jorvik-git
LOW
maintainer Xuruh
0 votes
scanned 2026-09-23 01:39:21.955055
Why flagged
The package builds from the project's own git repository, uses system Electron, and installs only project-built assets; the low severity is due to few votes and recent upload, not malicious content.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Low
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from the project's own git repository, uses system Electron, and installs only project-built assets; the low severity is due to few votes and recent upload, not malicious content.
PKGBUILD
1
# Maintainer: Xuruh <admin@jorvik.app>
2
3
pkgname=jorvik-git
4
_pkgname=jorvik
5
pkgver=1.0.8.r2.gd6a31a4
6
pkgrel=1
7
pkgdesc="Self-hosted Matrix client built to feel like Discord (git)"
8
arch=('x86_64')
9
url="https://github.com/jorvikapp/jorvik"
10
license=('AGPL-3.0-only')
11
# Runs on the system Electron rather than bundling its own: the app declares no
12
# runtime dependencies and its main process imports only electron and node
13
# builtins, so nothing else needs to ship.
14
depends=('electron44')
15
# ttf-dejavu is not optional: the tray badge assets are rendered from SVG text,
16
# and gen-tray-badges.js exits non-zero when no font resolves, so a clean chroot
17
# without one fails the build rather than producing blank badges.
18
makedepends=('git' 'nodejs' 'pnpm' 'ttf-dejavu')
19
provides=("$_pkgname=${pkgver%%.r*}")
20
conflicts=("$_pkgname")
21
options=('!strip')
22
source=("$_pkgname::git+$url.git")
23
sha256sums=('SKIP')
24
25
pkgver() {
26
cd "$srcdir/$_pkgname"
27
git describe --long --tags --abbrev=7 2>/dev/null |
28
sed 's/^v//;s/\([^-]*-g\)/r\1/;s/-/./g' ||
29
printf "r%s.g%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
30
}
31
32
build() {
33
cd "$srcdir/$_pkgname"
34
35
# electron-builder is never invoked here, so its Electron download would be
36
# dead weight. sharp is still fetched: it renders the icon set and the tray
37
# badge assets during the build.
38
export ELECTRON_SKIP_BINARY_DOWNLOAD=1
39
40
pnpm install --frozen-lockfile
41
pnpm --filter @heorot/desktop run build
42
}
43
44
package() {
45
cd "$srcdir/$_pkgname/apps/desktop"
46
47
install -dm755 "$pkgdir/usr/lib/$_pkgname"
48
cp -r dist web package.json "$pkgdir/usr/lib/$_pkgname/"
49
50
# With a system Electron, process.resourcesPath points at Electron's own
51
# resources, so main.ts falls back to app.getAppPath()/build for the window
52
# icon and the tray badge set. That fallback is this layout.
53
install -Dm644 build/icon.png "$pkgdir/usr/lib/$_pkgname/build/icon.png"
54
cp -r build/tray-badges "$pkgdir/usr/lib/$_pkgname/build/"
55
56
install -dm755 "$pkgdir/usr/bin"
57
cat > "$pkgdir/usr/bin/$_pkgname" <<'LAUNCH'
58
#!/bin/sh
59
exec electron44 /usr/lib/jorvik "$@"
60
LAUNCH
61
chmod 755 "$pkgdir/usr/bin/$_pkgname"
62
63
# Generated during the build from the one tracked source image, so these
64
# stay correct without assets being copied into this repository.
65
local size
66
for size in 16 24 32 48 64 128 256 512; do
67
install -Dm644 "build/icons/${size}x${size}.png" \
68
"$pkgdir/usr/share/icons/hicolor/${size}x${size}/apps/$_pkgname.png"
69
done
70
71
# Mirrors linux.desktop.entry in apps/desktop/electron-builder.json; the
72
# binary packages get theirs from Electron Builder, which is not used here.
73
install -Dm644 /dev/stdin "$pkgdir/usr/share/applications/$_pkgname.desktop" <<'DESKTOP'
74
[Desktop Entry]
75
Name=Jorvik
76
Comment=Jorvik Desktop Client
77
Exec=jorvik %U
78
Icon=jorvik
79
Terminal=false
80
Type=Application
81
Categories=Network;Chat;
82
StartupWMClass=jorvik
83
DESKTOP
84
85
install -Dm644 "$srcdir/$_pkgname/LICENSE" \
86
"$pkgdir/usr/share/licenses/$pkgname/LICENSE"
87
}
88
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-23 01:39:21 | Low | 2 |