linux-mod-organizer-git

LOW

maintainer LogicalKarma 0 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

The `npx tauri build` call runs the locally installed `@tauri-apps/cli` package fetched via `npm ci --locked` from the project's own `package-lock.json`, not an arbitrary remote package; combined with building from the project's own Codeberg git source with cargo --locked, this is standard Tauri packaging with no evidence of malicious behavior, though the few-votes/new status warrants mild caution.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): The `npx tauri build` call runs the locally installed `@tauri-apps/cli` package fetched via `npm ci --locked` from the project's own `package-lock.json`, not an arbitrary remote package; combined with building from the project's own Codeberg git source with cargo --locked, this is standard Tauri packaging with no evidence of malicious behavior, though the few-votes/new status warrants mild caution.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:56 RUSTFLAGS="-C link-arg=-lstdc++ ${RUSTFLAGS-}" NO_STRIP=1 npx tauri build --no-bundle

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: LogicalKarma <aur.archlinux.org.urgent678@passmail.net>
    
      2# Upstream: https://codeberg.org/Enoki/linux-mod-organizer (tags are annotated but unsigned)
    
      3#
    
      4# Tracks the newest release tag: pkgver() reads it from the clone and prepare()
    
      5# checks that tag out, so the build is never a floating master snapshot.
    
      6
    
      7pkgname=linux-mod-organizer-git
    
      8_pkgname=linux-mod-organizer
    
      9pkgver=1.28.0
    
      10pkgrel=1
    
      11pkgdesc="Native Linux mod organizer for Bethesda games and Baldur's Gate 3 using fuse-overlayfs"
    
      12arch=('x86_64' 'aarch64')
    
      13url="https://codeberg.org/Enoki/linux-mod-organizer"
    
      14license=('GPL-3.0-or-later')
    
      15depends=('fuse-overlayfs' 'webkit2gtk-4.1' 'gtk3' 'hicolor-icon-theme')
    
      16makedepends=('cargo' 'git' 'nodejs' 'npm' 'pkg-config')
    
      17optdepends=('wine: run xEdit, DynDOLOD and Wrye Bash through Proton/Wine')
    
      18provides=('linux-mod-organizer' 'lmo')
    
      19conflicts=('linux-mod-organizer' 'linux-mod-organizer-bin')
    
      20# !strip: Tauri/upstream keep the binary unstripped.
    
      21# !lto: makepkg's default lto option injects -flto=auto into CFLAGS, so the cc-built
    
      22#       archives from libsqlite3-sys/zstd-sys end up as GCC LTO bytecode that rust-lld
    
      23#       cannot read (undefined symbol: sqlite3_*, ZSTD_decompressStream).
    
      24options=('!strip' '!lto')
    
      25# No check(): upstream's 1420 tests are slow and stay out of the default build. To run them by hand
    
      26# (needs p7zip and zip): cd src/linux-mod-organizer && LMO_CONFIG_DIR=$(mktemp -d) CARGO_HOME=../cargo-home cargo test --release --locked
    
      27source=("git+https://codeberg.org/Enoki/linux-mod-organizer.git")
    
      28sha256sums=('SKIP')
    
      29
    
      30_latest_tag() {
    
      31    git tag --list 'v[0-9]*' --sort=-v:refname | head -n1
    
      32}
    
      33
    
      34pkgver() {
    
      35    cd "$srcdir/$_pkgname"
    
      36    _latest_tag | sed 's/^v//' | tr - '_'
    
      37}
    
      38
    
      39prepare() {
    
      40    cd "$srcdir/$_pkgname"
    
      41    git checkout "$(_latest_tag)"
    
      42
    
      43    export CARGO_HOME="$srcdir/cargo-home"
    
      44    cargo fetch --locked
    
      45
    
      46    cd gui
    
      47    npm ci --no-audit --no-fund --no-progress --cache "$srcdir/npm-cache"
    
      48}
    
      49
    
      50build() {
    
      51    cd "$srcdir/$_pkgname"
    
      52    export CARGO_HOME="$srcdir/cargo-home"
    
      53    cargo build --release --locked --bin lmo
    
      54
    
      55    cd gui
    
      56    RUSTFLAGS="-C link-arg=-lstdc++ ${RUSTFLAGS-}" NO_STRIP=1 npx tauri build --no-bundle
    
      57}
    
      58
    
      59package() {
    
      60    cd "$srcdir/$_pkgname"
    
      61
    
      62    install -Dm755 target/release/lmo "$pkgdir/usr/bin/lmo"
    
      63    install -Dm755 gui/src-tauri/target/release/lmo-gui "$pkgdir/usr/bin/lmo-gui"
    
      64
    
      65    install -Dm644 docs/lmo.1 "$pkgdir/usr/share/man/man1/lmo.1"
    
      66    install -Dm644 packaging/lmo.desktop "$pkgdir/usr/share/applications/lmo.desktop"
    
      67    install -Dm644 packaging/flatpak/page.codeberg.enoki.LinuxModOrganizer.metainfo.xml \
    
      68        "$pkgdir/usr/share/metainfo/page.codeberg.enoki.LinuxModOrganizer.metainfo.xml"
    
      69
    
      70    for size in 32 128 256 512; do
    
      71        install -Dm644 "gui/src-tauri/icons/icon_${size}x${size}.png" \
    
      72            "$pkgdir/usr/share/icons/hicolor/${size}x${size}/apps/lmo.png"
    
      73    done
    
      74
    
      75    install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      76}
    
      77

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Low	3
2026-10-16 00:12:47	Low	3
2026-10-15 00:28:05	Low	3
2026-10-14 00:06:47	Low	3
2026-10-13 15:19:27	Low	3
2026-10-13 15:17:00	Medium	2