imfile

LOW
maintainer zxp19821005 1 votes scanned 2026-10-20 05:27:35.159195
View on AUR
Why flagged

The package builds from a legitimate project source on GitHub, uses standard build tools, and installs only project assets; the flagged variable-named package installation refers to pnpm, a standard Node.js package manager, used within the build process from a trusted source.

Triggered rules

Low AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it LOW (confidence 95%): The package builds from a legitimate project source on GitHub, uses standard build tools, and installs only project assets; the flagged variable-named package installation refers to pnpm, a standard Node.js package manager, used within the build process from a trusted source.

  • PKGBUILD:97 npm install -g "pnpm@${_pnpmver}" --prefix "${HOME}/.pnpm" \

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2pkgname=imfile
3_pkgname=imFile
4_flathubname="io.github.${pkgname}_io.${pkgname}_desktop"
5pkgver=2.3.5
6_electronversion=43
7_nodeversion=24
8pkgrel=1
9pkgdesc="A full-featured download manager.Forked from motrix."
10arch=(
11 'aarch64'
12 'armv7l'
13 'x86_64'
14)
15url="https://imfile.org/"
16_ghurl="https://github.com/imfile-io/imfile-desktop"
17license=('MIT')
18conflicts=(
19 "${pkgname}"
20 "${pkgname}-electron"
21 'motrix'
22)
23provides=('motrix')
24depends=(
25 "electron${_electronversion}"
26 'aria2'
27)
28makedepends=(
29 'npm'
30 'pnpm'
31 'nvm'
32 'git'
33 'jq'
34)
35source=(
36 "${pkgname}-${pkgver}::git+${_ghurl}#tag=v${pkgver}"
37 "${pkgname}.sh"
38)
39sha256sums=('1f645ce75172ace86478cb54452914a13a15e06efca36eb90f81b062681a1065'
40 'dfcd6603d29c7b8d88e019b517a2e5c1a7b5ab905a0961a8b81adfa508b258b8')
41_get_project_dir() {
42 local d
43 while IFS= read -r d; do
44 find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
45 done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
46}
47_ensure_local_nvm() {
48 local NVM_DIR="${srcdir}/.nvm"
49 source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
50 nvm install "${_nodeversion}"
51 nvm use "${_nodeversion}"
52}
53_get_app_dir() {
54 find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -printf '%h\n' 2>/dev/null \
55 | while read -r d; do [[ -d "${d}/resources" ]] && { echo "$d"; return 0; }; done
56}
57_get_electron_version() {
58 _elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
59 | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
60 | grep -oE '[0-9]+' | head -1)
61 [[ -z "${_elec_ver}" ]] && return 1
62 (( _elec_ver == _electronversion )) && c=32 || c=31
63 echo -e "Electron version: \033[1;${c}m${_elec_ver}$([[ $c -eq 31 ]] && echo " (expected ${_electronversion})")\033[0m"
64}
65_set_build_env() {
66 export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
67 export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
68 export ELECTRON_SKIP_BINARY_DOWNLOAD=1
69 export ELECTRON_BUILDER_OFFLINE=true
70 export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
71 export HOME="${srcdir}/.home"
72 export XDG_CACHE_HOME="${HOME}/.cache"
73 export XDG_CONFIG_HOME="${HOME}/.config"
74 export XDG_DATA_HOME="${HOME}/.local/share"
75 export XDG_STATE_HOME="${HOME}/.local/state"
76 export PNPM_HOME="${HOME}/.pnpm/bin"
77 export pnpm_config_cache_dir="${HOME}/.pnpm_cache"
78 export pnpm_config_store_dir="${HOME}/.pnpm_store"
79 export pnpm_config_global_dir="${HOME}/.pnpm/global"
80 export pnpm_config_state_dir="${HOME}/.pnpm/state"
81 export pnpm_config_node_linker=hoisted
82 export pnpm_config_minimum_release_age=0
83 export pnpm_config_update_notifier=false
84 export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
85 export COREPACK_HOME="${HOME}/.corepack"
86 mkdir -p "${HOME}" "${PNPM_HOME}" "${pnpm_config_cache_dir}" "${pnpm_config_store_dir}" "${pnpm_config_global_dir}" "${pnpm_config_state_dir}" "${COREPACK_HOME}"
87 export PATH="${PNPM_HOME}:${PATH}"
88 local _pnpmver=""
89 local _pkgjson="$(_get_project_dir)/package.json"
90 if [ -f "${_pkgjson}" ]; then
91 _pnpmver="$(grep -o '"packageManager"[^,]*' "${_pkgjson}" 2>/dev/null | grep -oE 'pnpm@[^"+]+' | head -n1 | sed 's/^pnpm@//')"
92 if [ -z "${_pnpmver}" ]; then
93 _pnpmver="$(grep -oE '"pnpm"[[:space:]]*:[[:space:]]*"[^"]+"' "${_pkgjson}" 2>/dev/null | grep -oE '[0-9][0-9.]*' | head -n1)"
94 fi
95 fi
96 if [ -n "${_pnpmver}" ]; then
97 npm install -g "pnpm@${_pnpmver}" --prefix "${HOME}/.pnpm" \
98 --registry "${COREPACK_NPM_REGISTRY}"
99 fi
100}
101prepare() {
102 cd "$(_get_project_dir)"
103 _get_electron_version
104 sed -i -e "
105 s/@electronversion@/${_electronversion}/g
106 s/@appname@/${pkgname}/g
107 " "${srcdir}/${pkgname}.sh"
108 _ensure_local_nvm
109 _set_build_env
110 case "${CARCH}" in
111 aarch64) _replace_dir_name=arm64 ;;
112 armv7l) _replace_dir_name=armv7l ;;
113 x86_64) _replace_dir_name=x64 ;;
114 esac
115 ln -sf "/usr/bin/aria2c" "$(_get_project_dir)/extra/linux/${_replace_dir_name}/engine/aria2c"
116 jq --arg ver "${SYSTEM_ELECTRON_VERSION}" '.devDependencies.electron = $ver' package.json > package.json.tmp && mv package.json.tmp package.json
117 sed -i "s/'darwin', 'win32', 'linux'/'linux'/g" scripts/sync-go-aria2.mjs
118 sed -i "s/Icon=${_flathubname}/Icon=${pkgname}/g" "build/flathub/${_flathubname}.desktop"
119 sed -i "s/${_flathubname}/${pkgname}/g" "build/flathub/${_flathubname}.metainfo.xml"
120 find ./ -type f -name "pnpm-lock.yaml" -exec rm -rf {} +
121 export NODE_ENV=development
122 pnpm install
123}
124build() {
125 cd "$(_get_project_dir)"
126 _ensure_local_nvm
127 _set_build_env
128 export NODE_ENV=production
129 pnpm run sync-go-aria2
130 pnpm -c exec "node .electron-vue/build.js"
131 pnpm -c exec "electron-builder --linux dir -c.electronDist=${ELECTRON_DIST} --config=electron-builder.json"
132 rm -rf "$(_get_app_dir)/resources/default_app.asar"
133}
134package() {
135 install -Dm755 "${srcdir}/${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
136 install -Dm755 -d "${pkgdir}/usr/lib/${pkgname}"
137 cp -a "$(_get_app_dir)/resources/." "${pkgdir}/usr/lib/${pkgname}/"
138 install -Dm644 "$(_get_project_dir)/build/flathub/${_flathubname}.desktop" \
139 "${pkgdir}/usr/share/applications/${pkgname}.desktop"
140 install -Dm644 "$(_get_project_dir)/build/flathub/${_flathubname}.metainfo.xml" \
141 "${pkgdir}/usr/share/metainfo/${pkgname}.metainfo.xml"
142 install -Dm644 "$(_get_project_dir)/build/256x256.png" "${pkgdir}/usr/share/pixmaps/${pkgname%-git}.png"
143 install -Dm644 "$(_get_project_dir)/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
144}

Changes since previous scan

--- PKGBUILD @ 2026-08-13 13:26
+++ PKGBUILD @ 2026-10-20 05:27
@@ -2,11 +2,11 @@
pkgname=imfile
_pkgname=imFile
_flathubname="io.github.${pkgname}_io.${pkgname}_desktop"
-pkgver=2.3.4
+pkgver=2.3.5
_electronversion=43
_nodeversion=24
pkgrel=1
-pkgdesc="A full-featured download manager.Forked from motrix.(Use system-wide electron)"
+pkgdesc="A full-featured download manager.Forked from motrix."
arch=(
'aarch64'
'armv7l'
@@ -29,7 +29,6 @@
'npm'
'pnpm'
'nvm'
- 'curl'
'git'
'jq'
)
@@ -37,100 +36,109 @@
"${pkgname}-${pkgver}::git+${_ghurl}#tag=v${pkgver}"
"${pkgname}.sh"
)
-sha256sums=('0e580b2206bbc07c6eadfcdb1efa156c2d32f73e71ab70505820a2ff0f11c44c'
- 'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
+sha256sums=('1f645ce75172ace86478cb54452914a13a15e06efca36eb90f81b062681a1065'
+ 'dfcd6603d29c7b8d88e019b517a2e5c1a7b5ab905a0961a8b81adfa508b258b8')
+_get_project_dir() {
+ local d
+ while IFS= read -r d; do
+ find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
+ done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
+}
_ensure_local_nvm() {
- export NVM_DIR="${srcdir}/.nvm"
- source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
- nvm install "${_nodeversion}"
- nvm use "${_nodeversion}"
+ local NVM_DIR="${srcdir}/.nvm"
+ source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
+ nvm install "${_nodeversion}"
+ nvm use "${_nodeversion}"
}
_get_app_dir() {
- find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1
+ find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -printf '%h\n' 2>/dev/null \
+ | while read -r d; do [[ -d "${d}/resources" ]] && { echo "$d"; return 0; }; done
+}
+_get_electron_version() {
+ _elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
+ | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
+ | grep -oE '[0-9]+' | head -1)
+ [[ -z "${_elec_ver}" ]] && return 1
+ (( _elec_ver == _electronversion )) && c=32 || c=31
+ echo -e "Electron version: \033[1;${c}m${_elec_ver}$([[ $c -eq 31 ]] && echo " (expected ${_electronversion})")\033[0m"
}
_set_build_env() {
- export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
- export ELECTRON_SKIP_BINARY_DOWNLOAD=1
- export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/v//g')"
- export HOME="${srcdir}/.electron-gyp"
- {
- export PNPM_LINK_WORKSPACE_PACKAGES=true
- export PNPM_FETCH_RETRY_MAXTIMEOUT=10000
- export PNPM_CACHE_DIR="${srcdir}/.pnpm_cache"
- export PNPM_STORE_DIR="${srcdir}/.pnpm_store"
- export PNPM_VIRTUAL_STORE_DIR="${srcdir}/.pnpm_store"
- export PNPM_SHAMEFULLY_HOIST=true
- export PNPM_VIRTUAL_STORE_DIR_MAX_LENGTH=80
- export PNPM_NODE_LINKER=hoisted
- export PNPM_NETWORK_CONCURRENCY=32
- }
- if [[ "$(curl -s ipinfo.io/country)" == *"CN"* ]]; then
- {
- export pnpm_config_registry="https://registry.npmmirror.com"
- export npm_config_registry="https://registry.npmmirror.com"
- export NPM_CONFIG_ELECTRON_MIRROR="https://registry.npmmirror.com/-/binary/electron/"
- export NPM_CONFIG_ELECTRON_BUILDER_BINARIES_MIRROR="https://registry.npmmirror.com/-/binary/electron-builder-binaries/"
- export NODEJS_ORG_MIRROR="https://npmmirror.com/mirrors/node"
- }
- fi
-}
-_get_electron_version() {
- _elec_ver=$(find "${srcdir}" -maxdepth 5 -name "package.json" ! -path "*/node_modules/*" \
- -exec grep -l '"electron"' {} + | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null | head -1)
- [[ -z "${_elec_ver}" ]] && return 1
- echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
+ export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
+ export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
+ export ELECTRON_SKIP_BINARY_DOWNLOAD=1
+ export ELECTRON_BUILDER_OFFLINE=true
+ export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
+ export HOME="${srcdir}/.home"
+ export XDG_CACHE_HOME="${HOME}/.cache"
+ export XDG_CONFIG_HOME="${HOME}/.config"
+ export XDG_DATA_HOME="${HOME}/.local/share"
+ export XDG_STATE_HOME="${HOME}/.local/state"
+ export PNPM_HOME="${HOME}/.pnpm/bin"
+ export pnpm_config_cache_dir="${HOME}/.pnpm_cache"
+ export pnpm_config_store_dir="${HOME}/.pnpm_store"
+ export pnpm_config_global_dir="${HOME}/.pnpm/global"
+ export pnpm_config_state_dir="${HOME}/.pnpm/state"
+ export pnpm_config_node_linker=hoisted
+ export pnpm_config_minimum_release_age=0
+ export pnpm_config_update_notifier=false
+ export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
+ export COREPACK_HOME="${HOME}/.corepack"
+ mkdir -p "${HOME}" "${PNPM_HOME}" "${pnpm_config_cache_dir}" "${pnpm_config_store_dir}" "${pnpm_config_global_dir}" "${pnpm_config_state_dir}" "${COREPACK_HOME}"
+ export PATH="${PNPM_HOME}:${PATH}"
+ local _pnpmver=""
+ local _pkgjson="$(_get_project_dir)/package.json"
+ if [ -f "${_pkgjson}" ]; then
+ _pnpmver="$(grep -o '"packageManager"[^,]*' "${_pkgjson}" 2>/dev/null | grep -oE 'pnpm@[^"+]+' | head -n1 | sed 's/^pnpm@//')"
+ if [ -z "${_pnpmver}" ]; then
+ _pnpmver="$(grep -oE '"pnpm"[[:space:]]*:[[:space:]]*"[^"]+"' "${_pkgjson}" 2>/dev/null | grep -oE '[0-9][0-9.]*' | head -n1)"
+ fi
+ fi
+ if [ -n "${_pnpmver}" ]; then
+ npm install -g "pnpm@${_pnpmver}" --prefix "${HOME}/.pnpm" \
+ --registry "${COREPACK_NPM_REGISTRY}"
+ fi
}
prepare() {
- cd "${srcdir}/${pkgname}-${pkgver}"
+ cd "$(_get_project_dir)"
_get_electron_version
sed -i -e "
s/@electronversion@/${_electronversion}/g
s/@appname@/${pkgname}/g
- s/@runname@/app.asar/g
- s/@cfgdirname@/${_pkgname}/g
" "${srcdir}/${pkgname}.sh"
+ _ensure_local_nvm
_set_build_env
- _ensure_local_nvm
case "${CARCH}" in
- aarch64)
- _replace_dir_name=arm64
- ;;
- armv7h)
- _replace_dir_name=armv7l
- ;;
- x86_64)
- _replace_dir_name=x64
- ;;
+ aarch64) _replace_dir_name=arm64 ;;
+ armv7l) _replace_dir_name=armv7l ;;
+ x86_64) _replace_dir_name=x64 ;;
esac
- ln -sf "/usr/bin/aria2c" "${srcdir}/${pkgname}-${pkgver}/extra/linux/${_replace_dir_name}/engine/aria2c"
- sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g" package.json
+ ln -sf "/usr/bin/aria2c" "$(_get_project_dir)/extra/linux/${_replace_dir_name}/engine/aria2c"
+ jq --arg ver "${SYSTEM_ELECTRON_VERSION}" '.devDependencies.electron = $ver' package.json > package.json.tmp && mv package.json.tmp package.json
sed -i "s/'darwin', 'win32', 'linux'/'linux'/g" scripts/sync-go-aria2.mjs
sed -i "s/Icon=${_flathubname}/Icon=${pkgname}/g" "build/flathub/${_flathubname}.desktop"
sed -i "s/${_flathubname}/${pkgname}/g" "build/flathub/${_flathubname}.metainfo.xml"
- if [[ "$(curl -s ipinfo.io/country)" == *"CN"* ]]; then
- sed -i 's|asset\.browser_download_url|"https://gh-proxy.com/" + asset.browser_download_url|g' scripts/sync-go-aria2.mjs
- fi
- NODE_ENV=development pnpm install --frozen-lockfile
+ find ./ -type f -name "pnpm-lock.yaml" -exec rm -rf {} +
+ export NODE_ENV=development
+ pnpm install
}
build() {
- cd "${srcdir}/${pkgname}-${pkgver}"
+ cd "$(_get_project_dir)"
+ _ensure_local_nvm
_set_build_env
- _ensure_local_nvm
- NODE_ENV=production pnpm run sync-go-aria2
- NODE_ENV=production pnpm -c exec "node .electron-vue/build.js"
- NODE_ENV=production pnpm -c exec "electron-builder --linux dir -c.electronDist=${ELECTRON_DIST} --config=electron-builder.json"
+ export NODE_ENV=production
+ pnpm run sync-go-aria2
+ pnpm -c exec "node .electron-vue/build.js"
+ pnpm -c exec "electron-builder --linux dir -c.electronDist=${ELECTRON_DIST} --config=electron-builder.json"
+ rm -rf "$(_get_app_dir)/resources/default_app.asar"
}
package() {
install -Dm755 "${srcdir}/${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
install -Dm755 -d "${pkgdir}/usr/lib/${pkgname}"
- local _app_dir=$(_get_app_dir)
- cp -a "${_app_dir}/resources/". "${pkgdir}/usr/lib/${pkgname}/"
- rm -rf "${pkgdir}/usr/lib/${pkgname}/default_app.asar"
- install -Dm644 "${srcdir}/${pkgname}-${pkgver}/build/flathub/${_flathubname}.desktop" \
+ cp -a "$(_get_app_dir)/resources/." "${pkgdir}/usr/lib/${pkgname}/"
+ install -Dm644 "$(_get_project_dir)/build/flathub/${_flathubname}.desktop" \
"${pkgdir}/usr/share/applications/${pkgname}.desktop"
- install -Dm644 "${srcdir}/${pkgname}-${pkgver}/build/flathub/${_flathubname}.metainfo.xml" \
+ install -Dm644 "$(_get_project_dir)/build/flathub/${_flathubname}.metainfo.xml" \
"${pkgdir}/usr/share/metainfo/${pkgname}.metainfo.xml"
- install -Dm644 "${srcdir}/${pkgname}-${pkgver}/build/256x256.png" "${pkgdir}/usr/share/pixmaps/${pkgname%-git}.png"
- install -Dm644 "${srcdir}/${pkgname}-${pkgver}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
+ install -Dm644 "$(_get_project_dir)/build/256x256.png" "${pkgdir}/usr/share/pixmaps/${pkgname%-git}.png"
+ install -Dm644 "$(_get_project_dir)/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
}
-

Scan history

Scanned at (UTC)SeverityRules
2026-10-20 05:27:35 Low 1
2026-08-13 13:26:16 Clean 0
2026-08-12 03:22:23 Clean 0
2026-07-31 01:17:03 Clean 0
2026-07-09 01:29:43 Clean 0
2026-07-02 06:44:17 Clean 0
2026-06-18 16:11:54 Clean 0

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion