matcha-git

maintainer emersion · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The npm install runs on bundled source code from the project's own repository, not an external package, so it is part of the normal build process and not a supply-chain risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The npm install runs on bundled source code from the project's own repository, not an external package, so it is part of the normal build process and not a supply-chain risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:24 (cd "$srcdir/src/$_gourl/public" && npm install)

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: emersion <contact emersion fr>
    
      2
    
      3_pkgname=matcha
    
      4pkgname=matcha-git
    
      5pkgver=0.1.0.r0.gb8269e1
    
      6pkgrel=1
    
      7pkgdesc="A read-only web interface for Git repositories"
    
      8arch=('x86_64' 'i686')
    
      9url="https://github.com/emersion/matcha"
    
      10license=('MIT')
    
      11makedepends=('go' 'npm')
    
      12options=('!strip' '!emptydirs')
    
      13source=('matcha::git+https://github.com/emersion/matcha')
    
      14md5sums=('SKIP')
    
      15_gourl=github.com/emersion/matcha
    
      16
    
      17pkgver() {
    
      18  cd "$srcdir/matcha"
    
      19  git describe --long --tags | sed 's/\([^-]*-g\)/r\1/;s/-/./g' | sed 's/^v//'
    
      20}
    
      21
    
      22build() {
    
      23  GOPATH="$srcdir" go get -ldflags "-X $_gourl.publicDir=/usr/share/webapps/$_pkgname" ${_gourl}/cmd/matcha
    
      24  (cd "$srcdir/src/$_gourl/public" && npm install)
    
      25}
    
      26
    
      27package() {
    
      28  mkdir -p "$pkgdir/usr/bin"
    
      29  install -p -m755 "$srcdir/bin/"* "$pkgdir/usr/bin"
    
      30
    
      31  mkdir -p "$pkgdir/usr/share/webapps/$_pkgname"
    
      32  cp -R "$srcdir/src/$_gourl/public/"* "$pkgdir/usr/share/webapps/$_pkgname"
    
      33
    
      34  install -Dm644 "$srcdir/src/$_gourl/LICENSE" "$pkgdir/usr/share/licenses/$_pkgname/LICENSE"
    
      35}
    
      36

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2