homebridge-git

maintainer orphaned · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The flagged npm install is for the project's own bundled source (homebridge.tgz), built from the git repository specified in source=(), not an external package; this is a normal part of building the package and not a supply-chain risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The flagged npm install is for the project's own bundled source (homebridge.tgz), built from the git repository specified in source=(), not an external package; this is a normal part of building the package and not a supply-chain risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:53 npm install -g --user root --prefix "$pkgdir"/usr "$srcdir"/$_pkgname.tgz

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Felix Golatofski <contact@xdfr.de>
    
      2# Contributor: ahrs <Forward dot to at hotmail dot co dot uk>
    
      3
    
      4_pkgname=homebridge
    
      5pkgname=$_pkgname-git
    
      6pkgver=0.4.46.r222.g721ff2c
    
      7pkgrel=3
    
      8pkgdesc="HomeKit support for the impatient"
    
      9arch=('any')
    
      10url="https://github.com/nfarina/homebridge"
    
      11license=('apache')
    
      12depends=('nodejs>=10.17.0' 'avahi')
    
      13makedepends=(
    
      14  'git'
    
      15  'npm'
    
      16  'python' # Needed for node-gyp for building native modules
    
      17)
    
      18provides=('homebridge')
    
      19conflicts=('homebridge')
    
      20options=(!emptydirs)
    
      21source=(
    
      22  "git+${url}.git"
    
      23  "${_pkgname}-system.service"
    
      24  "${_pkgname}-user.service"
    
      25  "${_pkgname}.sysusers"
    
      26  "${_pkgname}.install"
    
      27)
    
      28sha512sums=('SKIP'
    
      29            '16f923855946b1ff7fd6b70da035a304634c7dd42bd2e86c5877718fd5e3a22a7177fd8d850e7ffa4826cdd2fc2b30f727bd182809ddb9faade626f87ed792bc'
    
      30            '2fc28db38b231caf8021bd6109e1c4cee65dd68e2128e9f2bfe712fd61867328dd6b6be642a6431b2c92657a5e7f23991be8dcf1ea0c23e3cfa120341ee090bc'
    
      31            '18277a981c2e6f68ed6433d9afc89fb59019b763c253dd135bb3662baba2185245a7eb476b3eed36f5458386447ed766b89dd0e307c5c1ab277900a01c625c7d'
    
      32            '20e373e99d814ea23b5fa0c966cafdc7e8bf116443c475d08870bffc36027ae512fa2e0c6996802f04e9703a9df52bacf2e25ecadb04b137c798524e50e6817d')
    
      33
    
      34install="${_pkgname}.install"
    
      35
    
      36pkgver() {
    
      37  cd "${srcdir}/${_pkgname}"
    
      38  # cutting off 'v' prefix that presents in the git tag
    
      39  git describe --long | sed 's/^v//;s/\([^-]*-g\)/r\1/;s/-/./g'
    
      40}
    
      41
    
      42prepare() {
    
      43  cd "${srcdir}"
    
      44
    
      45  # Fix error with npm5 issue
    
      46  tar -czf homebridge.tgz homebridge
    
      47}
    
      48
    
      49package() {
    
      50  cd "${srcdir}/${_pkgname}"
    
      51
    
      52  install -Dm644 LICENSE -t "${pkgdir}/usr/share/licenses/${_pkgname}"
    
      53  npm install -g --user root --prefix "$pkgdir"/usr "$srcdir"/$_pkgname.tgz
    
      54  
    
      55  # Non-deterministic race in npm gives 777 permissions to random directories.
    
      56  # See https://github.com/npm/npm/issues/9359 for details.
    
      57  chmod -R u=rwX,go=rX "$pkgdir"
    
      58
    
      59  # npm installs package.json owned by build user
    
      60  # https://bugs.archlinux.org/task/63396
    
      61  chown -R root:root "$pkgdir"
    
      62
    
      63  # Delete npm installed pyc files
    
      64  find "$pkgdir" -name "*.pyc" -delete
    
      65
    
      66  [ -z "$HOMEBRIDGE_KEEP_GIT_HISTORY" ] && rm -rf "${pkgdir}/usr/lib/node_modules/${_pkgname}/.git"
    
      67
    
      68  install -Dm644 "${srcdir}/${_pkgname}-system.service" "$pkgdir/usr/lib/systemd/system/${_pkgname}.service"
    
      69  install -Dm644 "${srcdir}/${_pkgname}-user.service" "$pkgdir/usr/lib/systemd/user/${_pkgname}.service"
    
      70  install -Dm644 "${srcdir}/${_pkgname}.sysusers" "$pkgdir/usr/lib/sysusers.d/${_pkgname}.conf"
    
      71
    
      72}
    
      73
    
      74# vim:set ts=2 sw=2 et:
    
      75

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2