kanoprii
LOW
maintainer visorcraft
0 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The npx command runs in offline mode using cached dependencies, building the project's own code, which is a normal part of the build process and not a remote code execution risk.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The npx command runs in offline mode using cached dependencies, building the project's own code, which is a normal part of the build process and not a remote code execution risk.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
npx/bunx/deno executes a remote package
remote_code_tool
`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.
-
PKGBUILD:64
npx --offline tauri build --no-bundle
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: VisorCraft LLC <packages@visorcraft.com>
2
3
pkgname=kanoprii
4
pkgver=1.21.0
5
pkgrel=1
6
_pdfiumver=7947
7
pkgdesc='High-performance PDF editor'
8
arch=('x86_64')
9
url='https://github.com/visorcraft/Kanoprii'
10
license=('GPL-3.0-only' 'BSD-3-Clause' 'MIT')
11
depends=(
12
'cairo'
13
'dbus'
14
'gcc-libs'
15
'gdk-pixbuf2'
16
'glib2'
17
'glibc'
18
'gtk3'
19
'hicolor-icon-theme'
20
'libcups'
21
'libsoup3'
22
'webkit2gtk-4.1'
23
)
24
makedepends=('cargo' 'npm' 'pkgconf')
25
conflicts=('kanoprii-bin' 'kanoprii-git')
26
options=('!lto')
27
source=(
28
"$pkgname-$pkgver.tar.gz::$url/archive/refs/tags/v$pkgver.tar.gz"
29
"pdfium-linux-x64-$_pdfiumver.tgz::https://github.com/bblanchon/pdfium-binaries/releases/download/chromium/$_pdfiumver/pdfium-linux-x64.tgz"
30
'kanoprii.desktop'
31
)
32
noextract=("pdfium-linux-x64-$_pdfiumver.tgz")
33
sha256sums=(
34
'4f103eeabbf64fb4b3350d27397b2fc58d1c69327471d5a691d26ee8dc8fc967'
35
'f73d69d309fe1f33cc7269dcc99be31ec44e1cf608e31d7e2fcc6545fc2f9323'
36
'05dfa58465ff1838d64a870f5b7d4b8e456607fe8157ad9b60aeae65b56a860f'
37
)
38
39
prepare() {
40
cd "Kanoprii-$pkgver"
41
export CARGO_HOME="$srcdir/cargo"
42
export npm_config_cache="$srcdir/npm-cache"
43
44
npm ci
45
cargo fetch --manifest-path src-tauri/Cargo.toml --locked \
46
--target "$CARCH-unknown-linux-gnu"
47
48
install -d src-tauri/vendor/pdfium
49
bsdtar -xf "$srcdir/pdfium-linux-x64-$_pdfiumver.tgz" \
50
-C src-tauri/vendor/pdfium --strip-components 1 lib/libpdfium.so
51
install -d "$srcdir/pdfium-licenses"
52
bsdtar -xf "$srcdir/pdfium-linux-x64-$_pdfiumver.tgz" \
53
-C "$srcdir/pdfium-licenses" LICENSE licenses
54
}
55
56
build() {
57
cd "Kanoprii-$pkgver"
58
export CARGO_HOME="$srcdir/cargo"
59
export CARGO_NET_OFFLINE=true
60
export CARGO_PROFILE_RELEASE_LTO=false
61
export npm_config_cache="$srcdir/npm-cache"
62
export npm_config_offline=true
63
64
npx --offline tauri build --no-bundle
65
}
66
67
check() {
68
cd "Kanoprii-$pkgver"
69
export CARGO_HOME="$srcdir/cargo"
70
export CARGO_NET_OFFLINE=true
71
export npm_config_cache="$srcdir/npm-cache"
72
export npm_config_offline=true
73
74
npm run lint
75
cargo test --manifest-path src-tauri/Cargo.toml --all-targets --frozen
76
}
77
78
package() {
79
cd "Kanoprii-$pkgver"
80
81
install -Dm755 src-tauri/target/release/kanoprii \
82
"$pkgdir/usr/bin/kanoprii"
83
install -Dm755 src-tauri/vendor/pdfium/libpdfium.so \
84
"$pkgdir/usr/lib/Kanoprii/vendor/pdfium/libpdfium.so"
85
install -Dm644 "$srcdir/kanoprii.desktop" \
86
"$pkgdir/usr/share/applications/kanoprii.desktop"
87
88
install -Dm644 src-tauri/icons/32x32.png \
89
"$pkgdir/usr/share/icons/hicolor/32x32/apps/kanoprii.png"
90
install -Dm644 src-tauri/icons/64x64.png \
91
"$pkgdir/usr/share/icons/hicolor/64x64/apps/kanoprii.png"
92
install -Dm644 src-tauri/icons/128x128.png \
93
"$pkgdir/usr/share/icons/hicolor/128x128/apps/kanoprii.png"
94
install -Dm644 src-tauri/icons/128x128@2x.png \
95
"$pkgdir/usr/share/icons/hicolor/256x256@2/apps/kanoprii.png"
96
install -Dm644 src-tauri/icons/512x512.png \
97
"$pkgdir/usr/share/icons/hicolor/512x512/apps/kanoprii.png"
98
99
install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
100
install -Dm644 "$srcdir/pdfium-licenses/LICENSE" \
101
"$pkgdir/usr/share/licenses/$pkgname/PDFium-Binaries-LICENSE"
102
cp -a "$srcdir/pdfium-licenses/licenses/." \
103
"$pkgdir/usr/share/licenses/$pkgname/"
104
install -Dm644 README.md "$pkgdir/usr/share/doc/$pkgname/README.md"
105
install -Dm644 CREDITS.md "$pkgdir/usr/share/doc/$pkgname/CREDITS.md"
106
}
107
Changes since previous scan
--- PKGBUILD @ 2026-10-30 00:29+++ PKGBUILD @ 2026-11-01 00:21@@ -1,7 +1,7 @@ # Maintainer: VisorCraft LLC <packages@visorcraft.com> pkgname=kanoprii-pkgver=1.20.1+pkgver=1.21.0 pkgrel=1 _pdfiumver=7947 pkgdesc='High-performance PDF editor'@@ -31,7 +31,7 @@ ) noextract=("pdfium-linux-x64-$_pdfiumver.tgz") sha256sums=(- '613c8234f528523367c6bb58c2d2a4af68878140ebc969079ee53e7983256eb0'+ '4f103eeabbf64fb4b3350d27397b2fc58d1c69327471d5a691d26ee8dc8fc967' 'f73d69d309fe1f33cc7269dcc99be31ec44e1cf608e31d7e2fcc6545fc2f9323' '05dfa58465ff1838d64a870f5b7d4b8e456607fe8157ad9b60aeae65b56a860f' )Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 03:55:04 | Medium | 1 |
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 00:13:55 | Low | 2 |
| 2026-10-28 00:06:54 | Low | 2 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |
| 2026-10-14 00:06:47 | Low | 2 |