homebridge-git

LOW

maintainer orphaned 1 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The flagged npm install is for the project's own bundled source (homebridge.tgz), built from the git repository specified in source=(), not an external package; this is a normal part of building the package and not a supply-chain risk.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The flagged npm install is for the project's own bundled source (homebridge.tgz), built from the git repository specified in source=(), not an external package; this is a normal part of building the package and not a supply-chain risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:53 npm install -g --user root --prefix "$pkgdir"/usr "$srcdir"/$_pkgname.tgz

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Felix Golatofski <contact@xdfr.de>
    
      2# Contributor: ahrs <Forward dot to at hotmail dot co dot uk>
    
      3
    
      4_pkgname=homebridge
    
      5pkgname=$_pkgname-git
    
      6pkgver=0.4.46.r222.g721ff2c
    
      7pkgrel=3
    
      8pkgdesc="HomeKit support for the impatient"
    
      9arch=('any')
    
      10url="https://github.com/nfarina/homebridge"
    
      11license=('apache')
    
      12depends=('nodejs>=10.17.0' 'avahi')
    
      13makedepends=(
    
      14  'git'
    
      15  'npm'
    
      16  'python' # Needed for node-gyp for building native modules
    
      17)
    
      18provides=('homebridge')
    
      19conflicts=('homebridge')
    
      20options=(!emptydirs)
    
      21source=(
    
      22  "git+${url}.git"
    
      23  "${_pkgname}-system.service"
    
      24  "${_pkgname}-user.service"
    
      25  "${_pkgname}.sysusers"
    
      26  "${_pkgname}.install"
    
      27)
    
      28sha512sums=('SKIP'
    
      29            '16f923855946b1ff7fd6b70da035a304634c7dd42bd2e86c5877718fd5e3a22a7177fd8d850e7ffa4826cdd2fc2b30f727bd182809ddb9faade626f87ed792bc'
    
      30            '2fc28db38b231caf8021bd6109e1c4cee65dd68e2128e9f2bfe712fd61867328dd6b6be642a6431b2c92657a5e7f23991be8dcf1ea0c23e3cfa120341ee090bc'
    
      31            '18277a981c2e6f68ed6433d9afc89fb59019b763c253dd135bb3662baba2185245a7eb476b3eed36f5458386447ed766b89dd0e307c5c1ab277900a01c625c7d'
    
      32            '20e373e99d814ea23b5fa0c966cafdc7e8bf116443c475d08870bffc36027ae512fa2e0c6996802f04e9703a9df52bacf2e25ecadb04b137c798524e50e6817d')
    
      33
    
      34install="${_pkgname}.install"
    
      35
    
      36pkgver() {
    
      37  cd "${srcdir}/${_pkgname}"
    
      38  # cutting off 'v' prefix that presents in the git tag
    
      39  git describe --long | sed 's/^v//;s/\([^-]*-g\)/r\1/;s/-/./g'
    
      40}
    
      41
    
      42prepare() {
    
      43  cd "${srcdir}"
    
      44
    
      45  # Fix error with npm5 issue
    
      46  tar -czf homebridge.tgz homebridge
    
      47}
    
      48
    
      49package() {
    
      50  cd "${srcdir}/${_pkgname}"
    
      51
    
      52  install -Dm644 LICENSE -t "${pkgdir}/usr/share/licenses/${_pkgname}"
    
      53  npm install -g --user root --prefix "$pkgdir"/usr "$srcdir"/$_pkgname.tgz
    
      54  
    
      55  # Non-deterministic race in npm gives 777 permissions to random directories.
    
      56  # See https://github.com/npm/npm/issues/9359 for details.
    
      57  chmod -R u=rwX,go=rX "$pkgdir"
    
      58
    
      59  # npm installs package.json owned by build user
    
      60  # https://bugs.archlinux.org/task/63396
    
      61  chown -R root:root "$pkgdir"
    
      62
    
      63  # Delete npm installed pyc files
    
      64  find "$pkgdir" -name "*.pyc" -delete
    
      65
    
      66  [ -z "$HOMEBRIDGE_KEEP_GIT_HISTORY" ] && rm -rf "${pkgdir}/usr/lib/node_modules/${_pkgname}/.git"
    
      67
    
      68  install -Dm644 "${srcdir}/${_pkgname}-system.service" "$pkgdir/usr/lib/systemd/system/${_pkgname}.service"
    
      69  install -Dm644 "${srcdir}/${_pkgname}-user.service" "$pkgdir/usr/lib/systemd/user/${_pkgname}.service"
    
      70  install -Dm644 "${srcdir}/${_pkgname}.sysusers" "$pkgdir/usr/lib/sysusers.d/${_pkgname}.conf"
    
      71
    
      72}
    
      73
    
      74# vim:set ts=2 sw=2 et:
    
      75

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2