imfile-git

LOW
maintainer zxp19821005 1 votes scanned 2026-10-20 05:27:35.159195
View on AUR
Why flagged

The package builds from a legitimate project source on GitHub, uses standard build tools, and installs dependencies via pnpm from a version specified in the project's package.json; the flagged variable-named package installation is part of normal, reproducible JavaScript ecosystem workflow and does not introduce untrusted code.

Triggered rules

Low AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it LOW (confidence 95%): The package builds from a legitimate project source on GitHub, uses standard build tools, and installs dependencies via pnpm from a version specified in the project's package.json; the flagged variable-named package installation is part of normal, reproducible JavaScript ecosystem workflow and does not introduce untrusted code.

  • PKGBUILD:105 npm install -g "pnpm@${_pnpmver}" --prefix "${HOME}/.pnpm" \

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2pkgname=imfile-git
3_pkgname=imFile
4_flathubname="io.github.${pkgname%-git}_io.${pkgname%-git}_desktop"
5pkgver=2.3.5.r0.g08497ff
6_electronversion=43
7_nodeversion=24
8pkgrel=1
9pkgdesc="A full-featured download manager.Forked from motrix."
10arch=(
11 'aarch64'
12 'armv7h'
13 'x86_64'
14)
15url="https://imfile.org/"
16_ghurl="https://github.com/imfile-io/imfile-desktop"
17license=('MIT')
18conflicts=(
19 "${pkgname%-git}"
20 'motrix'
21)
22provides=(
23 'motrix'
24 "${pkgname%-git}=${pkgver%.r*}"
25)
26depends=(
27 "electron${_electronversion}"
28 'aria2'
29)
30makedepends=(
31 'npm'
32 'git'
33 'pnpm'
34 'nvm'
35 'jq'
36)
37source=(
38 "${pkgname//-/.}::git+${_ghurl}.git"
39 "${pkgname%-git}.sh"
40)
41sha256sums=('SKIP'
42 'dfcd6603d29c7b8d88e019b517a2e5c1a7b5ab905a0961a8b81adfa508b258b8')
43_get_project_dir() {
44 local d
45 while IFS= read -r d; do
46 find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
47 done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
48}
49pkgver() {
50 cd "$(_get_project_dir)"
51 set -o pipefail
52 git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
53 printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
54}
55_ensure_local_nvm() {
56 local NVM_DIR="${srcdir}/.nvm"
57 source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
58 nvm install "${_nodeversion}"
59 nvm use "${_nodeversion}"
60}
61_get_app_dir() {
62 find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -printf '%h\n' 2>/dev/null \
63 | while read -r d; do [[ -d "${d}/resources" ]] && { echo "$d"; return 0; }; done
64}
65_get_electron_version() {
66 _elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
67 | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
68 | grep -oE '[0-9]+' | head -1)
69 [[ -z "${_elec_ver}" ]] && return 1
70 (( _elec_ver == _electronversion )) && c=32 || c=31
71 echo -e "Electron version: \033[1;${c}m${_elec_ver}$([[ $c -eq 31 ]] && echo " (expected ${_electronversion})")\033[0m"
72}
73_set_build_env() {
74 export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
75 export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
76 export ELECTRON_SKIP_BINARY_DOWNLOAD=1
77 export ELECTRON_BUILDER_OFFLINE=true
78 export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
79 export HOME="${srcdir}/.home"
80 export XDG_CACHE_HOME="${HOME}/.cache"
81 export XDG_CONFIG_HOME="${HOME}/.config"
