notemark-git

LOW
maintainer zxp19821005 0 votes scanned 2026-11-06 06:11:22.019786
View on AUR
Why flagged

The package builds from the project's own source via git, uses standard build tools, and installs only project files; the flagged variable-based package install refers to internal devDependencies, not external untrusted packages, and the low votes/recent upload is a mild risk indicator but not indicative of malice.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 90%): The package builds from the project's own source via git, uses standard build tools, and installs only project files; the flagged variable-based package install refers to internal devDependencies, not external untrusted packages, and the low votes/recent upload is a mild risk indicator but not indicative of malice.

  • PKGBUILD:104 npm install -g "@yarnpkg/cli-dist@${_yarnver}" --prefix "${_yarnhome}" --registry "${npm_config_registry}"

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2pkgname=notemark-git
3_pkgname=NoteMark
4pkgver=2.0.0.r2.g741f88a
5_electronversion=45
6_nodeversion=24
7pkgrel=1
8pkgdesc="A fast, local-first Markdown notes app. Notes are plain .md files."
9arch=('any')
10url="https://github.com/AbdulDevHub/NoteMark"
11license=('MIT')
12conflicts=("${pkgname%-git}")
13provides=("${pkgname%-git}=${pkgver%.r*}")
14depends=(
15 "electron${_electronversion}"
16)
17makedepends=(
18 'npm'
19 'git'
20 'nvm'
21 'gendesk'
22 'jq'
23 'yarn'
24)
25source=(
26 "${pkgname%-git}.git::git+${url}.git"
27 "${pkgname%-git}.js"
28 "${pkgname%-git}.sh"
29)
30sha256sums=('SKIP'
31 '562897be8a17076176f8d985c0d7bc1c685f2e7c9b3a932339ce015963243627'
32 'ace275e253744ca62d2572776df26b947f3c89616239985003126db635fc300e')
33_get_project_dir() {
34 local d
35 while IFS= read -r d; do
36 find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
37 done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
38}
39pkgver() {
40 cd "$(_get_project_dir)"
41 set -o pipefail
42 git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
43 printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
44}
45_ensure_local_nvm() {
46 local NVM_DIR="${srcdir}/.nvm"
47 source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
48 nvm install "${_nodeversion}"
49 nvm use "${_nodeversion}"
50}
51_get_app_dir() {
52 find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -printf '%h\n' 2>/dev/null \
53 | while read -r d; do [[ -d "${d}/resources" ]] && { echo "$d"; return 0; }; done
54}
55_get_electron_version() {
56 local _v
57 _v=$(jq -r '.. | (.electron? // empty) | strings' "$(_get_project_dir)/package.json" 2>/dev/null | head -1)
58 [[ -z "$_v" ]] && _v=$(grep -oE 'electron@[0-9.]+' "$(_get_project_dir)/pnpm-lock.yaml" 2>/dev/null | head -1 | sed 's/^electron@//')
59 [[ -z "$_v" ]] && _v=$(grep -oE 'electron@npm:[0-9.]+' "$(_get_project_dir)/yarn.lock" 2>/dev/null | head -1 | sed 's/^electron@npm://')
60 [[ -z "$_v" ]] && _v=$(jq -r '.packages["node_modules/electron"].version // empty' "$(_get_project_dir)/package-lock.json" 2>/dev/null | head -1)
61 [[ -z "$_v" ]] && _v=$(grep -oE 'electron: ?\[?"?npm:?[0-9.]+' "$(_get_project_dir)/bun.lock" 2>/dev/null | grep -oE '[0-9.]+' | head -1)
62 [[ -z "$_v" ]] && return 1
63 _v="$(printf '%s' "$_v" | sed 's/^[^0-9]*//')"
64 [[ "$_v" =~ ^[0-9] ]] || return 1
65 _v="${_v%%.*}"
66 (( ${_v} == _electronversion )) && echo -e "\033[1;32mElectron version: ${_v}\033[0m" || echo -e "\033[1;31mElectron version: ${_v} (expected ${_electronversion})\033[0m"
67}
68_set_electron_build_env() {
69 export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
70 export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
71 export ELECTRON_SKIP_BINARY_DOWNLOAD=1
72 export ELECTRON_BUILDER_OFFLINE=true
73 export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
74}
75_set_yarn_build_env() {
76 export HOME="${srcdir}/.home"
77 export XDG_CACHE_HOME="${HOME}/.cache"
78 export XDG_CONFIG_HOME="${HOME}/.config"
79 export XDG_DATA_HOME="${HOME}/.local/share"
80 export YARN_CACHE_FOLDER="${HOME}/.yarn/cache"
81 export YARN_NETWORK_CONCURRENCY=32
82 export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
83 export COREPACK_HOME="${HOME}/.corepack"
84 export npm_config_registry="${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}"
85 local _yarnver _yarnmajor=0
86 _yarnver="$(node -p "try { require('./package.json').packageManager?.split('@')[1]?.split('-')[0] || '' } catch { '' }" 2>/dev/null || true)"
87 _yarnmajor="${_yarnver%%.*}"
88 _yarnmajor="${_yarnmajor:-0}"
89 if [[ "${_yarnmajor}" -ge 2 ]] 2>/dev/null || [[ -f .yarnrc.yml ]]; then
90 export XDG_STATE_HOME="${HOME}/.local/state"
91 export YARN_ENABLE_GLOBAL_CACHE=false
92 export YARN_ENABLE_MIRROR=false
93 export YARN_GLOBAL_FOLDER="${HOME}/.yarn/berry"
94 export YARN_NODE_LINKER=node-modules
95 export YARN_NM_MODE=hardlinks-local
96 export YARN_ENABLE_TELEMETRY=false
97 export YARN_ENABLE_SCRIPTS=true
98 export YARN_HTTP_TIMEOUT=600000
99 export YARN_HTTP_RETRY=5
100 export YARN_NPM_REGISTRY_SERVER="${YARN_NPM_REGISTRY_SERVER:-${NPM_CONFIG_REGISTRY:-https://registry.yarnpkg.com}}"
101 local _yarnhome="${HOME}/.yarn/install"
102 mkdir -p "${HOME}" "${YARN_CACHE_FOLDER}" "${YARN_GLOBAL_FOLDER}" "${COREPACK_HOME}" "${_yarnhome}"
103 if [[ -n "${_yarnver}" ]]; then
104 npm install -g "@yarnpkg/cli-dist@${_yarnver}" --prefix "${_yarnhome}" --registry "${npm_config_registry}"
105 export PATH="${_yarnhome}/bin:${PATH}"
106 fi
107 else
108 export YARN_GLOBAL_FOLDER="${HOME}/.yarn/global"
109 export YARN_LINK_FOLDER="${HOME}/.yarn/link"
110 export YARN_TEMP_FOLDER="${HOME}/.yarn/tmp"
111 export YARN_NETWORK_TIMEOUT=600000
112 export YARN_CHILD_CONCURRENCY="$(nproc)"
113 export YARN_FROZEN_LOCKFILE=true
114 export YARN_IGNORE_ENGINES=true
115 export YARN_PRODUCTION=false
116 mkdir -p "${HOME}" "${YARN_CACHE_FOLDER}" "${YARN_GLOBAL_FOLDER}" "${YARN_LINK_FOLDER}" "${YARN_TEMP_FOLDER}" "${COREPACK_HOME}"
117 export YARN_REGISTRY="${NPM_CONFIG_REGISTRY:-https://registry.yarnpkg.com}"
118 fi
119 local _reg="${NPM_CONFIG_REGISTRY:-https://registry.yarnpkg.com}"
120 _reg="${_reg%/}"
121 if [[ -f yarn.lock ]] && grep -q 'registry.yarnpkg.com' yarn.lock; then
122 sed -i "s|https://registry.yarnpkg.com/|${_reg}/|g" yarn.lock
123 fi
124}
125prepare() {
126 cd "$(_get_project_dir)"
127 _get_electron_version
128 sed -i -e "
129 s/@electronversion@/${_electronversion}/g
130 s/@appname@/${pkgname%-git}/g
131 " "${srcdir}/${pkgname%-git}.sh" "${srcdir}/${pkgname%-git}.js"
132 gendesk -q -f -n \
133 --pkgname="${pkgname%-git}" \
134 --pkgdesc="${pkgdesc}" \
135 --categories="Office" \
136 --name="${_pkgname}" \
137 --exec="${pkgname%-git} %U"
138 _ensure_local_nvm
139 _set_electron_build_env
140 _set_yarn_build_env
141 jq --arg ver "${SYSTEM_ELECTRON_VERSION}" '.devDependencies.electron = $ver' package.json > package.json.tmp && mv package.json.tmp package.json
142 export NODE_ENV=development
143 yarn install
144}
145build() {
146 cd "$(_get_project_dir)"
147 _ensure_local_nvm
148 _set_electron_build_env
149 _set_yarn_build_env
150 export NODE_ENV=production
151 yarn run build
152 yarn electron-builder --linux dir -c.electronDist="${ELECTRON_DIST}" --config electron-builder.yml
153 rm -rf "$(_get_app_dir)/resources/default_app.asar"
154}
155package() {
156 install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
157 install -Dm644 "${srcdir}/${pkgname%-git}.js" -t "${pkgdir}/usr/lib/${pkgname%-git}"
158 cp -a "$(_get_app_dir)/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"
159 install -Dm644 "$(_get_project_dir)/build/icon.png" "${pkgdir}/usr/share/pixmaps/${pkgname%-git}.png"
160 install -Dm644 "$(_get_project_dir)/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
161 install -Dm644 "$(_get_project_dir)/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
162}
163

Scan history

Scanned at (UTC)SeverityRules
2026-11-06 06:11:22 Low 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion