAVEN_SESHAT unset), not both. AUR helpers reading .SRCINFO alone won't discover
40
# the makedepends change a user's own HAVEN_SESHAT=0 build makes - an accepted, if unusual,
41
# tradeoff for a PKGBUILD with an optional variant like this.
42
_seshat=${HAVEN_SESHAT:-1}
43
44
# rust/perl are for building matrix-seshat from source - it bundles SQLCipher, whose
45
# "bundled-sqlcipher" cargo feature also vendors+compiles OpenSSL from source (openssl-src
46
# crate), which needs perl for its Configure script. No libclang/bindgen in the dependency
47
# tree, so no clang makedepend needed - see the release repo's own flatpak/build.sh for how
48
# this was worked out from a real Flathub aarch64 CI failure.
49
# libxcrypt-compat: fpm's own vendored Ruby needs libcrypt.so.1, the legacy SONAME modern
50
# Arch's glibc/libxcrypt split dropped in favor of libxcrypt's own newer one - confirmed
51
# live ("ruby: error while loading shared libraries: libcrypt.so.1: cannot open shared
52
# object file"). The community element-desktop-git AUR package already carries this same
53
# makedepend for the identical reason.
54
makedepends=('git' 'nodejs' 'npm' 'libxcrypt-compat')
55
if [ "$_seshat" = 1 ]; then
56
makedepends+=('rust' 'perl')
57
fi
58
source=("${pkgname%-git}::git+https://github.com/Haven-Organization/haven-desktop.git#branch=develop")
59
sha256sums=('SKIP')
60
install=haven-desktop-git.install
61
62
pkgver() {
63
cd "$srcdir/${pkgname%-git}"
64
git describe --tags --long | sed 's/^haven-v//;s/\([^-]*-g\)/r\1/;s/-/./g'
65
}
66
67
prepare() {
68
# This is a unified fork repo, not a plain element-web checkout - the actual pnpm
69
# workspace root (package.json, pnpm-workspace.yaml) lives under element-web/, while the
70
# repo root itself only has HAVEN_VERSION/flatpak/scripts/LICENSE etc. Confirmed live: a
71
# bare "pnpm install" at the repo root fails outright with ERR_PNPM_NO_PKG_MANIFEST.
72
cd "$srcdir/${pkgname%-git}/element-web"
73
74
# hak (Element's native-module build tool) hardcodes "yarn" for matrix-seshat's own
75
# install/build steps, not pnpm. Pin real Yarn Classic (1.x) locally instead of trusting
76
# whatever "yarn" the build machine happens to have on PATH - could be missing entirely,
77
# or a Yarn Berry shim via corepack, which behaves very differently. Matches the same
78
# reasoning flatpak/build.sh landed on after chasing several aarch64 CI failures back to
79
# exactly this kind of assumption.
80
npm install --global --prefix "$srcdir/yarn-local" yarn@1.22.22
81
82
# root package.json's devEngines.packageManager pins pnpm@11.23.0 for a real reason, not
83
# just style: pnpm-workspace.yaml's allowBuilds gained a git-URL-keyed entry (needed for
84
# pnpm >=11.9's stricter git-hosted-package security gate) that older pnpm can't even
85
# parse - confirmed live against Arch's own official "pnpm" package (11.3.0, the latest
86
# available there as of this writing): "pnpm install" fails outright with
87
# ERR_PNPM_INVALID_VERSION_UNION. This isn't a version-pin *check* to bypass (that's what
88
# COREPACK_ENABLE_STRICT=0/PNPM_CONFIG_PM_ON_FAIL=ignore below are for) - it's a real
89
# functionality gap in the pnpm binary itself, so pin a genuinely modern one the same way
90
# yarn is pinned above, matching flatpak/build.sh's own pnpm-11.23.0.tgz vendoring for
91
# this identical reason.
92
npm install --global --prefix "$srcdir/pnpm-local" pnpm@11.23.0
93
export PATH="$srcdir/pnpm-local/bin:$PATH"
94
95
export CI=true
96
export NX_NON_INTERACTIVE=true
97
# See the repo's own feedback-build-command notes: root package.json pins an exact pnpm
98
# version via devEngines.packageManager, and corepack separately pins a yarn version at
99
# the user-global level that otherwise blocks pnpm outright - both bypassed the same way
100
# every other real build in this project already does it.
101
export COREPACK_ENABLE_STRICT=0
102
export PNPM_CONFIG_PM_ON_FAIL=ignore
103
export npm_config_pm_on_fail=ignore
104
# HAVEN_NO_BRANDING/HAVEN_LOGIN_BACKGROUND/HAVEN_NOTIFICATION_SOUND are real source-tree
105
# mutations (a git-checkout-based revert loop plus two webpack.config.ts source patches
106
# for the first one; file substitution for the other two), not simple env-read switches -
107
# they live in scripts/setup.sh, which this PKGBUILD otherwise deliberately doesn't call
108
# (its own plain "pnpm install" would re-trigger the expensive install-app-deps
109
# postinstall --ignore-scripts below exists to skip). Only pay that cost on the less
110
# common opt-in path; the default build keeps the fast, already-proven recipe untouched.
111
if [ -n "${HAVEN_NO_BRANDING:-}${HAVEN_LOGIN_BACKGROUND:-}${HAVEN_NOTIFICATION_SOUND:-}" ]; then
112
bash "$srcdir/${pkgname%-git}/scripts/setup.sh"
113
else
114
# --ignore-scripts skips the workspace root's own postinstall, which runs
115
# apps/desktop's "sane-postinstall" (electron-builder install-app-deps) across all 12
116
# workspace projects - a generic native-module rebuild pass that isn't needed here
117
# (the only real native dependency, matrix-seshat, is hak-managed and built
118
# separately below with SQLCIPHER_BUNDLED=1, not through electron-builder's own
119
# rebuild machinery at all) and spiked memory hard enough with its own default
120
# per-core parallelism to get this build OOM-killed twice in a row on an otherwise
121
# healthy machine.
122
pnpm install --frozen-lockfile=false --ignore-scripts
123
fi
124
}
125
126
build() {
127
cd "$srcdir/${pkgname%-git}/element-web"
128
export PATH="$srcdir/yarn-local/bin:$srcdir/pnpm-local/bin:$PATH"
129
export CI=true
130
export NX_NON_INTERACTIVE=true
131
export COREPACK_ENABLE_STRICT=0
132
export PNPM_CONFIG_PM_ON_FAIL=ignore
133
export npm_config_pm_on_fail=ignore
134
cd apps/web
135
# nx's default task parallelism (3) runs multiple projects' webpack/Terser builds
136
# concurrently ("build" depends on "^build" - element-web + 4 dependency tasks were
137
# reported running together) - each one memory-heavy enough on its own (production
138
# minification is the slow, RAM-hungry part) that running them concurrently OOM-killed
139
# this build even with the machine otherwise idle. NX_PARALLEL is not a real nx env var
140
# (confirmed - not referenced anywhere in nx's own source). "pnpm build -- --parallel=1"
141
# doesn't work either - pnpm's own "--" passthrough delivers a literal "--" token
142
# followed by the flag (confirmed live: process.argv came through as
143
# ["--","--parallel=1"]), which nx's yargs-based parser treats as "everything after
144
# this is positional", not a real --parallel option - it silently kept using the
145
# default the whole time. Invoke nx directly via "pnpm exec" instead, which passes the
146
# flag through cleanly with no "--" involved at all.
147
# HAVEN_INCLUDE_OLD_ROOM_LIST is required for any real/deployed build, not just dev -
148
# without it the "Use Old Room List" Labs toggle silently has nothing to switch to
149
# (legacy-room-list resolves to a stub at build time otherwise).
150
# Invoke the installed nx binary directly rather than through "pnpm exec" - the latter
151
# re-runs its own lockfile-freshness check first, which re-triggers the exact
152
# apps/desktop "sane-postinstall" (electron-builder install-app-deps) step prepare()
153
# already deliberately skipped with --ignore-scripts.
154
HAVEN_INCLUDE_OLD_ROOM_LIST="${HAVEN_INCLUDE_OLD_ROOM_LIST:-1}" \
155
"$srcdir/${pkgname%-git}/element-web/node_modules/.bin/nx" build --parallel=1
156
157
# electron-builder's own beforeBuild hook hard-requires apps/desktop/webapp.asar to
158
# already exist ("The webapp.asar archive is missing. Building without a webapp is
159
# fruitless.", confirmed live) - "nx build" above only produces the raw unpacked
160
# apps/web/webapp/ directory, it doesn't pack it. config.sample.json is copied in first
161
# since electron-builder needs *some* config.json present; a generic build can't bake in
162
# a real homeserver choice. Matches flatpak/build.sh's own equivalent step exactly.
163
cp config.sample.json webapp/config.json
164
cd ../desktop
165
pnpm exec asar pack ../web/webapp webapp.asar
166
167
# Build matrix-seshat from source before packaging (unless HAVEN_SESHAT=0 - see that
168
# variable's own comment near makedepends above) - SQLCIPHER_BUNDLED=1 statically links
169
# SQLCipher/OpenSSL into index.node instead of dynamically linking the system's
170
# libsqlcipher.so.0 (confirmed via ldd - without it, this becomes a real, silent
171
# runtime-breakage risk on any machine without that exact package/SONAME installed).
172
if [ "$_seshat" = 1 ]; then
173
SQLCIPHER_BUNDLED=1 pnpm run build:native
174
fi
175
176
# VARIANT_PATH (e.g. VARIANT_PATH=element.io/release/build.json for a stock-Element
177
# identity/appId/protocols instead of Haven's own) needs no handling here at all -
178
# electron-builder.ts reads it straight from process.env, and an exported env var
179
# already reaches this function's child processes through normal shell inheritance.
180
181
# electron-builder.ts's own default linux.target is ["tar.gz", "deb", "AppImage"] - the
182
# CLI's "--linux pacman" flag ADDS to that list rather than replacing it (confirmed
183
# live: a real build with just that flag built all four targets, wasting ~12 minutes and
184
# hitting an unrelated deb-specific failure before ever reaching pacman). Sed-patch the
185
# target list directly instead, the same way flatpak/build.sh already does for its own
186
# "dir" target, to build only what package() actually uses.
187
sed -i 's/target: \["tar.gz", "deb", "AppImage"\],/target: ["pacman"],/' electron-builder.ts
188
189
# "--publish=never" alone isn't enough to stop electron-builder from generating
190
# autoupdate metadata (confirmed live: "GitHub Personal Access Token is not set" -
191
# CI=true, needed elsewhere in this build, makes electron-builder implicitly assume
192
# publishing is wanted regardless of the CLI flag). flatpak/build.sh already solved this
193
# identical problem the same way: force config.publish = null at the config level.
194
sed -i 's#export default config;#config.publish = null; export default config;#' electron-builder.ts
195
196
# Build the real pacman target (same electron-builder/fpm output already published in
197
# GitHub releases and used by haven-desktop-bin) rather than the raw "dir" target and
198
# hand-assembling a .desktop/icon layout ourselves - fpm already gets the Exec path,
199
# icon name, MIME handlers and StartupWMClass right, confirmed by inspecting a real
200
# release .pacman directly.
201
VERSION="${pkgver%%.r*}" pnpm build -- --publish=never
202
}
203
204
package() {
205
cd "$srcdir/${pkgname%-git}/element-web/apps/desktop"
206
bsdtar -xf dist/*.pacman -C "$pkgdir" --exclude='.PKGINFO' --exclude='.MTREE' --exclude='.BUILDINFO' --exclude='.INSTALL'
207
208
install -Dm644 ../../../LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
209
}
210
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-06 05:10:24 | Medium | 2 |
| 2026-09-06 03:11:40 | Low | 3 |
| 2026-09-06 03:10:21 | Medium | 2 |