kopuz-git

maintainer UMCEKO · 1 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The npx call runs @tailwindcss/cli, which is a well-known official npm package installed locally via 'npm install' in prepare(), not fetched remotely at build time; the rest of the build compiles the project's own source from its official GitHub repo with cargo --frozen, posing no meaningful supply-chain risk beyond normal AUR packaging.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 75%): The npx call runs @tailwindcss/cli, which is a well-known official npm package installed locally via 'npm install' in prepare(), not fetched remotely at build time; the rest of the build compiles the project's own source from its official GitHub repo with cargo --frozen, posing no meaningful supply-chain risk beyond normal AUR packaging.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:61 npx @tailwindcss/cli -i ./tailwind.css -o ./crates/kopuz/assets/tailwind.css \

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: temidaradev <temidaradev@proton.me>
    
      2# Contributor: umceko
    
      3pkgname=kopuz-git
    
      4pkgver=0.9.0.r2.g45515c01
    
      5pkgrel=1
    
      6pkgdesc="A modern music player (latest git, built from source)"
    
      7arch=('x86_64')
    
      8url="https://github.com/Kopuz-org/kopuz"
    
      9license=('MIT')
    
      10provides=('kopuz')
    
      11conflicts=('kopuz')
    
      12depends=(
    
      13    'webkit2gtk-4.1'
    
      14    'gtk3'
    
      15    'libsoup3'
    
      16    'glib-networking'
    
      17    'alsa-lib'
    
      18    'openssl'
    
      19    'xdotool'
    
      20    'dbus'
    
      21    'opus'
    
      22    'libayatana-appindicator'
    
      23)
    
      24makedepends=(
    
      25    'git'
    
      26    'rust'
    
      27    'nodejs'
    
      28    'npm'
    
      29    'cmake'
    
      30    'pkgconf'
    
      31)
    
      32optdepends=(
    
      33    'yt-dlp'
    
      34    'python-mutagen'
    
      35)
    
      36# makepkg's default lto option injects -flto=auto into CFLAGS; the bundled
    
      37# sqlite3.c then compiles to LTO bitcode that rustc's link of sqlx's proc-macro
    
      38# dylib silently drops, and the macro fails to load with
    
      39# "undefined symbol: sqlite3_value_type".
    
      40options=('!lto')
    
      41source=("$pkgname::git+https://github.com/Kopuz-org/kopuz.git")
    
      42sha256sums=('SKIP')
    
      43
    
      44pkgver() {
    
      45    cd "$pkgname"
    
      46    git describe --long --tags | sed 's/^v//;s/-/.r/;s/-/./'
    
      47}
    
      48
    
      49prepare() {
    
      50    cd "$pkgname"
    
      51    export RUSTUP_TOOLCHAIN=stable
    
      52    cargo fetch --locked --target "$(rustc -vV | sed -n 's/host: //p')"
    
      53    npm install
    
      54}
    
      55
    
      56build() {
    
      57    cd "$pkgname"
    
      58    export RUSTUP_TOOLCHAIN=stable
    
      59    # tailwind.css is include_str!-embedded; regenerate it from the current
    
      60    # sources like upstream's own builds do, so styling matches this checkout.
    
      61    npx @tailwindcss/cli -i ./tailwind.css -o ./crates/kopuz/assets/tailwind.css \
    
      62        --content './crates/kopuz/**/*.rs,./crates/components/**/*.rs,./crates/pages/**/*.rs,./crates/hooks/**/*.rs,./crates/player/**/*.rs,./crates/reader/**/*.rs'
    
      63    cargo build --frozen --release -p kopuz
    
      64}
    
      65
    
      66package() {
    
      67    cd "$pkgname"
    
      68
    
      69    install -Dm755 target/release/kopuz "$pkgdir/usr/bin/kopuz"
    
      70
    
      71    install -Dm644 "data/com.temidaradev.kopuz.desktop" \
    
      72        "$pkgdir/usr/share/applications/com.temidaradev.kopuz.desktop"
    
      73    sed -i "s|Exec=kopuz|Exec=/usr/bin/kopuz|" \
    
      74        "$pkgdir/usr/share/applications/com.temidaradev.kopuz.desktop"
    
      75
    
      76    install -Dm644 "crates/kopuz/assets/logo.png" \
    
      77        "$pkgdir/usr/share/icons/hicolor/256x256/apps/com.temidaradev.kopuz.png"
    
      78
    
      79    install -Dm644 "data/com.temidaradev.kopuz.metainfo.xml" \
    
      80        "$pkgdir/usr/share/metainfo/com.temidaradev.kopuz.metainfo.xml"
    
      81
    
      82    install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      83}
    
      84

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	3
2026-07-23 00:14:47	LOW	3
2026-07-22 00:29:32	LOW	3
2026-07-21 00:24:15	LOW	3
2026-07-20 00:19:49	LOW	3
2026-07-19 00:17:08	LOW	3
2026-07-18 00:14:48	LOW	3
2026-07-17 00:06:16	LOW	3
2026-07-16 00:05:41	LOW	3
2026-07-15 00:09:25	LOW	3