inkdown-git

MEDIUM
maintainer zxp19821005 0 votes scanned 2026-09-23 15:40:39.984319
View on AUR
Why flagged

`bun add` / `bun install <package>` fetches an external package outside source=(). Severity downgraded: the package declares/looks like a Node.js consumer.

Triggered rules

Medium bun install of an undeclared external package bun_install_external

`bun add` / `bun install <package>` fetches an external package outside source=(). Severity downgraded: the package declares/looks like a Node.js consumer.

  • PKGBUILD:102 bun add color-name
Medium npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

  • PKGBUILD:109 bunx electron-vite build
  • PKGBUILD:110 bunx electron-builder --linux dir -c.electronDist="${ELECTRON_DIST}" --config electron-builder.yml

PKGBUILD

3 offending line(s) highlighted
1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2pkgname=inkdown-git
3_pkgname=Inkdown
4pkgver=2.0.2.r1.g4a36667
5_electronversion=35
6_nodeversion=22
7pkgrel=1
8pkgdesc="A WYSIWYG Markdown editor, improve reading and editing experience. and generate your Markdown files into online documents in the easiest and fastest way."
9arch=(
10 'aarch64'
11 'x86_64'
12)
13url="https://github.com/1943time/inkdown"
14license=('AGPL-3.0-only')
15conflicts=("${pkgname%-git}")
16provides=("${pkgname%-git}=${pkgver%.r*}")
17depends=(
18 "electron${_electronversion}"
19 'libvips'
20 'python'
21)
22makedepends=(
23 'bun'
24 'git'
25 'nvm'
26 'gendesk'
27 'curl'
28 'jq'
29)
30source=(
31 "${pkgname%-git}.git::git+${url}.git"
32 "${pkgname%-git}.sh"
33)
34sha256sums=('SKIP'
35 '5ec6b59a287204cbcbac040071f19d88897a0cb3156e794e6f05847cf5449a9e')
36pkgver() {
37 cd "${srcdir}/${pkgname//-/.}"
38 set -o pipefail
39 git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
40 printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
41}
42_ensure_local_nvm() {
43 local NVM_DIR="${srcdir}/.nvm"
44 source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
45 nvm install "${_nodeversion}"
46 nvm use "${_nodeversion}"
47}
48_get_app_dir() {
49 find "${srcdir}" -type d -name "node_modules" -prune -o -type f -name "resources.pak" -print0 | xargs -0 dirname | head -n 1
50}
51_get_electron_version() {
52 _elec_ver=$(find "${srcdir}" -maxdepth 5 -name "package.json" ! -path "*/node_modules/*" \
53 -exec grep -l '"electron"' {} + | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null | head -1)
54 [[ -z "${_elec_ver}" ]] && return 1
55 echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
56}
57_set_build_env() {
58 export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
59 export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
60 export ELECTRON_SKIP_BINARY_DOWNLOAD=1
61 export ELECTRON_BUILDER_OFFLINE=true
62 export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
63 export HOME="${srcdir}/.home"
64 export XDG_CACHE_HOME="${HOME}/.cache"
65 export XDG_CONFIG_HOME="${HOME}/.config"
66 export XDG_DATA_HOME="${HOME}/.local/share"
67 export BUN_INSTALL_CACHE_DIR="${HOME}/.bun/cache"
68 export BUN_INSTALL_GLOBAL_DIR="${HOME}/.bun/global"
69 export BUN_INSTALL_BIN="${HOME}/.bun/bin"
70 export BUN_CONFIG_SKIP_SAVE_LOCKFILE=1
71 export BUN_DISABLE_DOTENV=1
72 export DO_NOT_TRACK=1
73 export BUN_JOBS="$(nproc)"
74 mkdir -p "${HOME}" "${BUN_INSTALL_CACHE_DIR}" "${BUN_INSTALL_GLOBAL_DIR}" "${BUN_INSTALL_BIN}"
75}
76prepare() {
77 cd "${srcdir}/${pkgname%-git}.git"
78 _get_electron_version
79 sed -i -e "color-name
80 s/@electronversion@/${_electronversion}/g
81 s/@appname@/${pkgname%-git}/g
82 s/@runname@/app.asar/g
83 s/@cfgdirname@/${_pkgname}/g
84 " "${srcdir}/${pkgname%-git}.sh"
85 gendesk -q -f -n \
86 --pkgname="${pkgname%-git}" \
87 --pkgdesc="${pkgdesc}" \
88 --categories="Office" \
89 --name="${_pkgname}" \
90 --exec="${pkgname%-git} %U"
91 _ensure_local_nvm
92 _set_build_env
93 sed -i "s/\/\${platform}\/\${arch}//g" electron-builder.yml
94 sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g" package.json
95 # Fix afterPack.js: don't delete linux dir when building on linux
96 sed -i "s/if (fs.existsSync(path.join(onnBin, 'linux')))/if (os.platform() !== 'linux') {\n if (fs.existsSync(path.join(onnBin, 'linux')))/" scripts/afterPack.js
97 sed -i "/fs.rmSync(path.join(onnBin, 'linux')/{n;s/ }/ }\n }/}" scripts/afterPack.js
98 # Add linux platform block to clean up darwin and win32 dirs
99 sed -i "/^}$/i\\ if (os.platform() === 'linux') {\n if (fs.existsSync(path.join(onnBin, 'darwin'))) {\n fs.rmSync(path.join(onnBin, 'darwin'), { recursive: true, force: true })\n }\n if (fs.existsSync(path.join(onnBin, 'win32'))) {\n fs.rmSync(path.join(onnBin, 'win32'), { recursive: true, force: true })\n }\n }" scripts/afterPack.js
100 export NODE_ENV=development
101 bun install
102 bun add color-name
103}
104build() {
105 cd "${srcdir}/${pkgname%-git}.git"
106 _ensure_local_nvm
107 _set_build_env
108 export NODE_ENV=development
109 bunx electron-vite build
110 bunx electron-builder --linux dir -c.electronDist="${ELECTRON_DIST}" --config electron-builder.yml
111 local _app_dir=$(_get_app_dir)
112 case "${CARCH}" in
113 aarch64) _arch_rem="x64" ;;
114 x86_64) _arch_rem="arm64" ;;
115 esac
116 rm -rf "${_app_dir}/resources/app.asar.unpacked/node_modules/onnxruntime-node/bin/napi-v3/linux/${_arch_rem}"
117}
118package() {
119 install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
120 install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-git}"
121 local _app_dir=$(_get_app_dir)
122 cp -a "${_app_dir}/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"
123 install -Dm644 "${srcdir}/${pkgname%-git}.git/resources/icon.png" "${pkgdir}/usr/share/pixmaps/${pkgname%-git}.png"
124 install -Dm644 "${srcdir}/${pkgname%-git}.git/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
125 install -Dm644 "${srcdir}/${pkgname%-git}.git/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
126}

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-09-23 15:40
@@ -1,11 +1,11 @@
# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
pkgname=inkdown-git
_pkgname=Inkdown
-pkgver=2.0.1.r0.gc31eb37
+pkgver=2.0.2.r1.g4a36667
_electronversion=35
_nodeversion=22
pkgrel=1
-pkgdesc="A WYSIWYG Markdown editor, improve reading and editing experience. and generate your Markdown files into online documents in the easiest and fastest way.(Use system-wide electron)"
+pkgdesc="A WYSIWYG Markdown editor, improve reading and editing experience. and generate your Markdown files into online documents in the easiest and fastest way."
arch=(
'aarch64'
'x86_64'
@@ -17,21 +17,22 @@
depends=(
"electron${_electronversion}"
'libvips'
+ 'python'
)
makedepends=(
- 'npm'
- 'pnpm'
+ 'bun'
'git'
'nvm'
'gendesk'
'curl'
+ 'jq'
)
source=(
"${pkgname%-git}.git::git+${url}.git"
"${pkgname%-git}.sh"
)
sha256sums=('SKIP'
- '291f50480f5a61bc9c68db7d44cd0412071128706baa868a9cb854f8779a1980')
+ '5ec6b59a287204cbcbac040071f19d88897a0cb3156e794e6f05847cf5449a9e')
pkgver() {
cd "${srcdir}/${pkgname//-/.}"
set -o pipefail
@@ -44,71 +45,81 @@
nvm install "${_nodeversion}"
nvm use "${_nodeversion}"
}
+_get_app_dir() {
+ find "${srcdir}" -type d -name "node_modules" -prune -o -type f -name "resources.pak" -print0 | xargs -0 dirname | head -n 1
+}
+_get_electron_version() {
+ _elec_ver=$(find "${srcdir}" -maxdepth 5 -name "package.json" ! -path "*/node_modules/*" \
+ -exec grep -l '"electron"' {} + | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null | head -1)
+ [[ -z "${_elec_ver}" ]] && return 1
+ echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
+}
+_set_build_env() {
+ export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
+ export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
+ export ELECTRON_SKIP_BINARY_DOWNLOAD=1
+ export ELECTRON_BUILDER_OFFLINE=true
+ export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
+ export HOME="${srcdir}/.home"
+ export XDG_CACHE_HOME="${HOME}/.cache"
+ export XDG_CONFIG_HOME="${HOME}/.config"
+ export XDG_DATA_HOME="${HOME}/.local/share"
+ export BUN_INSTALL_CACHE_DIR="${HOME}/.bun/cache"
+ export BUN_INSTALL_GLOBAL_DIR="${HOME}/.bun/global"
+ export BUN_INSTALL_BIN="${HOME}/.bun/bin"
+ export BUN_CONFIG_SKIP_SAVE_LOCKFILE=1
+ export BUN_DISABLE_DOTENV=1
+ export DO_NOT_TRACK=1
+ export BUN_JOBS="$(nproc)"
+ mkdir -p "${HOME}" "${BUN_INSTALL_CACHE_DIR}" "${BUN_INSTALL_GLOBAL_DIR}" "${BUN_INSTALL_BIN}"
+}
prepare() {
cd "${srcdir}/${pkgname%-git}.git"
- sed -i -e "
+ _get_electron_version
+ sed -i -e "color-name
s/@electronversion@/${_electronversion}/g
s/@appname@/${pkgname%-git}/g
s/@runname@/app.asar/g
s/@cfgdirname@/${_pkgname}/g
- s/@options@/env ELECTRON_OZONE_PLATFORM_HINT=auto/g
" "${srcdir}/${pkgname%-git}.sh"
- _ensure_local_nvm
gendesk -q -f -n \
--pkgname="${pkgname%-git}" \
--pkgdesc="${pkgdesc}" \
--categories="Office" \
--name="${_pkgname}" \
--exec="${pkgname%-git} %U"
- export ELECTRON_SKIP_BINARY_DOWNLOAD=1
- export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/v//g')"
- HOME="${srcdir}/.electron-gyp"
- {
- echo -e '\n'
- #echo 'build_from_source=true'
- echo 'link-workspace-packages=true'
- echo 'fetch-retry-maxtimeout=10000'
- echo "cache-dir="${srcdir}"/.pnpm_cache"
- echo "store-dir="${srcdir}"/.pnpm_store"
- echo "shamefully-hoist=true"
- echo "virtual-store-dir-max-length=80"
- echo "node-linker=hoisted"
- echo "network-concurrency=32"
- } >> .npmrc
- if [[ "$(curl -s ipinfo.io/country)" == *"CN"* ]]; then
- {
- echo 'registry=https://registry.npmmirror.com'
- echo 'electron_mirror=https://cdn.npmmirror.com/binaries/electron/'
- echo 'electron_builder_binaries_mirror=https://npmmirror.com/mirrors/electron-builder-binaries/'
- } >> .npmrc
- fi
+ _ensure_local_nvm
+ _set_build_env
sed -i "s/\/\${platform}\/\${arch}//g" electron-builder.yml
sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g" package.json
- NODE_ENV=development pnpm install --no-frozen-lockfile
+ # Fix afterPack.js: don't delete linux dir when building on linux
+ sed -i "s/if (fs.existsSync(path.join(onnBin, 'linux')))/if (os.platform() !== 'linux') {\n if (fs.existsSync(path.join(onnBin, 'linux')))/" scripts/afterPack.js
+ sed -i "/fs.rmSync(path.join(onnBin, 'linux')/{n;s/ }/ }\n }/}" scripts/afterPack.js
+ # Add linux platform block to clean up darwin and win32 dirs
+ sed -i "/^}$/i\\ if (os.platform() === 'linux') {\n if (fs.existsSync(path.join(onnBin, 'darwin'))) {\n fs.rmSync(path.join(onnBin, 'darwin'), { recursive: true, force: true })\n }\n if (fs.existsSync(path.join(onnBin, 'win32'))) {\n fs.rmSync(path.join(onnBin, 'win32'), { recursive: true, force: true })\n }\n }" scripts/afterPack.js
+ export NODE_ENV=development
+ bun install
+ bun add color-name
}
build() {
cd "${srcdir}/${pkgname%-git}.git"
- local electronDist="/usr/lib/electron${_electronversion}"
- NODE_ENV=development pnpm run build
- NODE_ENV=production pnpm -c exec "electron-builder --linux dir -c.electronDist=${electronDist} --config electron-builder.yml"
- rm -rf "${srcdir}/${pkgname%-git}.git/dist/linux-"*/resources/app.asar.unpacked/node_modules/onnxruntime-node/bin/napi-v3/{darwin,win32}
+ _ensure_local_nvm
+ _set_build_env
+ export NODE_ENV=development
+ bunx electron-vite build
+ bunx electron-builder --linux dir -c.electronDist="${ELECTRON_DIST}" --config electron-builder.yml
+ local _app_dir=$(_get_app_dir)
case "${CARCH}" in
- 'aarch64')
- cp -r "${srcdir}/${pkgname%-git}.git/node_modules/onnxruntime-node/bin/napi-v3/linux" \
- "${srcdir}/${pkgname%-git}.git/dist/linux-"*/resources/app.asar.unpacked/node_modules/onnxruntime-node/bin/napi-v3/
- rm -rf "${srcdir}/${pkgname%-git}.git/dist/linux-"*/resources/app.asar.unpacked/node_modules/onnxruntime-node/bin/napi-v3/linux/x64
- ;;
- 'x86_64')
- cp -r "${srcdir}/${pkgname%-git}.git/node_modules/onnxruntime-node/bin/napi-v3/linux" \
- "${srcdir}/${pkgname%-git}.git/dist/linux-"*/resources/app.asar.unpacked/node_modules/onnxruntime-node/bin/napi-v3/
- rm -rf "${srcdir}/${pkgname%-git}.git/dist/linux-"*/resources/app.asar.unpacked/node_modules/onnxruntime-node/bin/napi-v3/linux/arm64
- ;;
+ aarch64) _arch_rem="x64" ;;
+ x86_64) _arch_rem="arm64" ;;
esac
+ rm -rf "${_app_dir}/resources/app.asar.unpacked/node_modules/onnxruntime-node/bin/napi-v3/linux/${_arch_rem}"
}
package() {
install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
- install -Dm644 "${srcdir}/${pkgname%-git}.git/dist/linux-"*/resources/app.asar -t "${pkgdir}/usr/lib/${pkgname%-git}"
- cp -Pr --no-preserve=ownership "${srcdir}/${pkgname%-git}.git/dist/linux-"*/resources/app.asar.unpacked "${pkgdir}/usr/lib/${pkgname%-git}"
+ install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-git}"
+ local _app_dir=$(_get_app_dir)
+ cp -a "${_app_dir}/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"
install -Dm644 "${srcdir}/${pkgname%-git}.git/resources/icon.png" "${pkgdir}/usr/share/pixmaps/${pkgname%-git}.png"
install -Dm644 "${srcdir}/${pkgname%-git}.git/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
install -Dm644 "${srcdir}/${pkgname%-git}.git/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"

Scan history

Scanned at (UTC)SeverityRules
2026-09-23 15:40:39 Medium 2
2026-06-18 16:11:54 Clean 0

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion