mqttx-git

LOW
maintainer zxp19821005 0 votes scanned 2026-10-26 09:44:33.960329
View on AUR
Why flagged

The package builds from the official EMQX GitHub repository, uses standard build tools with locked versions, and installs only project artifacts; the variable-named package install via npm/yarn is part of normal JavaScript ecosystem workflows and does not introduce untrusted external code.

Triggered rules

Low AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it LOW (confidence 95%): The package builds from the official EMQX GitHub repository, uses standard build tools with locked versions, and installs only project artifacts; the variable-named package install via npm/yarn is part of normal JavaScript ecosystem workflows and does not introduce untrusted external code.

  • PKGBUILD:98 npm install -g "@yarnpkg/cli-dist@${_yarnver}" --prefix "${_yarnhome}" --registry "${npm_config_registry}"

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2pkgname=mqttx-git
3_pkgname=MQTTX
4pkgver=1.13.2.r4.g4ac1d62
5_electronversion=39
6_nodeversion=22
7pkgrel=1
8pkgdesc="A cross-platform MQTT 5.0 client tool open sourced by EMQ."
9arch=(
10 'aarch64'
11 'x86_64'
12)
13url="https://mqttx.app/"
14_ghurl="https://github.com/emqx/MQTTX"
15license=('Apache-2.0')
16depends=(
17 "electron${_electronversion}"
18)
19makedepends=(
20 'npm'
21 'git'
22 'nvm'
23 'gendesk'
24 'yarn'
25 'python'
26 'jq'
27)
28source=(
29 "${pkgname//-/.}::git+${_ghurl}.git"
30 "${pkgname%-git}.sh"
31)
32sha256sums=('SKIP'
33 '983ddfde8e06d067be65dd41ccc555f4da0a635358eac915c40863d0782206c7')
34_get_project_dir() {
35 local d
36 while IFS= read -r d; do
37 find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
38 done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
39}
40pkgver() {
41 cd "$(_get_project_dir)"
42 set -o pipefail
43 git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
44 printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
45}
46_ensure_local_nvm() {
47 local NVM_DIR="${srcdir}/.nvm"
48 source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
49 nvm install "${_nodeversion}"
50 nvm use "${_nodeversion}"
51}
52_get_app_dir() {
53 find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -printf '%h\n' 2>/dev/null \
54 | while read -r d; do [[ -d "${d}/resources" ]] && { echo "$d"; return 0; }; done
55}
56_get_electron_version() {
57 _elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
58 | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
59 | grep -oE '[0-9]+' | head -1)
60 [[ -z "${_elec_ver}" ]] && return 1
61 (( _elec_ver == _electronversion )) && c=32 || c=31
62 echo -e "Electron version: \033[1;${c}m${_elec_ver}$([[ $c -eq 31 ]] && echo " (expected ${_electronversion})")\033[0m"
63}
64_set_build_env() {
65 export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
66 export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
67 export ELECTRON_SKIP_BINARY_DOWNLOAD=1
68 export ELECTRON_BUILDER_OFFLINE=true
69 export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
70 export HOME="${srcdir}/.home"
71 export XDG_CACHE_HOME="${HOME}/.cache"
72 export XDG_CONFIG_HOME="${HOME}/.config"
73 export XDG_DATA_HOME="${HOME}/.local/share"
74 export YARN_CACHE_FOLDER="${HOME}/.yarn/cache"
75 export YARN_NETWORK_CONCURRENCY=32
76 export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
77 export COREPACK_HOME="${HOME}/.corepack"
78 export npm_config_registry="${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}"
79 local _yarnver _yarnmajor=0
80 _yarnver="$(node -p "try { require('./package.json').packageManager?.split('@')[1]?.split('-')[0] || '' } catch { '' }" 2>/dev/null || true)"
81 _yarnmajor="${_yarnver%%.*}"
82 _yarnmajor="${_yarnmajor:-0}"
83 if [[ "${_yarnmajor}" -ge 2 ]] 2>/dev/null || [[ -f .yarnrc.yml ]]; then
84 export XDG_STATE_HOME="${HOME}/.local/state"
85 export YARN_ENABLE_GLOBAL_CACHE=false
86 export YARN_ENABLE_MIRROR=false
87 export YARN_GLOBAL_FOLDER="${HOME}/.yarn/berry"
88 export YARN_NODE_LINKER=node-modules
89 export YARN_NM_MODE=hardlinks-local
90 export YARN_ENABLE_TELEMETRY=false
91 export YARN_ENABLE_SCRIPTS=true
92 export YARN_HTTP_TIMEOUT=600000
93 export YARN_HTTP_RETRY=5
94 export YARN_NPM_REGISTRY_SERVER="${YARN_NPM_REGISTRY_SERVER:-${NPM_CONFIG_REGISTRY:-https://registry.yarnpkg.com}}"
95 local _yarnhome="${HOME}/.yarn/install"
96 mkdir -p "${HOME}" "${YARN_CACHE_FOLDER}" "${YARN_GLOBAL_FOLDER}" "${COREPACK_HOME}" "${_yarnhome}"
97 if [[ -n "${_yarnver}" ]]; then
98 npm install -g "@yarnpkg/cli-dist@${_yarnver}" --prefix "${_yarnhome}" --registry "${npm_config_registry}"
99 export PATH="${_yarnhome}/bin:${PATH}"
100 fi
101 else
102 export YARN_GLOBAL_FOLDER="${HOME}/.yarn/global"
103 export YARN_LINK_FOLDER="${HOME}/.yarn/link"
104 export YARN_TEMP_FOLDER="${HOME}/.yarn/tmp"
105 export YARN_NETWORK_TIMEOUT=600000
106 export YARN_CHILD_CONCURRENCY="$(nproc)"
107 export YARN_FROZEN_LOCKFILE=true
108 export YARN_IGNORE_ENGINES=true
109 export YARN_PRODUCTION=false
110 mkdir -p "${HOME}" "${YARN_CACHE_FOLDER}" "${YARN_GLOBAL_FOLDER}" "${YARN_LINK_FOLDER}" "${YARN_TEMP_FOLDER}" "${COREPACK_HOME}"
111 fi
112 local _reg="${NPM_CONFIG_REGISTRY:-https://registry.yarnpkg.com}"
113 export YARN_REGISTRY="${_reg}"
114 _reg="${_reg%/}"
115 if [[ -f .yarnrc ]]; then
116 sed -i "s|^registry .*|registry \"${_reg}\"|" .yarnrc
117 fi
118 if [[ -f yarn.lock ]] && grep -q 'resolved "https://registry.yarnpkg.com' yarn.lock; then
119 sed -i "s|https://registry.yarnpkg.com/|${_reg}/|g" yarn.lock
120 fi
121}
122prepare() {
123 cd "$(_get_project_dir)"
124 _get_electron_version
125 sed -i -e "
126 s/@electronversion@/${_electronversion}/g
127 s/@appname@/${pkgname%-git}/g
128 " "${srcdir}/${pkgname%-git}.sh"
129 gendesk -f -n -q \
130 --pkgname="${pkgname%-git}" \
131 --pkgdesc="${pkgdesc}" \
132 --categories="Development" \
133 --name="${_pkgname}" \
134 --exec="${pkgname%-git} %U"
135 _ensure_local_nvm
136 _set_build_env
137 jq --arg ver "${SYSTEM_ELECTRON_VERSION}" '.devDependencies.electron = $ver' package.json > package.json.tmp && mv package.json.tmp package.json
138 export NODE_ENV=development
139 yarn install
140}
141build() {
142 cd "$(_get_project_dir)"
143 _ensure_local_nvm
144 _set_build_env
145 export NODE_ENV=production
146 yarn run electron:build-linux
147 rm -rf "$(_get_app_dir)/resources/default_app.asar"
148}
149package() {
150 install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
151 install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-git}"
152 cp -a "$(_get_app_dir)/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"
153 install -Dm644 "$(_get_project_dir)/public/icons/app.png" "${pkgdir}/usr/share/pixmaps/${pkgname%-git}.png"
154 install -Dm644 "$(_get_project_dir)/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
155}
156

Changes since previous scan

--- PKGBUILD @ 2026-09-20 09:32
+++ PKGBUILD @ 2026-10-26 09:44
@@ -1,7 +1,7 @@
# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
pkgname=mqttx-git
_pkgname=MQTTX
-pkgver=1.13.1.r0.g5cf00bf
+pkgver=1.13.2.r4.g4ac1d62
_electronversion=39
_nodeversion=22
pkgrel=1
@@ -23,7 +23,6 @@
'gendesk'
'yarn'
'python'
- 'curl'
'jq'
)
source=(
@@ -31,91 +30,101 @@
"${pkgname%-git}.sh"
)
sha256sums=('SKIP'
- 'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
+ '983ddfde8e06d067be65dd41ccc555f4da0a635358eac915c40863d0782206c7')
+_get_project_dir() {
+ local d
+ while IFS= read -r d; do
+ find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
+ done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
+}
pkgver() {
- cd "${srcdir}/${pkgname//-/.}"
- set -o pipefail
- git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
- printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
+ cd "$(_get_project_dir)"
+ set -o pipefail
+ git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
+ printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
}
_ensure_local_nvm() {
- local NVM_DIR="${srcdir}/.nvm"
- source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
- nvm install "${_nodeversion}"
- nvm use "${_nodeversion}"
+ local NVM_DIR="${srcdir}/.nvm"
+ source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
+ nvm install "${_nodeversion}"
+ nvm use "${_nodeversion}"
+}
+_get_app_dir() {
+ find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -printf '%h\n' 2>/dev/null \
+ | while read -r d; do [[ -d "${d}/resources" ]] && { echo "$d"; return 0; }; done
+}
+_get_electron_version() {
+ _elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
+ | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
+ | grep -oE '[0-9]+' | head -1)
+ [[ -z "${_elec_ver}" ]] && return 1
+ (( _elec_ver == _electronversion )) && c=32 || c=31
+ echo -e "Electron version: \033[1;${c}m${_elec_ver}$([[ $c -eq 31 ]] && echo " (expected ${_electronversion})")\033[0m"
}
_set_build_env() {
export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
export ELECTRON_SKIP_BINARY_DOWNLOAD=1
- _ev="$(electron${_electronversion} -v)"
- export SYSTEM_ELECTRON_VERSION="${_ev#v}"
- export HOME="${srcdir}/.electron-gyp"
- export XDG_CACHE_HOME="${srcdir}/.cache"
- export XDG_CONFIG_HOME="${srcdir}/.config"
- export XDG_DATA_HOME="${srcdir}/.local/share"
- export npm_config_platform=linux
- export npm_config_arch="${CARCH}"
- export NODE_OPTIONS="--max-old-space-size=4096"
- export YARN_CACHE_FOLDER="${srcdir}/.yarn/cache"
+ export ELECTRON_BUILDER_OFFLINE=true
+ export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
+ export HOME="${srcdir}/.home"
+ export XDG_CACHE_HOME="${HOME}/.cache"
+ export XDG_CONFIG_HOME="${HOME}/.config"
+ export XDG_DATA_HOME="${HOME}/.local/share"
+ export YARN_CACHE_FOLDER="${HOME}/.yarn/cache"
export YARN_NETWORK_CONCURRENCY=32
+ export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
+ export COREPACK_HOME="${HOME}/.corepack"
+ export npm_config_registry="${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}"
local _yarnver _yarnmajor=0
- _yarnver="$(node -p "require('./package.json').packageManager?.split('@')[1]?.split('-')[0] || ''" 2>/dev/null)"
+ _yarnver="$(node -p "try { require('./package.json').packageManager?.split('@')[1]?.split('-')[0] || '' } catch { '' }" 2>/dev/null || true)"
_yarnmajor="${_yarnver%%.*}"
_yarnmajor="${_yarnmajor:-0}"
if [[ "${_yarnmajor}" -ge 2 ]] 2>/dev/null || [[ -f .yarnrc.yml ]]; then
- export XDG_STATE_HOME="${srcdir}/.local/state"
+ export XDG_STATE_HOME="${HOME}/.local/state"
export YARN_ENABLE_GLOBAL_CACHE=false
export YARN_ENABLE_MIRROR=false
- export YARN_GLOBAL_FOLDER="${srcdir}/.yarn/berry"
+ export YARN_GLOBAL_FOLDER="${HOME}/.yarn/berry"
export YARN_NODE_LINKER=node-modules
export YARN_NM_MODE=hardlinks-local
export YARN_ENABLE_TELEMETRY=false
export YARN_ENABLE_SCRIPTS=true
- export YARN_ENABLE_IMMUTABLE_INSTALLS=false
- export YARN_ENABLE_PROGRESS_BARS=false
- export YARN_ENABLE_COLORS=false
export YARN_HTTP_TIMEOUT=600000
export YARN_HTTP_RETRY=5
- export COREPACK_HOME="${srcdir}/.corepack"
- mkdir -p "${HOME}" "${YARN_CACHE_FOLDER}" "${YARN_GLOBAL_FOLDER}"
- install -dm755 "${srcdir}/.bin"
- corepack enable --install-directory "${srcdir}/.bin"
- export PATH="${srcdir}/.bin:${PATH}"
- corepack prepare "yarn@${_yarnver}" --activate
+ export YARN_NPM_REGISTRY_SERVER="${YARN_NPM_REGISTRY_SERVER:-${NPM_CONFIG_REGISTRY:-https://registry.yarnpkg.com}}"
+ local _yarnhome="${HOME}/.yarn/install"
+ mkdir -p "${HOME}" "${YARN_CACHE_FOLDER}" "${YARN_GLOBAL_FOLDER}" "${COREPACK_HOME}" "${_yarnhome}"
+ if [[ -n "${_yarnver}" ]]; then
+ npm install -g "@yarnpkg/cli-dist@${_yarnver}" --prefix "${_yarnhome}" --registry "${npm_config_registry}"
+ export PATH="${_yarnhome}/bin:${PATH}"
+ fi
else
- export YARN_GLOBAL_FOLDER="${srcdir}/.yarn/global"
- export YARN_LINK_FOLDER="${srcdir}/.yarn/link"
- export YARN_TEMP_FOLDER="${srcdir}/.yarn/tmp"
+ export YARN_GLOBAL_FOLDER="${HOME}/.yarn/global"
+ export YARN_LINK_FOLDER="${HOME}/.yarn/link"
+ export YARN_TEMP_FOLDER="${HOME}/.yarn/tmp"
export YARN_NETWORK_TIMEOUT=600000
export YARN_CHILD_CONCURRENCY="$(nproc)"
export YARN_FROZEN_LOCKFILE=true
- export YARN_NONINTERACTIVE=true
- export YARN_NO_PROGRESS=true
export YARN_IGNORE_ENGINES=true
- export NODE_ENV=production
export YARN_PRODUCTION=false
- mkdir -p "${HOME}" "${YARN_CACHE_FOLDER}" "${YARN_GLOBAL_FOLDER}" "${YARN_LINK_FOLDER}" "${YARN_TEMP_FOLDER}"
+ mkdir -p "${HOME}" "${YARN_CACHE_FOLDER}" "${YARN_GLOBAL_FOLDER}" "${YARN_LINK_FOLDER}" "${YARN_TEMP_FOLDER}" "${COREPACK_HOME}"
+ fi
+ local _reg="${NPM_CONFIG_REGISTRY:-https://registry.yarnpkg.com}"
+ export YARN_REGISTRY="${_reg}"
+ _reg="${_reg%/}"
+ if [[ -f .yarnrc ]]; then
+ sed -i "s|^registry .*|registry \"${_reg}\"|" .yarnrc
+ fi
+ if [[ -f yarn.lock ]] && grep -q 'resolved "https://registry.yarnpkg.com' yarn.lock; then
+ sed -i "s|https://registry.yarnpkg.com/|${_reg}/|g" yarn.lock
fi
}
-_get_app_dir() {
- find "${srcdir}" -type d -name "node_modules" -prune -o -type f -name "resources.pak" -print0 | xargs -0 dirname | head -n 1
-}
-_get_electron_version() {
- _elec_ver=$(find "${srcdir}" -maxdepth 5 -name "package.json" ! -path "*/node_modules/*" \
- -exec grep -l '"electron"' {} + | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null | head -1)
- [[ -z "${_elec_ver}" ]] && return 1
- echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
-}
prepare() {
- cd "${srcdir}/${pkgname//-/.}"
+ cd "$(_get_project_dir)"
_get_electron_version
sed -i -e "
s/@electronversion@/${_electronversion}/g
s/@appname@/${pkgname%-git}/g
- s/@runname@/app.asar/g
- s/@cfgdirname@/${_pkgname}/g
- s/@options@/env ELECTRON_OZONE_PLATFORM_HINT=auto/g
" "${srcdir}/${pkgname%-git}.sh"
gendesk -f -n -q \
--pkgname="${pkgname%-git}" \
@@ -125,21 +134,23 @@
--exec="${pkgname%-git} %U"
_ensure_local_nvm
_set_build_env
- sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g;s/--linux\"/--linux --dir\"/g" package.json
- NODE_ENV=development yarn install
+ jq --arg ver "${SYSTEM_ELECTRON_VERSION}" '.devDependencies.electron = $ver' package.json > package.json.tmp && mv package.json.tmp package.json
+ export NODE_ENV=development
+ yarn install
}
build() {
- cd "${srcdir}/${pkgname//-/.}"
+ cd "$(_get_project_dir)"
_ensure_local_nvm
_set_build_env
- NODE_ENV=production yarn run electron:build-linux
+ export NODE_ENV=production
+ yarn run electron:build-linux
+ rm -rf "$(_get_app_dir)/resources/default_app.asar"
}
package() {
install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-git}"
- local _app_dir=$(_get_app_dir)
- cp -a "${_app_dir}/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"
- install -Dm644 "${srcdir}/${pkgname//-/.}/public/icons/app.png" "${pkgdir}/usr/share/pixmaps/${pkgname%-git}.png"
- install -Dm644 "${srcdir}/${pkgname//-/.}/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
+ cp -a "$(_get_app_dir)/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"
+ install -Dm644 "$(_get_project_dir)/public/icons/app.png" "${pkgdir}/usr/share/pixmaps/${pkgname%-git}.png"
+ install -Dm644 "$(_get_project_dir)/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
}

Scan history

Scanned at (UTC)SeverityRules
2026-10-26 09:44:33 Low 1
2026-09-20 09:32:46 Clean 0
2026-06-18 16:11:54 Clean 0

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion