lunarvim-git

maintainer xiota · 6 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The PKGBUILD sources LunarVim from its official GitHub repository and nvim-treesitter from its official GitHub repository with a pinned tag and checksum. The `yarn global add` and `cargo install` calls are inside an opt-in user-run shell script (`init-lvim.sh`) that is installed to `/usr/share/lunarvim/` — they are NOT executed during `makepkg` build or install, and they are NOT a .install hook. The user must explicitly run this script themselves after installation. While pulling unversioned packages from npm/cargo registries at runtime is a supply-chain concern in principle, it is a well-known pattern for Neovim plugin managers and is clearly documented as optional setup. The actual package build only compiles tree-sitter parsers from a pinned, checksummed source. This does not meet the bar for 'medium' since no unverified code is executed during packaging or installation — only during an explicit, user-initiated post-install script. The pattern is sloppy (should ideally use system packages) but not a security risk in the packaging sense.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 82%): The PKGBUILD sources LunarVim from its official GitHub repository and nvim-treesitter from its official GitHub repository with a pinned tag and checksum. The `yarn global add` and `cargo install` calls are inside an opt-in user-run shell script (`init-lvim.sh`) that is installed to `/usr/share/lunarvim/` — they are NOT executed during `makepkg` build or install, and they are NOT a .install hook. The user must explicitly run this script themselves after installation. While pulling unversioned packages from npm/cargo registries at runtime is a supply-chain concern in principle, it is a well-known pattern for Neovim plugin managers and is clearly documented as optional setup. The actual package build only compiles tree-sitter parsers from a pinned, checksummed source. This does not meet the bar for 'medium' since no unverified code is executed during packaging or installation — only during an explicit, user-initiated post-install script. The pattern is sloppy (should ideally use system packages) but not a security risk in the packaging sense.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM External install via pipx/uv/poetry/cargo/go/gem alt_pkg_manager_install

A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.

PKGBUILD:110 cargo install fd-find
PKGBUILD:111 cargo install ripgrep

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer:
    
      2# Contributor: Hanatomizu <chart11from21 at outlook dot com>
    
      3# Contributor: edward-p <edward AT edward-p DOT xyz>
    
      4
    
      5_pkgname="lunarvim"
    
      6pkgname="$_pkgname-git"
    
      7pkgver=1.4.0.r5.gaa51c20
    
      8pkgrel=3
    
      9pkgdesc="An IDE layer for Neovim with sane defaults"
    
      10url="https://github.com/LunarVim/LunarVim"
    
      11license=('GPL-3.0-only')
    
      12arch=('any')
    
      13
    
      14depends=(
    
      15  'fzf'
    
      16  'git'
    
      17  'lua'
    
      18  'neovim'
    
      19  'neovim-remote'
    
      20  'nodejs'
    
      21  'tree-sitter'
    
      22  'yarn'
    
      23)
    
      24makedepends=(
    
      25  'git'
    
      26  'parallel'
    
      27  'tree-sitter-cli'
    
      28)
    
      29optdepends=(
    
      30  'ripgrep: optional dependencies for telescope.nvim'
    
      31  'lazygit: enables <leader>gg to launch lazygit for intergrated and enhanced Git experience while in lvim'
    
      32)
    
      33
    
      34_pkgsrc="$_pkgname"
    
      35source=(
    
      36  "$_pkgsrc"::"git+$url.git"
    
      37  "nvim-treesitter"::"git+https://github.com/nvim-treesitter/nvim-treesitter.git#tag=v0.10.0"
    
      38  'langs.lua'
    
      39)
    
      40sha256sums=(
    
      41  'SKIP'
    
      42  'b4a7931c690c2f2326398fede61e87a19686f065d9b7c32664a885cbbb3f827d'
    
      43  '165e39c90fb14aa220b7e0c8082e6b95109f4302acede816ef572f9b5f951ff7'
    
      44)
    
      45
    
      46pkgver() {
    
      47  cd "$_pkgsrc"
    
      48  git describe --long --tags --abbrev=7 --exclude='*[a-zA-Z][a-zA-Z]*' \
    
      49    | sed -E 's/^[^0-9]*//;s/([^-]*-g)/r\1/;s/-/./g'
    
      50}
    
      51
    
      52build() {
    
      53  cd "$srcdir/nvim-treesitter"
    
      54  runtime="$srcdir/nvim-treesitter"
    
      55
    
      56  echo "::: step 1"
    
      57  nvim --clean --cmd "set runtimepath+=${runtime}" -l "$srcdir/langs.lua"
    
      58
    
      59  echo "::: step 2"
    
      60  langs=$(< langs.txt)
    
      61
    
      62  for lang in ${langs[@]}; do
    
      63    if [[ ! -e "$runtime/parser/$lang.so" ]]; then
    
      64      echo "nvim --clean --cmd 'set runtimepath+=$runtime' --headless +'TSUpdateSync $lang' +qall"
    
      65    fi
    
      66  done | parallel -j $(nproc)
    
      67}
    
      68
    
      69package() {
    
      70  cd "$_pkgsrc"
    
      71
    
      72  mkdir -pm755 "$pkgdir/usr/share/lunarvim"{,/ftplugin}
    
      73  cp -r {lua,snapshots,init.lua} "$pkgdir/usr/share/lunarvim"
    
      74
    
      75  mkdir -pm755 "$pkgdir/usr/share/lunarvim/prebuild/nvim-treesitter/parser"{,-info}
    
      76
    
      77  for parser in "$srcdir/nvim-treesitter/parser"/*.so; do
    
      78    install -Dm755 "$parser" "$pkgdir/usr/share/lunarvim/prebuild/nvim-treesitter/parser/${parser##/*/}"
    
      79  done
    
      80
    
      81  for info in "$srcdir/nvim-treesitter/parser-info"/*; do
    
      82    install -Dm755 "$info" "$pkgdir/usr/share/lunarvim/prebuild/nvim-treesitter/parser-info/${info##/*/}"
    
      83  done
    
      84
    
      85  install -Dm755 /dev/stdin "$pkgdir/usr/bin/lvim" << 'END'
    
      86#!/usr/bin/env sh
    
      87
    
      88export LUNARVIM_RUNTIME_DIR="${LUNARVIM_RUNTIME_DIR:-$HOME/.local/share/lunarvim}"
    
      89export LUNARVIM_CONFIG_DIR="${LUNARVIM_CONFIG_DIR:-$HOME/.config/lvim}"
    
      90export LUNARVIM_CACHE_DIR="${LUNARVIM_CACHE_DIR:-$HOME/.cache/lvim}"
    
      91
    
      92exec nvim -u "$LUNARVIM_RUNTIME_DIR/lvim/init.lua" "$@"
    
      93END
    
      94
    
      95  install -Dm755 /dev/stdin "$pkgdir/usr/share/lunarvim/init-lvim.sh" << 'END'
    
      96#!/usr/bin/env bash
    
      97
    
      98mkdir -p ~/.config/lvim
    
      99cat > ~/.config/lvim/config.lua << EOL
    
      100-- Read the docs: https://www.lunarvim.org/docs/configuration
    
      101-- Example configs: https://github.com/LunarVim/starter.lvim
    
      102EOL
    
      103
    
      104mkdir -p ~/.local/share/lunarvim
    
      105ln -s /usr/share/lunarvim ~/.local/share/lunarvim/lvim
    
      106
    
      107echo -e "\033[1;32m==> Installing dependencies of NodeJS & Rust...\033[0m"
    
      108yarn global add neovim
    
      109yarn global add tree-sitter-cli
    
      110cargo install fd-find
    
      111cargo install ripgrep
    
      112
    
      113echo -e "\033[1;32m==> Preparing Lazy setup...\033[0m"
    
      114lvim --headless -c 'quitall'
    
      115
    
      116[ ! -f "$LUNARVIM_CONFIG_DIR/config.lua" ] \
    
      117  && cp /usr/share/doc/lunarvim/config.example.lua ~/.config/lvim/config.lua
    
      118
    
      119echo -e "\033[1;32m==> Installing treesitter parsers..\033[0m"
    
      120ln -s /usr/share/lunarvim/prebuild/nvim-treesitter/parser/* \
    
      121  ~/.local/share/lunarvim/site/pack/lazy/opt/nvim-treesitter/parser/
    
      122ln -s /usr/share/lunarvim/prebuild/nvim-treesitter/parser-info/* \
    
      123  ~/.local/share/lunarvim/site/pack/lazy/opt/nvim-treesitter/parser-info/
    
      124
    
      125echo -e "\033[1;32m==> Generate the new ftplugin template files..\033[0m"
    
      126lvim --headless +LvimUpdate +q
    
      127
    
      128echo -e "\033[1;32m===============================================\033[0m"
    
      129echo "lunarvim runtime is inited for $(whoami)"
    
      130echo "clean up by:"
    
      131echo "    rm -rf ~/.config/lvim ~/.local/share/lunarvim"
    
      132echo -e "\033[1;32m===============================================\033[0m"
    
      133END
    
      134}
    
      135

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2