kanoprii
LOW
maintainer visorcraft
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The npx command runs in offline mode using locally fetched npm dependencies, so no remote code is downloaded or executed during build.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The npx command runs in offline mode using locally fetched npm dependencies, so no remote code is downloaded or executed during build.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
npx/bunx/deno executes a remote package
remote_code_tool
`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.
-
PKGBUILD:64
npx --offline tauri build --no-bundle
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: VisorCraft LLC <packages@visorcraft.com>
2
3
pkgname=kanoprii
4
pkgver=1.17.5
5
pkgrel=1
6
_pdfiumver=7947
7
pkgdesc='High-performance PDF editor'
8
arch=('x86_64')
9
url='https://github.com/visorcraft/Kanoprii'
10
license=('GPL-3.0-only' 'BSD-3-Clause' 'MIT')
11
depends=(
12
'cairo'
13
'dbus'
14
'gcc-libs'
15
'gdk-pixbuf2'
16
'glib2'
17
'glibc'
18
'gtk3'
19
'hicolor-icon-theme'
20
'libcups'
21
'libsoup3'
22
'webkit2gtk-4.1'
23
)
24
makedepends=('cargo' 'npm' 'pkgconf')
25
conflicts=('kanoprii-bin' 'kanoprii-git')
26
options=('!lto')
27
source=(
28
"$pkgname-$pkgver.tar.gz::$url/archive/refs/tags/v$pkgver.tar.gz"
29
"pdfium-linux-x64-$_pdfiumver.tgz::https://github.com/bblanchon/pdfium-binaries/releases/download/chromium/$_pdfiumver/pdfium-linux-x64.tgz"
30
'kanoprii.desktop'
31
)
32
noextract=("pdfium-linux-x64-$_pdfiumver.tgz")
33
sha256sums=(
34
'e52a7d79fc902f30321d9c7199620ba4ae316b220a185163f1d5ea13a5ece858'
35
'f73d69d309fe1f33cc7269dcc99be31ec44e1cf608e31d7e2fcc6545fc2f9323'
36
'05dfa58465ff1838d64a870f5b7d4b8e456607fe8157ad9b60aeae65b56a860f'
37
)
38
39
prepare() {
40
cd "Kanoprii-$pkgver"
41
export CARGO_HOME="$srcdir/cargo"
42
export npm_config_cache="$srcdir/npm-cache"
43
44
npm ci
45
cargo fetch --manifest-path src-tauri/Cargo.toml --locked \
46
--target "$CARCH-unknown-linux-gnu"
47
48
install -d src-tauri/vendor/pdfium
49
bsdtar -xf "$srcdir/pdfium-linux-x64-$_pdfiumver.tgz" \
50
-C src-tauri/vendor/pdfium --strip-components 1 lib/libpdfium.so
51
install -d "$srcdir/pdfium-licenses"
52
bsdtar -xf "$srcdir/pdfium-linux-x64-$_pdfiumver.tgz" \
53
-C "$srcdir/pdfium-licenses" LICENSE licenses
54
}
55
56
build() {
57
cd "Kanoprii-$pkgver"
58
export CARGO_HOME="$srcdir/cargo"
59
export CARGO_NET_OFFLINE=true
60
export CARGO_PROFILE_RELEASE_LTO=false
61
export npm_config_cache="$srcdir/npm-cache"
62
export npm_config_offline=true
63
64
npx --offline tauri build --no-bundle
65
}
66
67
check() {
68
cd "Kanoprii-$pkgver"
69
export CARGO_HOME="$srcdir/cargo"
70
export CARGO_NET_OFFLINE=true
71
export npm_config_cache="$srcdir/npm-cache"
72
export npm_config_offline=true
73
74
npm run lint
75
cargo test --manifest-path src-tauri/Cargo.toml --all-targets --frozen
76
}
77
78
package() {
79
cd "Kanoprii-$pkgver"
80
81
install -Dm755 src-tauri/target/release/kanoprii \
82
"$pkgdir/usr/bin/kanoprii"
83
install -Dm755 src-tauri/vendor/pdfium/libpdfium.so \
84
"$pkgdir/usr/lib/Kanoprii/vendor/pdfium/libpdfium.so"
85
install -Dm644 "$srcdir/kanoprii.desktop" \
86
"$pkgdir/usr/share/applications/kanoprii.desktop"
87
88
install -Dm644 src-tauri/icons/32x32.png \
89
"$pkgdir/usr/share/icons/hicolor/32x32/apps/kanoprii.png"
90
install -Dm644 src-tauri/icons/64x64.png \
91
"$pkgdir/usr/share/icons/hicolor/64x64/apps/kanoprii.png"
92
install -Dm644 src-tauri/icons/128x128.png \
93
"$pkgdir/usr/share/icons/hicolor/128x128/apps/kanoprii.png"
94
install -Dm644 src-tauri/icons/128x128@2x.png \
95
"$pkgdir/usr/share/icons/hicolor/256x256@2/apps/kanoprii.png"
96
install -Dm644 src-tauri/icons/512x512.png \
97
"$pkgdir/usr/share/icons/hicolor/512x512/apps/kanoprii.png"
98
99
install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
100
install -Dm644 "$srcdir/pdfium-licenses/LICENSE" \
101
"$pkgdir/usr/share/licenses/$pkgname/PDFium-Binaries-LICENSE"
102
cp -a "$srcdir/pdfium-licenses/licenses/." \
103
"$pkgdir/usr/share/licenses/$pkgname/"
104
install -Dm644 README.md "$pkgdir/usr/share/doc/$pkgname/README.md"
105
install -Dm644 CREDITS.md "$pkgdir/usr/share/doc/$pkgname/CREDITS.md"
106
}
107
Changes since previous scan
--- PKGBUILD @ 2026-09-02 00:02+++ PKGBUILD @ 2026-09-17 00:27@@ -1,7 +1,7 @@ # Maintainer: VisorCraft LLC <packages@visorcraft.com> pkgname=kanoprii-pkgver=1.17.4+pkgver=1.17.5 pkgrel=1 _pdfiumver=7947 pkgdesc='High-performance PDF editor'@@ -31,7 +31,7 @@ ) noextract=("pdfium-linux-x64-$_pdfiumver.tgz") sha256sums=(- '683d1879d09fde0eeaae7e863f3d83d06fccb164bf76c7a771143d8ab9850b7b'+ 'e52a7d79fc902f30321d9c7199620ba4ae316b220a185163f1d5ea13a5ece858' 'f73d69d309fe1f33cc7269dcc99be31ec44e1cf608e31d7e2fcc6545fc2f9323' '05dfa58465ff1838d64a870f5b7d4b8e456607fe8157ad9b60aeae65b56a860f' )Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 05:49:42 | Medium | 1 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 13:48:42 | Medium | 1 |
| 2026-09-01 01:46:26 | Medium | 1 |
| 2026-09-01 00:11:19 | Low | 2 |