nvm-desktop-git

LOW
maintainer zxp19821005 0 votes scanned 2026-11-01 00:21:48.120785
View on AUR
Why flagged

The package builds from source hosted on GitHub repositories associated with the project, uses standard build tools, and installs dependencies via version-pinned npm/pnpm; the variable-named package install is part of normal project toolchain setup, not untrusted external code.

Triggered rules

Low AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it LOW (confidence 95%): The package builds from source hosted on GitHub repositories associated with the project, uses standard build tools, and installs dependencies via version-pinned npm/pnpm; the variable-named package install is part of normal project toolchain setup, not untrusted external code.

  • PKGBUILD:101 npm install -g "pnpm@${_pnpmver}" --prefix "${HOME}/.pnpm" \

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2pkgname=nvm-desktop-git
3_pkgname='NVM Desktop'
4pkgver=4.5.0.r0.g809e35c
5_nodeversion=24
6pkgrel=1
7pkgdesc="A version management desktop client for the Nodejs."
8arch=('any')
9url="https://github.com/1111mp/nvm-desktop"
10_nvmdurl="https://github.com/1111mp/nvmd-command"
11license=('MIT')
12conflicts=("${pkgname%-git}")
13provides=("${pkgname%-git}=${pkgver%.r*}")
14depends=(
15 'webkit2gtk-4.1'
16 'gtk3'
17 'libayatana-indicator'
18 'libappindicator'
19)
20makedepends=(
21 'gendesk'
22 'npm'
23 'nvm'
24 'pnpm'
25 'git'
26 'rustup'
27 'librsvg'
28 'patchelf'
29)
30source=(
31 "${pkgname%-git}.git::git+${url}"
32 "nvmd.git::git+${_nvmdurl}"
33)
34sha256sums=('SKIP')
35_get_project_dir() {
36 find "${srcdir}" -name "src-tauri" -type d ! -path "*/node_modules/*" 2>/dev/null | \
37 while read -r tauri_dir; do
38 [ -f "${tauri_dir}/Cargo.toml" ] || continue
39 local dir="${tauri_dir}"
40 until [ -f "${dir}/package.json" ] || [ "$dir" = "${srcdir}" ] || [ "$dir" = "/" ]; do
41 dir="$(dirname "$dir")"
42 done
43 [ -f "${dir}/package.json" ] && { echo "$dir"; return; }
44 done
45}
46pkgver() {
47 cd "$(_get_project_dir)"
48 set -o pipefail
49 git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
50 printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
51}
52_get_nvmd_dir() {
53 find "${srcdir}" -type d -name "crates" \
54 -exec test -f "{}/../Cargo.toml" -a -f "{}/../Cargo.lock" -a ! -f "{}/../tauri.conf.json" \; \
55 -printf "%h\n" -quit 2>/dev/null
56}
57_ensure_local_nvm() {
58 local NVM_DIR="${srcdir}/.nvm"
59 source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
60 nvm install "${_nodeversion}"
61 nvm use "${_nodeversion}"
62}
63_set_rust_build_env() {
64 export HOME="${srcdir}/.home"
65 export CARGO_HOME="${HOME}/.cargo"
66 export CARGO_NET_GIT_FETCH_WITH_CLI=true
67 export CARGO_NET_RETRY=5
68 export CARGO_HTTP_MULTIPLEXING=false
69 export CARGO_INCREMENTAL=0
70 export CARGO_TERM_COLOR=never
71 export CARGO_PROFILE_RELEASE_STRIP=symbols
72 mkdir -p "${HOME}" "${CARGO_HOME}"
73}
74_set_pnpm_build_env() {
75 export HOME="${srcdir}/.home"
76 export XDG_CACHE_HOME="${HOME}/.cache"
77 export XDG_CONFIG_HOME="${HOME}/.config"
78 export XDG_DATA_HOME="${HOME}/.local/share"
79 export XDG_STATE_HOME="${HOME}/.local/state"
80 export PNPM_HOME="${HOME}/.pnpm/bin"
81 export pnpm_config_cache_dir="${HOME}/.pnpm_cache"
82 export pnpm_config_store_dir="${HOME}/.pnpm_store"
83 export pnpm_config_global_dir="${HOME}/.pnpm/global"
84 export pnpm_config_state_dir="${HOME}/.pnpm/state"
85 export pnpm_config_node_linker=hoisted
86 export pnpm_config_minimum_release_age=0
87 export pnpm_config_update_notifier=false
88 export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
89 export COREPACK_HOME="${HOME}/.corepack"
90 mkdir -p "${HOME}" "${PNPM_HOME}" "${pnpm_config_cache_dir}" "${pnpm_config_store_dir}" "${pnpm_config_global_dir}" "${pnpm_config_state_dir}" "${COREPACK_HOME}"
91 export PATH="${PNPM_HOME}:${PATH}"
92 local _pnpmver=""
93 local _pkgjson="$(_get_project_dir)/package.json"
94 if [ -f "${_pkgjson}" ]; then
95 _pnpmver="$(grep -o '"packageManager"[^,]*' "${_pkgjson}" 2>/dev/null | grep -oE 'pnpm@[^"+]+' | head -n1 | sed 's/^pnpm@//')"
96 if [ -z "${_pnpmver}" ]; then
97 _pnpmver="$(grep -oE '"pnpm"[[:space:]]*:[[:space:]]*"[^"]+"' "${_pkgjson}" 2>/dev/null | grep -oE '[0-9][0-9.]*' | head -n1)"
98 fi
99 fi
100 if [ -n "${_pnpmver}" ]; then
101 npm install -g "pnpm@${_pnpmver}" --prefix "${HOME}/.pnpm" \
102 --registry "${COREPACK_NPM_REGISTRY}"
103 fi
104}
105prepare() {
106 cd "$(_get_project_dir)"
107 gendesk -f -n -q \
108 --pkgname="${pkgname%-git}" \
109 --pkgdesc="${pkgdesc}" \
110 --categories="Development" \
111 --name="${pkgname%-git}" \
112 --exec="${pkgname%-git} %U"
113 _ensure_local_nvm
114 _set_rust_build_env
115 _set_pnpm_build_env
116 rustup toolchain install stable
117 rustup default stable
118 cd "$(_get_nvmd_dir)"
119 cargo build --release
120 install -Dm755 target/release/nvmd -t "$(_get_project_dir)/src-tauri/resources"
121 cd "$(_get_project_dir)"
122 jq '.bundle.active = false' src-tauri/tauri.conf.json > tmp.json && mv tmp.json src-tauri/tauri.conf.json
123 cp "src-tauri/icons/128x128@2x.png" "src-tauri/icons/256x256.png"
124 export NODE_ENV=development
125 pnpm install
126}
127build() {
128 cd "$(_get_project_dir)"
129 _ensure_local_nvm
130 _set_rust_build_env
131 _set_pnpm_build_env
132 export NODE_ENV=production
133 pnpm run build
134}
135package() {
136 install -Dm755 "$(_get_project_dir)/src-tauri/target/release/${pkgname%-git}" -t "${pkgdir}/usr/bin"
137 install -Dm755 "$(_get_nvmd_dir)/target/release/nvmd" -t "${pkgdir}/usr/lib/${_pkgname//-/ }/resources"
138 install -Dm644 "$(_get_project_dir)/src-tauri/icons/icon.png" -t "${pkgdir}/usr/lib/${_pkgname//-/ }/icons"
139 install -Dm644 "$(_get_project_dir)/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
140 _icon_sizes=(32x32 64x64 128x128 256x256)
141 for _icons in "${_icon_sizes[@]}";do
142 install -Dm644 "$(_get_project_dir)/src-tauri/icons/${_icons}.png" \
143 "${pkgdir}/usr/share/icons/hicolor/${_icons//@2/}/apps/${pkgname%-git}.png"
144 done
145 install -Dm644 "$(_get_project_dir)/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
146}
147

Changes since previous scan

--- PKGBUILD @ 2026-10-30 00:29
+++ PKGBUILD @ 2026-11-01 00:21
@@ -1,7 +1,7 @@
# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
pkgname=nvm-desktop-git
_pkgname='NVM Desktop'
-pkgver=4.4.0.r0.g0eeff7a
+pkgver=4.5.0.r0.g809e35c
_nodeversion=24
pkgrel=1
pkgdesc="A version management desktop client for the Nodejs."
@@ -14,15 +14,16 @@
depends=(
'webkit2gtk-4.1'
'gtk3'
+ 'libayatana-indicator'
+ 'libappindicator'
)
makedepends=(
'gendesk'
'npm'
'nvm'
'pnpm'
- 'curl'
'git'
- 'rust'
+ 'rustup'
'librsvg'
'patchelf'
)
@@ -30,37 +31,28 @@
"${pkgname%-git}.git::git+${url}"
"nvmd.git::git+${_nvmdurl}"
)
-sha256sums=('SKIP'
- 'SKIP')
+sha256sums=('SKIP')
+_get_project_dir() {
+ find "${srcdir}" -name "src-tauri" -type d ! -path "*/node_modules/*" 2>/dev/null | \
+ while read -r tauri_dir; do
+ [ -f "${tauri_dir}/Cargo.toml" ] || continue
+ local dir="${tauri_dir}"
+ until [ -f "${dir}/package.json" ] || [ "$dir" = "${srcdir}" ] || [ "$dir" = "/" ]; do
+ dir="$(dirname "$dir")"
+ done
+ [ -f "${dir}/package.json" ] && { echo "$dir"; return; }
+ done
+}
pkgver() {
- cd "${srcdir}/${pkgname%-git}.git"
+ cd "$(_get_project_dir)"
set -o pipefail
git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
}
-_set_build_env() {
- export HOME="${srcdir}/.electron-gyp"
- export CARGO_HOME="${srcdir}/.cargo"
- {
- export PNPM_LINK_WORKSPACE_PACKAGES=true
- export PNPM_FETCH_RETRY_MAXTIMEOUT=10000
- export PNPM_CACHE_DIR="${srcdir}/.pnpm_cache"
- export PNPM_STORE_DIR="${srcdir}/.pnpm_store"
- export PNPM_VIRTUAL_STORE_DIR="${srcdir}/.pnpm_store"
- export PNPM_SHAMEFULLY_HOIST=true
- export PNPM_VIRTUAL_STORE_DIR_MAX_LENGTH=80
- export PNPM_NODE_LINKER=hoisted
- export PNPM_NETWORK_CONCURRENCY=32
- }
- if [[ "$(curl -s ipinfo.io/country)" == *"CN"* ]]; then
- {
- export pnpm_config_registry="https://registry.npmmirror.com"
- export npm_config_registry="https://registry.npmmirror.com"
- export NODEJS_ORG_MIRROR="https://npmmirror.com/mirrors/node"
- export RUSTUP_DIST_SERVER="https://mirrors.aliyun.com/rustup"
- export RUSTUP_UPDATE_ROOT="https://mirrors.aliyun.com/rustup/rustup"
- }
- fi
+_get_nvmd_dir() {
+ find "${srcdir}" -type d -name "crates" \
+ -exec test -f "{}/../Cargo.toml" -a -f "{}/../Cargo.lock" -a ! -f "{}/../tauri.conf.json" \; \
+ -printf "%h\n" -quit 2>/dev/null
}
_ensure_local_nvm() {
local NVM_DIR="${srcdir}/.nvm"
@@ -68,42 +60,88 @@
nvm install "${_nodeversion}"
nvm use "${_nodeversion}"
}
+_set_rust_build_env() {
+ export HOME="${srcdir}/.home"
+ export CARGO_HOME="${HOME}/.cargo"
+ export CARGO_NET_GIT_FETCH_WITH_CLI=true
+ export CARGO_NET_RETRY=5
+ export CARGO_HTTP_MULTIPLEXING=false
+ export CARGO_INCREMENTAL=0
+ export CARGO_TERM_COLOR=never
+ export CARGO_PROFILE_RELEASE_STRIP=symbols
+ mkdir -p "${HOME}" "${CARGO_HOME}"
+}
+_set_pnpm_build_env() {
+ export HOME="${srcdir}/.home"
+ export XDG_CACHE_HOME="${HOME}/.cache"
+ export XDG_CONFIG_HOME="${HOME}/.config"
+ export XDG_DATA_HOME="${HOME}/.local/share"
+ export XDG_STATE_HOME="${HOME}/.local/state"
+ export PNPM_HOME="${HOME}/.pnpm/bin"
+ export pnpm_config_cache_dir="${HOME}/.pnpm_cache"
+ export pnpm_config_store_dir="${HOME}/.pnpm_store"
+ export pnpm_config_global_dir="${HOME}/.pnpm/global"
+ export pnpm_config_state_dir="${HOME}/.pnpm/state"
+ export pnpm_config_node_linker=hoisted
+ export pnpm_config_minimum_release_age=0
+ export pnpm_config_update_notifier=false
+ export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
+ export COREPACK_HOME="${HOME}/.corepack"
+ mkdir -p "${HOME}" "${PNPM_HOME}" "${pnpm_config_cache_dir}" "${pnpm_config_store_dir}" "${pnpm_config_global_dir}" "${pnpm_config_state_dir}" "${COREPACK_HOME}"
+ export PATH="${PNPM_HOME}:${PATH}"
+ local _pnpmver=""
+ local _pkgjson="$(_get_project_dir)/package.json"
+ if [ -f "${_pkgjson}" ]; then
+ _pnpmver="$(grep -o '"packageManager"[^,]*' "${_pkgjson}" 2>/dev/null | grep -oE 'pnpm@[^"+]+' | head -n1 | sed 's/^pnpm@//')"
+ if [ -z "${_pnpmver}" ]; then
+ _pnpmver="$(grep -oE '"pnpm"[[:space:]]*:[[:space:]]*"[^"]+"' "${_pkgjson}" 2>/dev/null | grep -oE '[0-9][0-9.]*' | head -n1)"
+ fi
+ fi
+ if [ -n "${_pnpmver}" ]; then
+ npm install -g "pnpm@${_pnpmver}" --prefix "${HOME}/.pnpm" \
+ --registry "${COREPACK_NPM_REGISTRY}"
+ fi
+}
prepare() {
+ cd "$(_get_project_dir)"
gendesk -f -n -q \
--pkgname="${pkgname%-git}" \
--pkgdesc="${pkgdesc}" \
--categories="Development" \
--name="${pkgname%-git}" \
--exec="${pkgname%-git} %U"
- _set_build_env
_ensure_local_nvm
+ _set_rust_build_env
+ _set_pnpm_build_env
+ rustup toolchain install stable
rustup default stable
- # build nvmd
- cd "${srcdir}/nvmd.git"
- cargo install toml-cli
+ cd "$(_get_nvmd_dir)"
cargo build --release
- # build nvm-desktop
- cd "${srcdir}/${pkgname%-git}.git"
- install -Dm755 "${srcdir}/nvmd.git/target/release/nvmd" -t "${srcdir}/${pkgname%-git}.git/src-tauri/resources"
- sed -i "s/\"active\"\: true\,/\"active\"\: false\,/g" src-tauri/tauri.conf.json
+ install -Dm755 target/release/nvmd -t "$(_get_project_dir)/src-tauri/resources"
+ cd "$(_get_project_dir)"
+ jq '.bundle.active = false' src-tauri/tauri.conf.json > tmp.json && mv tmp.json src-tauri/tauri.conf.json
cp "src-tauri/icons/128x128@2x.png" "src-tauri/icons/256x256.png"
- NODE_ENV=development pnpm install
+ export NODE_ENV=development
+ pnpm install
}
build() {
- cd "${srcdir}/${pkgname%-git}.git"
- _set_build_env
+ cd "$(_get_project_dir)"
_ensure_local_nvm
- NODE_ENV=production pnpm run build
+ _set_rust_build_env
+ _set_pnpm_build_env
+ export NODE_ENV=production
+ pnpm run build
}
package() {
- install -Dm755 "${srcdir}/${pkgname%-git}.git/src-tauri/target/release/${pkgname%-git}" -t "${pkgdir}/usr/bin"
- install -Dm755 "${srcdir}/nvmd.git/target/release/nvmd" -t "${pkgdir}/usr/lib/${_pkgname//-/ }/resources"
- install -Dm644 "${srcdir}/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
+ install -Dm755 "$(_get_project_dir)/src-tauri/target/release/${pkgname%-git}" -t "${pkgdir}/usr/bin"
+ install -Dm755 "$(_get_nvmd_dir)/target/release/nvmd" -t "${pkgdir}/usr/lib/${_pkgname//-/ }/resources"
+ install -Dm644 "$(_get_project_dir)/src-tauri/icons/icon.png" -t "${pkgdir}/usr/lib/${_pkgname//-/ }/icons"
+ install -Dm644 "$(_get_project_dir)/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
_icon_sizes=(32x32 64x64 128x128 256x256)
for _icons in "${_icon_sizes[@]}";do
- install -Dm644 "${srcdir}/${pkgname%-git}.git/src-tauri/icons/${_icons}.png" \
- "${pkgdir}/usr/share/icons/hicolor/${_icons}/apps/${pkgname%-git}.png"
+ install -Dm644 "$(_get_project_dir)/src-tauri/icons/${_icons}.png" \
+ "${pkgdir}/usr/share/icons/hicolor/${_icons//@2/}/apps/${pkgname%-git}.png"
done
- install -Dm644 "${srcdir}/${pkgname%-git}.git/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
+ install -Dm644 "$(_get_project_dir)/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
}

Scan history

Scanned at (UTC)SeverityRules
2026-11-01 00:21:48 Low 1
2026-10-31 00:07:41 Low 1
2026-10-30 03:55:04 Low 1
2026-10-30 00:29:30 Low 2
2026-10-29 00:13:55 Low 2
2026-10-28 00:06:54 Low 2
2026-10-27 00:23:28 Low 2
2026-10-26 00:12:40 Low 2
2026-10-25 00:20:48 Low 2
2026-10-24 00:14:55 Low 2
2026-10-23 00:02:19 Low 2
2026-10-22 00:13:10 Low 2
2026-10-21 00:12:50 Low 2
2026-10-20 00:10:31 Low 2
2026-10-19 00:03:55 Low 2
2026-10-18 00:06:55 Low 2
2026-10-17 00:21:55 Low 2
2026-10-16 00:12:47 Low 2
2026-10-15 00:28:05 Low 2
2026-10-14 00:06:47 Low 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion