mdcz-server

MEDIUM

maintainer evine 0 votes scanned 2026-08-26 13:30:21.790211

View on AUR

Why flagged

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

Triggered rules

Medium npm/yarn/pnpm install of an undeclared external package npm_install_external

PKGBUILD:42 npm install-scripts approve better-sqlite3 impit sharp

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: devome <evinedeng@hotmail.com>
    
      2
    
      3_reponame=mdcz
    
      4pkgname="${_reponame}-server"
    
      5pkgver=0.12.0
    
      6pkgrel=1
    
      7pkgdesc="Media metadata scraper (server)"
    
      8arch=('x86_64' 'aarch64')
    
      9url="https://github.com/ShotHeadman/${_reponame}"
    
      10license=("GPL-3.0-or-later")
    
      11backup=("etc/conf.d/${_reponame}")
    
      12depends=("nodejs")
    
      13makedepends=("npm" "pnpm")
    
      14source=("${_reponame}-${pkgver}.tar.gz::${url}/archive/refs/tags/v${pkgver}.tar.gz"
    
      15        "${_reponame}.service"
    
      16        "${_reponame}.sysusers"
    
      17        "${_reponame}.tmpfiles"
    
      18        "${_reponame}u.service")
    
      19sha256sums=('cd23405f4d1e54928e70483304ba2c962b7de8a60ff26db6949e32aa5810c928'
    
      20            'b238101b924496e6257593a82405e984e9373aac52a06cdbf236d30624972c99'
    
      21            'c80caf8e5dc0ec46f3aefd2b207a2ddf035685874102698196f050afe7719310'
    
      22            '5325bb75ca4acdadef92d12d159ea2ade7f80cc4cb57b48e08274a8a625d6d66'
    
      23            '28e159c1da2e09fede6d97f4a9a2b4ed53039dca99ac189efaf6b4496aef7529')
    
      24
    
      25prepare() {
    
      26    export ELECTRON_SKIP_BINARY_DOWNLOAD=1
    
      27    export ELECTRON_OVERRIDE_DIST_PATH="/usr/lib/$_electron"
    
      28
    
      29    rm -rf "${pkgname}" &>/dev/null
    
      30    cd "${_reponame}-${pkgver}"
    
      31    sed -i "s|^MDCZ_WEB_DIST_DIR=web|MDCZ_WEB_DIST_DIR=/usr/lib/mdcz/server/web|" apps/server/.env.example
    
      32    pnpm install
    
      33}
    
      34
    
      35build() {
    
      36    cd "${_reponame}-${pkgver}"
    
      37    pnpm run package:webui
    
      38    rm -rf "release/staging/${_reponame}-${pkgver}/"{systemd,install.*,start.*}
    
      39    cp -ar "release/staging/${_reponame}-${pkgver}" "../${pkgname}"
    
      40    cd "../${pkgname}"
    
      41    npm install --omit=dev --no-audit --no-fund --no-package-lock
    
      42    npm install-scripts approve better-sqlite3 impit sharp
    
      43    npm rebuild better-sqlite3 impit sharp
    
      44    find . -type f -name "*.map" -delete
    
      45    grep -rl "${srcdir}/${pkgname}" . | xargs -I {} sed -i "s|${srcdir}/${pkgname}|/usr/lib/${_reponame}/server|g" {}
    
      46    perl -0777 -pe 's{
    
      47        (?:\#.*\n)*
    
      48        \#?\s*(?:MDCZ_HOME|MDCZ_CONFIG_DIR|MDCZ_DATA_DIR|MDCZ_DATABASE_PATH)=.*\n
    
      49        (?:\n)?
    
      50    }{}gx' .env.example > "../${_reponame}.conf"
    
      51}
    
      52
    
      53package() {
    
      54    install -Dm644 "${_reponame}.conf"     "${pkgdir}/etc/conf.d/${_reponame}"
    
      55    install -Dm644 "${_reponame}.service"  "${pkgdir}/usr/lib/systemd/system/${_reponame}.service"
    
      56    install -Dm644 "${_reponame}.sysusers" "${pkgdir}/usr/lib/sysusers.d/${_reponame}.conf"
    
      57    install -Dm644 "${_reponame}.tmpfiles" "${pkgdir}/usr/lib/tmpfiles.d/${_reponame}.conf"
    
      58    install -Dm644 "${_reponame}u.service" "${pkgdir}/usr/lib/systemd/user/${_reponame}.service"
    
      59    install -dm755                         "${pkgdir}/usr/lib/${_reponame}"
    
      60    cp -a -r --preserve=mode "${pkgname}"  "${pkgdir}/usr/lib/${_reponame}/server"
    
      61}
    
      62

Changes since previous scan

--- PKGBUILD @ 2026-07-27 13:35
+++ PKGBUILD @ 2026-08-26 13:30
@@ -2,7 +2,7 @@
 
 _reponame=mdcz
 pkgname="${_reponame}-server"
-pkgver=0.11.0
+pkgver=0.12.0
 pkgrel=1
 pkgdesc="Media metadata scraper (server)"
 arch=('x86_64' 'aarch64')
@@ -16,7 +16,7 @@
         "${_reponame}.sysusers"
         "${_reponame}.tmpfiles"
         "${_reponame}u.service")
-sha256sums=('76ddc3966c8cc53f1f83e8a2db6f068ea4199076c7552c11e5f29d9b415e9106'
+sha256sums=('cd23405f4d1e54928e70483304ba2c962b7de8a60ff26db6949e32aa5810c928'
             'b238101b924496e6257593a82405e984e9373aac52a06cdbf236d30624972c99'
             'c80caf8e5dc0ec46f3aefd2b207a2ddf035685874102698196f050afe7719310'
             '5325bb75ca4acdadef92d12d159ea2ade7f80cc4cb57b48e08274a8a625d6d66'
@@ -39,6 +39,8 @@
     cp -ar "release/staging/${_reponame}-${pkgver}" "../${pkgname}"
     cd "../${pkgname}"
     npm install --omit=dev --no-audit --no-fund --no-package-lock
+    npm install-scripts approve better-sqlite3 impit sharp
+    npm rebuild better-sqlite3 impit sharp
     find . -type f -name "*.map" -delete
     grep -rl "${srcdir}/${pkgname}" . | xargs -I {} sed -i "s|${srcdir}/${pkgname}|/usr/lib/${_reponame}/server|g" {}
     perl -0777 -pe 's{

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-26 13:30:21	Medium	1
2026-07-27 13:35:00	Clean	0
2026-07-27 11:35:00	Clean	0
2026-06-28 08:32:16	Clean	2