82 export XDG_DATA_HOME="${HOME}/.local/share"
83 export XDG_STATE_HOME="${HOME}/.local/state"
84 export PNPM_HOME="${HOME}/.pnpm/bin"
85 export pnpm_config_cache_dir="${HOME}/.pnpm_cache"
86 export pnpm_config_store_dir="${HOME}/.pnpm_store"
87 export pnpm_config_global_dir="${HOME}/.pnpm/global"
88 export pnpm_config_state_dir="${HOME}/.pnpm/state"
89 export pnpm_config_node_linker=hoisted
90 export pnpm_config_minimum_release_age=0
91 export pnpm_config_update_notifier=false
92 export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
93 export COREPACK_HOME="${HOME}/.corepack"
94 mkdir -p "${HOME}" "${PNPM_HOME}" "${pnpm_config_cache_dir}" "${pnpm_config_store_dir}" "${pnpm_config_global_dir}" "${pnpm_config_state_dir}" "${COREPACK_HOME}"
95 export PATH="${PNPM_HOME}:${PATH}"
96 local _pnpmver=""
97 local _pkgjson="$(_get_project_dir)/package.json"
98 if [ -f "${_pkgjson}" ]; then
99 _pnpmver="$(grep -o '"packageManager"[^,]*' "${_pkgjson}" 2>/dev/null | grep -oE 'pnpm@[^"+]+' | head -n1 | sed 's/^pnpm@//')"
100 if [ -z "${_pnpmver}" ]; then
101 _pnpmver="$(grep -oE '"pnpm"[[:space:]]*:[[:space:]]*"[^"]+"' "${_pkgjson}" 2>/dev/null | grep -oE '[0-9][0-9.]*' | head -n1)"
102 fi
103 fi
104 if [ -n "${_pnpmver}" ]; then
105 npm install -g "pnpm@${_pnpmver}" --prefix "${HOME}/.pnpm" \
106 --registry "${COREPACK_NPM_REGISTRY}"
107 fi
108}
109prepare() {
110 cd "$(_get_project_dir)"
111 _get_electron_version
112 sed -i -e "
113 s/@electronversion@/${_electronversion}/g
114 s/@appname@/${pkgname%-git}/g
115 " "${srcdir}/${pkgname%-git}.sh"
116 _ensure_local_nvm
117 _set_build_env
118 case "${CARCH}" in
119 aarch64) _replace_dir_name=arm64 ;;
120 armv7h) _replace_dir_name=armv7l ;;
121 x86_64) _replace_dir_name=x64 ;;
122 esac
123 ln -sf "/usr/bin/aria2c" "$(_get_project_dir)/extra/linux/${_replace_dir_name}/engine/aria2c"
124 jq --arg ver "${SYSTEM_ELECTRON_VERSION}" '.devDependencies.electron = $ver' package.json > package.json.tmp && mv package.json.tmp package.json
125 sed -i "s/'darwin', 'win32', 'linux'/'linux'/g" scripts/sync-go-aria2.mjs
126 sed -i "s/Icon=${_flathubname}/Icon=${pkgname}/g" "build/flathub/${_flathubname}.desktop"
127 sed -i "s/${_flathubname}/${pkgname}/g" "build/flathub/${_flathubname}.metainfo.xml"
128 export NODE_ENV=development
129 pnpm install --no-lockfile
130}
131build() {
132 cd "$(_get_project_dir)"
133 _ensure_local_nvm
134 _set_build_env
135 export NODE_ENV=production
136 pnpm run sync-go-aria2
137 pnpm run build:github
138 pnpm exec electron-builder --linux dir -c.electronDist="${ELECTRON_DIST}" --config=electron-builder.json
139 rm -rf "$(_get_app_dir)/resources/default_app.asar"
140}
141package() {
142 install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
143 install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-git}"
144 cp -a "$(_get_app_dir)/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"
145 install -Dm644 "$(_get_project_dir)/build/256x256.png" "${pkgdir}/usr/share/icons/hicolor/256x256/apps/${pkgname%-git}.png"
146 install -Dm644 "$(_get_project_dir)/build/flathub/${_flathubname}.desktop" \
147 "${pkgdir}/usr/share/applications/${pkgname}.desktop"
148 install -Dm644 "$(_get_project_dir)/build/flathub/${_flathubname}.metainfo.xml" \
149 "${pkgdir}/usr/share/metainfo/${pkgname}.metainfo.xml"
150 install -Dm644 "$(_get_project_dir)/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
151}
152

