nodejs-carto-git

maintainer dreieck · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The npm install runs on the project's own source from GitHub, which is normal for building Node.js packages; the flagged 'external package' is part of the project's declared dependencies, not an undeclared remote execution.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The npm install runs on the project's own source from GitHub, which is normal for building Node.js packages; the flagged 'external package' is part of the project's declared dependencies, not an undeclared remote execution.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:92 npm install --user root -g --prefix "$pkgdir"/usr --cache "${srcdir}/.npm-cache" --production --no-optional "$(npm pack -g --prefix "$pkgdir"/usr --cache "${srcdir}/.npm-cache" --production --no-optional | tail -n 1)"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: dreieck
    
      2
    
      3_pkgorigname=carto
    
      4_pkgname="${_pkgorigname}"
    
      5pkgname="nodejs-${_pkgname}-git"
    
      6pkgdesc="Mapbox carto: Translates Carto MML/ CartoCSS to Mapnik XML or a JSON variant of Mapnik XML."
    
      7pkgver=1.2.0+28+r1971.20201014.3051072
    
      8pkgrel=3
    
      9arch=('any')
    
      10license=('apache')
    
      11url="https://vis4.net/chromajs/"
    
      12depends=(
    
      13  'mapnik'
    
      14  'nodejs'
    
      15)
    
      16makedepends=(
    
      17  'git'
    
      18  'npm'
    
      19  'python-sphinx' # For making documentation.
    
      20  'python-sphinx_rtd_theme' # For making documentation.
    
      21  'texinfo' # For making documentation.
    
      22  'texlive-bin' # For making documentation.
    
      23  'texlive-latexextra' # For making documentation.
    
      24)
    
      25provides=(
    
      26  "${_pkgname}=${pkgver}"
    
      27  "nodejs-${_pkgname}=${pkgver}"
    
      28  "${_pkgname}-git=${pkgver}"
    
      29  # "${_pkgname}-doc=${pkgver}"
    
      30  # "nodejs-${_pkgname}-doc=${pkgver}"
    
      31  # "${_pkgname}-git-doc=${pkgver}"
    
      32  # "nodejs-${_pkgname}-git-doc=${pkgver}"
    
      33)
    
      34conflicts=(
    
      35  "${_pkgname}"
    
      36  "nodejs-${_pkgname}"
    
      37  "${_pkgname}-git"
    
      38  # "${_pkgname}-doc"
    
      39  # "nodejs-${_pkgname}-doc"
    
      40  # "${_pkgname}-git-doc"
    
      41  # "nodejs-${_pkgname}-git-doc"
    
      42)
    
      43options=('!strip') # Do not attempt to strip, since there is no ELF binary anyway, so strip will just take needless time.
    
      44source=(
    
      45  "${_pkgorigname}::git+https://github.com/mapbox/${_pkgorigname}.git"
    
      46)
    
      47sha256sums=(
    
      48  'SKIP'
    
      49)
    
      50
    
      51pkgver() {
    
      52  cd "${srcdir}/${_pkgorigname}"
    
      53
    
      54  _ver="$(git describe --tags | sed -E 's|\-g[0-9a-fA-F]*$||' | sed 's|^v||' | tr '-' '+')"
    
      55  _rev="$(git rev-list --count HEAD)"
    
      56  _hash="$(git rev-parse --short HEAD)"
    
      57  _date="$(git log -n 1 --format=tformat:%ci | awk '{print $1}' | tr -d '-')"
    
      58
    
      59  if [ -n "${_ver}" ]; then
    
      60    printf '%s' "${_ver}+r${_rev}.${_date}.${_hash}"
    
      61  fi
    
      62}
    
      63
    
      64prepare() {
    
      65  cd "${srcdir}/${_pkgorigname}"
    
      66  msg2 "Downloading node-dependencies by running 'npm install' into a temporary directory ..."
    
      67  _carto_tmp="$(mktemp -d "${srcdir}/tmp_XXXX")"
    
      68  npm install -g --prefix "${_carto_tmp}" --cache "${srcdir}/.npm-cache" --production --no-optional
    
      69  rm -Rf "${_carto_tmp}"
    
      70}
    
      71
    
      72build() {
    
      73  cd "${srcdir}/${_pkgorigname}/docs"
    
      74
    
      75  msg2 "Building documentation ..."
    
      76  msg2 "· make man:";      make man
    
      77  msg2 "· make info:";     make info
    
      78  msg2 "· make text:";     make text
    
      79  # msg2 "· make dirhtml:";  make dirhtml
    
      80  msg2 "· make latexpdf:"; make latexpdf
    
      81
    
      82  msg2 "compressing pdf, manpage and info file ..."
    
      83  rm -f "_build/man/carto.1.gz";        gzip -v -9 "_build/man/carto.1"
    
      84  rm -f "_build/texinfo/carto.info.gz"; gzip -v -9 "_build/texinfo/carto.info"
    
      85  rm -f "_build/latex/carto.pdf.xz";    xz   -v -9 "_build/latex/carto.pdf"
    
      86}
    
      87
    
      88package() {
    
      89  cd "${srcdir}/${_pkgorigname}"
    
      90
    
      91  msg2 "Running 'npm pack', and 'npm install' on the result ..."
    
      92  npm install --user root -g --prefix "$pkgdir"/usr --cache "${srcdir}/.npm-cache" --production --no-optional "$(npm pack -g --prefix "$pkgdir"/usr --cache "${srcdir}/.npm-cache" --production --no-optional | tail -n 1)"
    
      93
    
      94  msg2 "Remving unneeded files from '/usr/lib/node_modules/carto/' ..."
    
      95  rm -rf "${pkgdir}/usr/lib/node_modules/carto"/{docs,man,carto-*.tgz}
    
      96  rm -rf "${pkgdir}/usr/share/man/man1/carto.1"
    
      97
    
      98  # Non-deterministic race in npm gives 777 permissions to random directories.
    
      99  # See http://github.com/npm/npm/issues/9359 for details.
    
      100  msg2 "Fixing permissions of directories due to a possible race condition in 'npm' ..."
    
      101  find "${pkgdir}"/usr -type d -exec chmod 755 {} +
    
      102
    
      103  for _docfile in CHANGELOG.md CONTRIBUTING.md README.md; do
    
      104    install -D -v -m644 "${_docfile}" "${pkgdir}/usr/share/doc/${_pkgname}/${_docfile}"
    
      105  done
    
      106  install -D -v -m644 "docs/_build/man/carto.1.gz" "${pkgdir}/usr/share/man/man1/carto.1.gz"
    
      107  install -D -v -m644 "docs/_build/texinfo/carto.info.gz" "${pkgdir}/usr/share/info/carto.info.gz"
    
      108  printf "%s\n" "Copying 'docs/_build/text' -> '${pkgdir}/usr/share/doc/${_pkgname}/text' ..."; cp -r "docs/_build/text" "${pkgdir}/usr/share/doc/${_pkgname}/text"; chmod -R a+Xr "${pkgdir}/usr/share/doc/${_pkgname}/text"
    
      109  # printf "%s\n" "Copying 'docs/_build/dirhtml' -> '${pkgdir}/usr/share/doc/${_pkgname}/html' ..."; cp -r "docs/_build/dirhtml" "${pkgdir}/usr/share/doc/${_pkgname}/html"
    
      110  install -D -v -m644 "docs/_build/latex/carto.pdf.xz" "${pkgdir}/usr/share/doc/${_pkgname}/carto.pdf.xz"
    
      111  install -d -v -m755 "${pkgdir}/usr/share/doc/${_pkgname}/html"; printf '%s\n' 'http://cartocss.readthedocs.io/en/latest/' > "${pkgdir}/usr/share/doc/${_pkgname}/html/html_doc.url"
    
      112
    
      113  install -D -v -m644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.md"
    
      114
    
      115  msg2 "Fixing ownership ..."
    
      116  chown -R root:root "${pkgdir}"/*
    
      117}
    
      118

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2