onq
MEDIUM
maintainer visorcraft
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads a prebuilt ONNX Runtime binary from a non-standard, unverifiable host (cdn.pyke.io) which could be swapped by an unrelated party, constituting a supply-chain risk.
Triggered rules
Medium
npx/bunx/deno executes a remote package
remote_code_tool
`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.
-
PKGBUILD:63
npx --offline tauri build --no-bundle
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:29
"onnxruntime-$_ortver-x86_64.tar.lzma2::https://cdn.pyke.io/0/pyke:ort-rs/ms@$_ortver/x86_64-unknown-linux-gnu.tar.lzma2"
Medium
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 85%): The package downloads a prebuilt ONNX Runtime binary from a non-standard, unverifiable host (cdn.pyke.io) which could be swapped by an unrelated party, constituting a supply-chain risk.
PKGBUILD
2 offending line(s) highlighted
1
# Maintainer: VisorCraft LLC <packages@visorcraft.com>
2
3
pkgname=onq
4
pkgver=1.12.0
5
pkgrel=1
6
_ortver=1.24.2
7
pkgdesc='Search-oriented encrypted prompt vault'
8
arch=('x86_64')
9
url='https://github.com/visorcraft/onQ'
10
license=('GPL-3.0-only' 'MIT')
11
depends=(
12
'cairo'
13
'dbus'
14
'gcc-libs'
15
'gdk-pixbuf2'
16
'glib2'
17
'glibc'
18
'gtk3'
19
'hicolor-icon-theme'
20
'libsoup3'
21
'webkit2gtk-4.1'
22
)
23
makedepends=('cargo' 'npm' 'pkgconf')
24
conflicts=('onq-bin' 'onq-git')
25
options=('!lto')
26
source=(
27
"$pkgname-$pkgver.tar.gz::$url/archive/refs/tags/v$pkgver.tar.gz"
28
'com.visorcraft.onq.desktop'
29
"onnxruntime-$_ortver-x86_64.tar.lzma2::https://cdn.pyke.io/0/pyke:ort-rs/ms@$_ortver/x86_64-unknown-linux-gnu.tar.lzma2"
30
"onnxruntime-$_ortver-LICENSE::https://raw.githubusercontent.com/microsoft/onnxruntime/v$_ortver/LICENSE"
31
"onnxruntime-$_ortver-ThirdPartyNotices.txt::https://raw.githubusercontent.com/microsoft/onnxruntime/v$_ortver/ThirdPartyNotices.txt"
32
)
33
noextract=("onnxruntime-$_ortver-x86_64.tar.lzma2")
34
sha256sums=('f59e6b6c37b7607b6b1a92686b7b0f259f9a9a911093b6a5e7720d0de3cc5a6b'
35
'5ac2f4c83de25d9c254e7ff8cba2e016935f174a0a2110e9be229168813978d3'
36
'acc1cba79c337594ead1d88ca72516147aa60054c84217b53399a31caa5ba671'
37
'2f07c72751aed99790b8a4869cf2311df85a860b22ded05fa22803587a48922c'
38
'0e07b95f3a8d6230037707c5c4a2b554d12c4cb67369669ac255635528ffcee2')
39
40
prepare() {
41
cd "onQ-$pkgver"
42
export CARGO_HOME="$srcdir/cargo"
43
export npm_config_cache="$srcdir/npm-cache"
44
45
npm ci
46
install -d "$srcdir/onnxruntime"
47
xz --format=raw --lzma2=dict=64MiB -dc \
48
"$srcdir/onnxruntime-$_ortver-x86_64.tar.lzma2" |
49
bsdtar -xf - -C "$srcdir/onnxruntime"
50
cargo fetch --locked --target "$CARCH-unknown-linux-gnu"
51
}
52
53
build() {
54
cd "onQ-$pkgver"
55
export CARGO_HOME="$srcdir/cargo"
56
export CARGO_NET_OFFLINE=true
57
export CARGO_PROFILE_RELEASE_LTO=false
58
export npm_config_cache="$srcdir/npm-cache"
59
export npm_config_offline=true
60
export ORT_LIB_LOCATION="$srcdir/onnxruntime"
61
export RUSTFLAGS="${RUSTFLAGS:-} --remap-path-prefix=$srcdir=/usr/src/debug/$pkgname-$pkgver"
62
63
npx --offline tauri build --no-bundle
64
}
65
66
package() {
67
cd "onQ-$pkgver"
68
69
install -Dm755 target/release/onQ "$pkgdir/usr/bin/onq"
70
install -Dm644 "$srcdir/com.visorcraft.onq.desktop" \
71
"$pkgdir/usr/share/applications/com.visorcraft.onq.desktop"
72
73
install -Dm644 crates/onq-app/icons/32x32.png \
74
"$pkgdir/usr/share/icons/hicolor/32x32/apps/com.visorcraft.onq.png"
75
install -Dm644 crates/onq-app/icons/64x64.png \
76
"$pkgdir/usr/share/icons/hicolor/64x64/apps/com.visorcraft.onq.png"
77
install -Dm644 crates/onq-app/icons/128x128.png \
78
"$pkgdir/usr/share/icons/hicolor/128x128/apps/com.visorcraft.onq.png"
79
install -Dm644 crates/onq-app/icons/128x128@2x.png \
80
"$pkgdir/usr/share/icons/hicolor/256x256/apps/com.visorcraft.onq.png"
81
install -Dm644 crates/onq-app/icons/icon.png \
82
"$pkgdir/usr/share/icons/hicolor/512x512/apps/com.visorcraft.onq.png"
83
84
install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
85
install -Dm644 "$srcdir/onnxruntime-$_ortver-LICENSE" \
86
"$pkgdir/usr/share/licenses/$pkgname/ONNX-Runtime-LICENSE"
87
install -Dm644 "$srcdir/onnxruntime-$_ortver-ThirdPartyNotices.txt" \
88
"$pkgdir/usr/share/licenses/$pkgname/ONNX-Runtime-ThirdPartyNotices.txt"
89
install -Dm644 README.md "$pkgdir/usr/share/doc/$pkgname/README.md"
90
}
91
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Medium | 3 |
| 2026-09-16 00:03:17 | Medium | 3 |
| 2026-09-15 00:25:31 | Medium | 3 |
| 2026-09-14 00:27:57 | Medium | 3 |
| 2026-09-13 00:19:54 | Medium | 3 |
| 2026-09-12 00:25:17 | Medium | 3 |
| 2026-09-11 00:19:22 | Medium | 3 |
| 2026-09-10 00:22:44 | Medium | 3 |
| 2026-09-09 00:04:09 | Medium | 3 |
| 2026-09-08 00:18:08 | Medium | 3 |
| 2026-09-07 00:30:15 | Medium | 3 |
| 2026-09-06 00:17:06 | Medium | 3 |
| 2026-09-05 00:16:27 | Medium | 3 |
| 2026-09-04 00:03:13 | Medium | 3 |
| 2026-09-03 00:15:47 | Medium | 3 |
| 2026-09-02 00:02:31 | Medium | 3 |
| 2026-09-01 00:11:19 | Medium | 3 |
| 2026-08-31 00:19:57 | Medium | 3 |
| 2026-08-30 00:04:14 | Medium | 3 |
| 2026-08-29 00:29:17 | Medium | 3 |