Changes since previous scan

--- PKGBUILD @ 2026-09-24 03:41
+++ PKGBUILD @ 2026-10-20 05:27
@@ -2,11 +2,11 @@
pkgname=imfile-git
_pkgname=imFile
_flathubname="io.github.${pkgname%-git}_io.${pkgname%-git}_desktop"
-pkgver=2.3.4.r61.g8e64da1
+pkgver=2.3.5.r0.g08497ff
_electronversion=43
_nodeversion=24
pkgrel=1
-pkgdesc="A full-featured download manager.Forked from motrix.(Use system-wide electron)"
+pkgdesc="A full-featured download manager.Forked from motrix."
arch=(
'aarch64'
'armv7h'
@@ -39,27 +39,36 @@
"${pkgname%-git}.sh"
)
sha256sums=('SKIP'
- 'bd5358d8f323d3c2c2f0733364ee4ea55f551dd86ba0be2a76846210b60897fc')
+ 'dfcd6603d29c7b8d88e019b517a2e5c1a7b5ab905a0961a8b81adfa508b258b8')
+_get_project_dir() {
+ local d
+ while IFS= read -r d; do
+ find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
+ done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
+}
pkgver() {
- cd "${srcdir}/${pkgname//-/.}"
- set -o pipefail
- git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
- printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
+ cd "$(_get_project_dir)"
+ set -o pipefail
+ git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
+ printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
}
_ensure_local_nvm() {
- export NVM_DIR="${srcdir}/.nvm"
- source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
- nvm install "${_nodeversion}"
- nvm use "${_nodeversion}"
+ local NVM_DIR="${srcdir}/.nvm"
+ source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
+ nvm install "${_nodeversion}"
+ nvm use "${_nodeversion}"
}
_get_app_dir() {
- find "${srcdir}" -type d -name "node_modules" -prune -o -type f -name "resources.pak" -print0 | xargs -0 dirname | head -n 1
+ find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -printf '%h\n' 2>/dev/null \
+ | while read -r d; do [[ -d "${d}/resources" ]] && { echo "$d"; return 0; }; done
}
_get_electron_version() {
- _elec_ver=$(find "${srcdir}" -maxdepth 5 -name "package.json" ! -path "*/node_modules/*" \
- -exec grep -l '"electron"' {} + | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null | head -1)
- [[ -z "${_elec_ver}" ]] && return 1
- echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
+ _elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
+ | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
+ | grep -oE '[0-9]+' | head -1)
+ [[ -z "${_elec_ver}" ]] && return 1
+ (( _elec_ver == _electronversion )) && c=32 || c=31
+ echo -e "Electron version: \033[1;${c}m${_elec_ver}$([[ $c -eq 31 ]] && echo " (expected ${_electronversion})")\033[0m"
}
_set_build_env() {
export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
@@ -84,15 +93,25 @@
export COREPACK_HOME="${HOME}/.corepack"
mkdir -p "${HOME}" "${PNPM_HOME}" "${pnpm_config_cache_dir}" "${pnpm_config_store_dir}" "${pnpm_config_global_dir}" "${pnpm_config_state_dir}" "${COREPACK_HOME}"
export PATH="${PNPM_HOME}:${PATH}"
+ local _pnpmver=""
+ local _pkgjson="$(_get_project_dir)/package.json"
+ if [ -f "${_pkgjson}" ]; then
+ _pnpmver="$(grep -o '"packageManager"[^,]*' "${_pkgjson}" 2>/dev/null | grep -oE 'pnpm@[^"+]+' | head -n1 | sed 's/^pnpm@//')"
+ if [ -z "${_pnpmver}" ]; then
+ _pnpmver="$(grep -oE '"pnpm"[[:space:]]*:[[:space:]]*"[^"]+"' "${_pkgjson}" 2>/dev/null | grep -oE '[0-9][0-9.]*' | head -n1)"
+ fi
+ fi
+ if [ -n "${_pnpmver}" ]; then
+ npm install -g "pnpm@${_pnpmver}" --prefix "${HOME}/.pnpm" \
+ --registry "${COREPACK_NPM_REGISTRY}"
+ fi
}
prepare() {
- cd "${srcdir}/${pkgname//-/.}"
+ cd "$(_get_project_dir)"
_get_electron_version
sed -i -e "
s/@electronversion@/${_electronversion}/g
s/@appname@/${pkgname%-git}/g
- s/@runname@/app.asar/g
- s/@cfgdirname@/${_pkgname}/g
" "${srcdir}/${pkgname%-git}.sh"
_ensure_local_nvm
_set_build_env
@@ -101,8 +120,8 @@
armv7h) _replace_dir_name=armv7l ;;
x86_64) _replace_dir_name=x64 ;;
esac
- ln -sf "/usr/bin/aria2c" "${srcdir}/${pkgname//-/.}/extra/linux/${_replace_dir_name}/engine/aria2c"
- sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g" package.json
+ ln -sf "/usr/bin/aria2c" "$(_get_project_dir)/extra/linux/${_replace_dir_name}/engine/aria2c"
+ jq --arg ver "${SYSTEM_ELECTRON_VERSION}" '.devDependencies.electron = $ver' package.json > package.json.tmp && mv package.json.tmp package.json
sed -i "s/'darwin', 'win32', 'linux'/'linux'/g" scripts/sync-go-aria2.mjs
sed -i "s/Icon=${_flathubname}/Icon=${pkgname}/g" "build/flathub/${_flathubname}.desktop"
sed -i "s/${_flathubname}/${pkgname}/g" "build/flathub/${_flathubname}.metainfo.xml"
@@ -110,25 +129,24 @@
pnpm install --no-lockfile
}
build() {
- cd "${srcdir}/${pkgname//-/.}"
+ cd "$(_get_project_dir)"
_ensure_local_nvm
_set_build_env
export NODE_ENV=production
pnpm run sync-go-aria2
pnpm run build:github
pnpm exec electron-builder --linux dir -c.electronDist="${ELECTRON_DIST}" --config=electron-builder.json
+ rm -rf "$(_get_app_dir)/resources/default_app.asar"
}
package() {
install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-git}"
- local _app_dir=$(_get_app_dir)
- cp -a "${_app_dir}/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"
- rm -rf "${pkgdir}/usr/lib/${pkgname%-git}/default_app.asar"
- install -Dm644 "${srcdir}/${pkgname//-/.}/build/256x256.png" "${pkgdir}/usr/share/icons/hicolor/256x256/apps/${pkgname%-git}.png"
- install -Dm644 "${srcdir}/${pkgname//-/.}/build/flathub/${_flathubname}.desktop" \
+ cp -a "$(_get_app_dir)/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"
+ install -Dm644 "$(_get_project_dir)/build/256x256.png" "${pkgdir}/usr/share/icons/hicolor/256x256/apps/${pkgname%-git}.png"
+ install -Dm644 "$(_get_project_dir)/build/flathub/${_flathubname}.desktop" \
"${pkgdir}/usr/share/applications/${pkgname}.desktop"
- install -Dm644 "${srcdir}/${pkgname//-/.}/build/flathub/${_flathubname}.metainfo.xml" \
+ install -Dm644 "$(_get_project_dir)/build/flathub/${_flathubname}.metainfo.xml" \
"${pkgdir}/usr/share/metainfo/${pkgname}.metainfo.xml"
- install -Dm644 "${srcdir}/${pkgname//-/.}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
+ install -Dm644 "$(_get_project_dir)/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
}

Scan history

Scanned at (UTC)SeverityRules
2026-10-20 05:27:35 Low 1
2026-09-24 03:41:46 Clean 0
2026-08-12 03:22:23 Clean 0
2026-07-31 01:17:03 Clean 0
2026-07-09 01:29:43 Clean 0
2026-07-02 06:44:17 Clean 0
2026-06-18 16:11:54 Clean 0

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion