motrix-git

LOW
maintainer zxp19821005 2 votes scanned 2026-10-17 00:21:55.226236
View on AUR
Why flagged

The package builds from the project's own source via git, uses standard build tools with locked versions, and installs only project files; the variable-named package install is part of a legitimate pnpm/npm workflow and does not introduce untrusted external code.

Triggered rules

Low AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it LOW (confidence 95%): The package builds from the project's own source via git, uses standard build tools with locked versions, and installs only project files; the variable-named package install is part of a legitimate pnpm/npm workflow and does not introduce untrusted external code.

  • PKGBUILD:114 npm install -g "pnpm@${_pnpmver}" --prefix "${HOME}/.pnpm" \

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2# Contributor: Butui Hu <hot123tea123@gmail.com>
3pkgname=motrix-git
4_debname="app.${pkgname%-git}.native"
5_pkgname=Motrix
6pkgver=2.0.0.beta.47.r10.ga4a867d
7_electronversion=44
8_nodeversion=24
9pkgrel=1
10pkgdesc="A full-featured download manager that supports downloading HTTP, FTP, BitTorrent, Magnet, etc."
11arch=(
12 'aarch64'
13 'armv7h'
14 'x86_64'
15)
16url="https://motrix.app/"
17_ghurl="https://github.com/agalwood/Motrix"
18_giteeurl="https://gitee.com/mirrors/motrix"
19license=('MIT')
20provides=("${pkgname%-git}=${pkgver}")
21conflicts=(
22 "${pkgname%-git}"
23 "${pkgname%-git}-bin"
24)
25depends=(
26 "electron${_electronversion}"
27)
28makedepends=(
29 'git'
30 'pnpm'
31 'npm'
32 'nvm'
33 'jq'
34 'rustup'
35)
36optdepends=(
37 'ffmpeg'
38)
39source=(
40 "${pkgname//-/.}::git+${_ghurl}.git"
41 "${pkgname%-git}.sh"
42)
43sha256sums=('SKIP'
44 'dfcd6603d29c7b8d88e019b517a2e5c1a7b5ab905a0961a8b81adfa508b258b8')
45_get_project_dir() {
46 local d
47 while IFS= read -r d; do
48 find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
49 done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
50}
51pkgver() {
52 cd "$(_get_project_dir)"
53 set -o pipefail
54 git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
55 printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
56}
57_ensure_local_nvm() {
58 local NVM_DIR="${srcdir}/.nvm"
59 source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
60 nvm install "${_nodeversion}"
61 nvm use "${_nodeversion}"
62}
63_get_app_dir() {
64 find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -printf '%h\n' 2>/dev/null \
65 | while read -r d; do [[ -d "${d}/resources" ]] && { echo "$d"; return 0; }; done
66}
67_get_electron_version() {
68 _elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
69 | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
70 | grep -oE '[0-9]+' | head -1)
71 [[ -z "${_elec_ver}" ]] && return 1
72 (( _elec_ver == _electronversion )) && c=32 || c=31
73 echo -e "Electron version: \033[1;${c}m${_elec_ver}$([[ $c -eq 31 ]] && echo " (expected ${_electronversion})")\033[0m"
74}
75_set_build_env() {
76 export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
77 export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
78 export ELECTRON_SKIP_BINARY_DOWNLOAD=1
79 export ELECTRON_BUILDER_OFFLINE=true
80 export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
81 export HOME="${srcdir}/.home"
82 export XDG_CACHE_HOME="${HOME}/.cache"
83 export XDG_CONFIG_HOME="${HOME}/.config"
84 export XDG_DATA_HOME="${HOME}/.local/share"
85 export XDG_STATE_HOME="${HOME}/.local/state"
86 export PNPM_HOME="${HOME}/.pnpm/bin"
87 export pnpm_config_cache_dir="${HOME}/.pnpm_cache"
88 export pnpm_config_store_dir="${HOME}/.pnpm_store"
89 export pnpm_config_global_dir="${HOME}/.pnpm/global"
90 export pnpm_config_state_dir="${HOME}/.pnpm/state"
91 export pnpm_config_node_linker=hoisted
92 export pnpm_config_minimum_release_age=0
93 export pnpm_config_update_notifier=false
94 export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
95 export COREPACK_HOME="${HOME}/.corepack"
96 export CARGO_HOME="${HOME}/.cargo"
97 export CARGO_NET_GIT_FETCH_WITH_CLI=true
98 export CARGO_NET_RETRY=5
99 export CARGO_HTTP_MULTIPLEXING=false
100 export CARGO_INCREMENTAL=0
101 export CARGO_TERM_COLOR=never
102 export CARGO_PROFILE_RELEASE_STRIP=symbols
103 mkdir -p "${HOME}" "${CARGO_HOME}" "${PNPM_HOME}" "${pnpm_config_cache_dir}" "${pnpm_config_store_dir}" "${pnpm_config_global_dir}" "${pnpm_config_state_dir}" "${COREPACK_HOME}"
104 export PATH="${PNPM_HOME}:${PATH}"
105 local _pnpmver=""
106 local _pkgjson="$(_get_project_dir)/package.json"
107 if [ -f "${_pkgjson}" ]; then
108 _pnpmver="$(grep -o '"packageManager"[^,]*' "${_pkgjson}" 2>/dev/null | grep -oE 'pnpm@[^"+]+' | head -n1 | sed 's/^pnpm@//')"
109 if [ -z "${_pnpmver}" ]; then
110 _pnpmver="$(grep -oE '"pnpm"[[:space:]]*:[[:space:]]*"[^"]+"' "${_pkgjson}" 2>/dev/null | grep -oE '[0-9][0-9.]*' | head -n1)"
111 fi
112 fi
113 if [ -n "${_pnpmver}" ]; then
114 npm install -g "pnpm@${_pnpmver}" --prefix "${HOME}/.pnpm" \
115 --registry "${COREPACK_NPM_REGISTRY}"
116 fi
117}
118prepare() {
119 cd "$(_get_project_dir)"
120 _get_electron_version
121 sed -i -e "
122 s/@electronversion@/${_electronversion}/g
123 s/@appname@/${pkgname%-git}/g
124 " "${srcdir}/${pkgname%-git}.sh"
125 _ensure_local_nvm
126 _set_build_env
127 sed -i -e "
128 s/Exec=start-${pkgname%-git}/Exec=${pkgname%-git}/g
129 s/Icon=${_debname}/Icon=${pkgname%-git}/g
130 " "flatpak/${_debname}.desktop"
131 sed -i "s/${_debname}/${pkgname%-git}/g" "flatpak/${_debname}.metainfo.xml"
132 local _rp="'/usr/lib/${pkgname%-git}'"
133 find src -type f -name '*.ts' -exec sed -i \
134 -e "s|: process\.resourcesPath,|: ${_rp},|g" \
135 -e "s|path\.join(process\.resourcesPath,|path.join(${_rp},|g" \
136 -e "s|path\.join(process\.resourcesPath |path.join(${_rp} |g" \
137 -e "s|(process\.resourcesPath |(${_rp} |g" \
138 {} +
139 rustup update stable
140 rustup default stable
141 jq --arg ver "${SYSTEM_ELECTRON_VERSION}" '.devDependencies.electron = $ver' package.json > package.json.tmp && mv package.json.tmp package.json
142 export NODE_ENV=development
143 export MOTRIX_SKIP_ENGINE_FETCH=1
144 pnpm install
145 node node_modules/electron/install.js
146}
147build() {
148 cd "$(_get_project_dir)"
149 _ensure_local_nvm
150 _set_build_env
151 export NODE_ENV=production
152 declare -A _arch_map=( [x86_64]=x64 [aarch64]=arm64 [armv7h]=armv7l )
153 local _arch="${_arch_map[${CARCH}]:-x64}"
154 local _rust_target="${CARCH/x86_64/x86_64-unknown-linux-musl}"
155 _rust_target="${_rust_target/aarch64/aarch64-unknown-linux-musl}"
156 pnpm run fetch:engine --platform linux --arch "${_arch}"
157 pnpm run build:builtin
158 [[ "${_rust_target}" == *"-linux-musl" ]] && rustup target add "${_rust_target}"
159 pnpm run build:native-host -- --platform linux --arch "${_arch}"
160 pnpm run build:finalize-fs -- --platform linux --arch "${_arch}"
161 pnpm run build:electron
162 pnpm run stage:electron -- --platform linux --arch "${_arch}"
163 pnpm exec electron-builder --linux dir -c.electronDist="${ELECTRON_DIST}"
164 rm -rf "$(_get_app_dir)/resources/default_app.asar"
165}
166package() {
167 install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
168 install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-git}"
169 cp -a "$(_get_app_dir)/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"
170 rm -rf "${pkgdir}/usr/lib/${pkgname%-git}/default_app.asar"
171 install -Dm644 "$(_get_project_dir)/flatpak/${_debname}.desktop" \
172 "${pkgdir}/usr/share/applications/${pkgname%-git}.desktop"
173 install -Dm644 "$(_get_project_dir)/flatpak/${_debname}.metainfo.xml" \
174 "${pkgdir}/usr/share/metainfo/${pkgname%-git}.metainfo.xml"
175 install -Dm644 "$(_get_project_dir)/build/256x256.png" "${pkgdir}/usr/share/icons/hicolor/256x256/apps/${pkgname%-git}.png"
176 install -Dm644 "$(_get_project_dir)/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
177}

Changes since previous scan

--- PKGBUILD @ 2026-10-15 00:28
+++ PKGBUILD @ 2026-10-17 00:21
@@ -3,7 +3,7 @@
pkgname=motrix-git
_debname="app.${pkgname%-git}.native"
_pkgname=Motrix
-pkgver=2.0.0.beta.47.r3.g99a40ab
+pkgver=2.0.0.beta.47.r10.ga4a867d
_electronversion=44
_nodeversion=24
pkgrel=1
@@ -41,7 +41,7 @@
"${pkgname%-git}.sh"
)
sha256sums=('SKIP'
- 'cebedc3391cbab6d43f37fbf3a87ddaad16597cb5ea487a4d55b1f478d810082')
+ 'dfcd6603d29c7b8d88e019b517a2e5c1a7b5ab905a0961a8b81adfa508b258b8')
_get_project_dir() {
local d
while IFS= read -r d; do
@@ -49,13 +49,20 @@
done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
}
pkgver() {
- cd "$(_get_project_dir)"
- set -o pipefail
- git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
- printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
+ cd "$(_get_project_dir)"
+ set -o pipefail
+ git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
+ printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
+}
+_ensure_local_nvm() {
+ local NVM_DIR="${srcdir}/.nvm"
+ source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
+ nvm install "${_nodeversion}"
+ nvm use "${_nodeversion}"
}
_get_app_dir() {
- find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -print 2>/dev/null | while read f; do [ -d "${f%/*}/resources" ] && echo "${f%/*}" && break; done
+ find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -printf '%h\n' 2>/dev/null \
+ | while read -r d; do [[ -d "${d}/resources" ]] && { echo "$d"; return 0; }; done
}
_get_electron_version() {
_elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
@@ -108,20 +115,12 @@
--registry "${COREPACK_NPM_REGISTRY}"
fi
}
-_ensure_local_nvm() {
- local NVM_DIR="${srcdir}/.nvm"
- source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
- nvm install "${_nodeversion}"
- nvm use "${_nodeversion}"
-}
prepare() {
cd "$(_get_project_dir)"
_get_electron_version
sed -i -e "
s/@electronversion@/${_electronversion}/g
s/@appname@/${pkgname%-git}/g
- s/@runname@/app.asar/g
- s/@cfgdirname@/${pkgname%-git}/g
" "${srcdir}/${pkgname%-git}.sh"
_ensure_local_nvm
_set_build_env
@@ -130,8 +129,6 @@
s/Icon=${_debname}/Icon=${pkgname%-git}/g
" "flatpak/${_debname}.desktop"
sed -i "s/${_debname}/${pkgname%-git}/g" "flatpak/${_debname}.metainfo.xml"
- # Replace process.resourcesPath with system-wide install path in source files
- # Only replace property access patterns, not string literals
local _rp="'/usr/lib/${pkgname%-git}'"
find src -type f -name '*.ts' -exec sed -i \
-e "s|: process\.resourcesPath,|: ${_rp},|g" \
@@ -142,46 +139,39 @@
rustup update stable
rustup default stable
jq --arg ver "${SYSTEM_ELECTRON_VERSION}" '.devDependencies.electron = $ver' package.json > package.json.tmp && mv package.json.tmp package.json
- export NODE_ENV=development
+ export NODE_ENV=development
export MOTRIX_SKIP_ENGINE_FETCH=1
pnpm install
node node_modules/electron/install.js
}
build() {
cd "$(_get_project_dir)"
+ _ensure_local_nvm
_set_build_env
- _ensure_local_nvm
- case "${CARCH}" in
- x86_64) _arch="x64" ;;
- aarch64) _arch="arm64" ;;
- armv7h) _arch="armv7l" ;;
- *) _arch="x64" ;;
- esac
export NODE_ENV=production
+ declare -A _arch_map=( [x86_64]=x64 [aarch64]=arm64 [armv7h]=armv7l )
+ local _arch="${_arch_map[${CARCH}]:-x64}"
+ local _rust_target="${CARCH/x86_64/x86_64-unknown-linux-musl}"
+ _rust_target="${_rust_target/aarch64/aarch64-unknown-linux-musl}"
pnpm run fetch:engine --platform linux --arch "${_arch}"
pnpm run build:builtin
- case "${CARCH}" in
- x86_64) rustup target add x86_64-unknown-linux-musl ;;
- aarch64) rustup target add aarch64-unknown-linux-musl ;;
- esac
+ [[ "${_rust_target}" == *"-linux-musl" ]] && rustup target add "${_rust_target}"
pnpm run build:native-host -- --platform linux --arch "${_arch}"
pnpm run build:finalize-fs -- --platform linux --arch "${_arch}"
pnpm run build:electron
pnpm run stage:electron -- --platform linux --arch "${_arch}"
pnpm exec electron-builder --linux dir -c.electronDist="${ELECTRON_DIST}"
+ rm -rf "$(_get_app_dir)/resources/default_app.asar"
}
package() {
install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-git}"
- local _app_dir="$(_get_app_dir)"
- rm -rf "${_app_dir}/resources/default_app.asar"
- cp -a "${_app_dir}/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"
+ cp -a "$(_get_app_dir)/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"
rm -rf "${pkgdir}/usr/lib/${pkgname%-git}/default_app.asar"
install -Dm644 "$(_get_project_dir)/flatpak/${_debname}.desktop" \
"${pkgdir}/usr/share/applications/${pkgname%-git}.desktop"
install -Dm644 "$(_get_project_dir)/flatpak/${_debname}.metainfo.xml" \
"${pkgdir}/usr/share/metainfo/${pkgname%-git}.metainfo.xml"
- install -Dm644 "$(_get_project_dir)/build/256x256.png" "${pkgdir}/usr/share/pixmaps/${pkgname%-git}.png"
+ install -Dm644 "$(_get_project_dir)/build/256x256.png" "${pkgdir}/usr/share/icons/hicolor/256x256/apps/${pkgname%-git}.png"
install -Dm644 "$(_get_project_dir)/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
}
-

Scan history

Scanned at (UTC)SeverityRules
2026-10-17 00:21:55 Low 1
2026-10-16 00:12:47 Low 1
2026-10-15 03:10:23 Low 1
2026-10-15 00:28:05 Low 1
2026-10-14 00:06:47 Low 1
2026-10-13 00:23:45 Low 1
2026-10-12 11:13:20 Low 1
2026-09-21 07:34:25 Clean 0
2026-09-02 21:51:32 Clean 0
2026-08-24 05:22:02 Clean 0
2026-06-18 16:11:54 Clean 0

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion