pandora-box-git

LOW
maintainer zxp19821005 0 votes scanned 2026-09-17 00:27:14.276658
View on AUR
Why flagged

The downloads are from a trusted project's release assets via a mirror (ghfast.top) used for geo-location-based performance; the files are data (GeoIP databases), not executable code, and are used by the application at runtime.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The downloads are from a trusted project's release assets via a mirror (ghfast.top) used for geo-location-based performance; the files are data (GeoIP databases), not executable code, and are used by the application at runtime.

1 higher static finding superseded - not the current verdict (shown for transparency)
Medium External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

  • PKGBUILD:112 wget -O internal/em/geoip.metadb "https://${_DLURL}/MetaCubeX/meta-rules-dat/releases/download/latest/geoip.metadb"
  • PKGBUILD:113 wget -O internal/em/GeoSite.dat "https://${_DLURL}/MetaCubeX/meta-rules-dat/releases/download/latest/geosite.dat"
  • PKGBUILD:114 wget -O internal/em/GeoLite2-ASN.mmdb "https://${_DLURL}/MetaCubeX/meta-rules-dat/releases/download/latest/GeoLite2-ASN.mmdb"

PKGBUILD

3 offending line(s) highlighted
1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2pkgname=pandora-box-git
3_pkgname=Pandora-Box
4pkgver=1.0.23.r4.g87e16ea
5_electronversion=41
6_nodeversion=26
7pkgrel=1
8pkgdesc="A Simple Mihomo GUI. 一个简易的 Mihomo 桌面客户端"
9arch=(
10 'aarch64'
11 'x86_64'
12)
13url="https://github.com/snakem982/Pandora-Box"
14license=('GPL-3.0-only')
15conflicts=("${pkgname%-git}")
16provides=("${pkgname%-git}=${pkgver%.r*}")
17depends=(
18 "electron${_electronversion}"
19)
20makedepends=(
21 'gendesk'
22 'npm'
23 'nvm'
24 'go'
25 'git'
26 'wget'
27 'curl'
28 'jq'
29 'zip'
30)
31source=(
32 "${pkgname%-git}.git::git+${url}"
33 "${pkgname%-git}.sh"
34)
35sha256sums=('SKIP'
36 'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
37pkgver() {
38 cd "${srcdir}/${pkgname%-git}.git"
39 set -o pipefail
40 git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
41 printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
42}
43_ensure_local_nvm() {
44 export NVM_DIR="${srcdir}/.nvm"
45 source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
46 nvm install "${_nodeversion}"
47 nvm use "${_nodeversion}"
48}
49_set_build_env() {
50 export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
51 export ELECTRON_SKIP_BINARY_DOWNLOAD=1
52 export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/v//g')"
53 export HOME="${srcdir}/.electron-gyp"
54 export NPM_CONFIG_CACHE="${srcdir}/.npm_cache"
55 export NPM_CONFIG_MAXSOCKETS=32
56 export CGO_ENABLED=1
57 export GO111MODULE=on
58 export GOOS=linux
59 export GOCACHE="${srcdir}/go-build"
60 export GOMODCACHE="${srcdir}/go/pkg/mod"
61 if [[ "$(curl -s ipinfo.io/country)" == *"CN"* ]]; then
62 {
63 export NPM_CONFIG_REGISTRY="https://registry.npmmirror.com"
64 export NODEJS_ORG_MIRROR="https://npmmirror.com/mirrors/node"
65 export ELECTRON_MIRROR="https://npmmirror.com/mirrors/electron/"
66 export ELECTRON_BUILDER_BINARIES_MIRROR="https://npmmirror.com/mirrors/electron-builder-binaries/"
67 }
68 export GOPROXY=https://goproxy.cn,direct
69 _DLURL="ghfast.top/https://github.com"
70 find ./ -type f -name "package-lock.json" -exec sed -i "s/registry.npmjs.org/registry.npmmirror.com/g" {} +
71 else
72 _DLURL="github.com"
73 fi
74}
75_get_app_dir() {
76 find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1
77}
78_get_electron_version() {
79 _elec_ver=$(find "${srcdir}" -maxdepth 5 -name "package.json" ! -path "*/node_modules/*" \
80 -exec grep -l '"electron"' {} + | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null | head -1)
81 [[ -z "${_elec_ver}" ]] && return 1
82 echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
83}
84prepare() {
85 cd "${srcdir}/${pkgname%-git}.git"
86 _get_electron_version
87 sed -i -e "
88 s/@electronversion@/${_electronversion}/g
89 s/@appname@/${pkgname%-git}/g
90 s/@runname@/app.asar/g
91 s/@cfgdirname@/${_pkgname}/g
92 " "${srcdir}/${pkgname%-git}.sh"
93 gendesk -q -f -n \
94 --pkgname="${pkgname%-git}" \
95 --pkgdesc="${pkgdesc}" \
96 --categories="Network" \
97 --name="${_pkgname}" \
98 --exec="${pkgname%-git}"
99 _set_build_env
100 _ensure_local_nvm
101 find src-electron -type f -exec sed -i "s/process.resourcesPath/\'\/usr\/lib\/${pkgname%-git}\'/g" {} +
102 sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g" package.json
103 NODE_ENV=development npm install --legacy-peer-deps
104 local _v="${SYSTEM_ELECTRON_VERSION}"
105 local _zd="${srcdir}/electron-zips"
106 local _zf="${_zd}/electron-v${_v}-linux-x64.zip"
107 install -Dm755 -d "${_zd}"
108 ( cd "${ELECTRON_DIST}" && zip -r -q -0 "${_zf}" . )
109 sed -i "/packagerConfig:[[:space:]]*{/a\\ electronZipDir: '${_zd}'," forge.config.*
110 cd "${srcdir}/${pkgname%-git}.git/src-go"
111 go mod tidy
112 wget -O internal/em/geoip.metadb "https://${_DLURL}/MetaCubeX/meta-rules-dat/releases/download/latest/geoip.metadb"
113 wget -O internal/em/GeoSite.dat "https://${_DLURL}/MetaCubeX/meta-rules-dat/releases/download/latest/geosite.dat"
114 wget -O internal/em/GeoLite2-ASN.mmdb "https://${_DLURL}/MetaCubeX/meta-rules-dat/releases/download/latest/GeoLite2-ASN.mmdb"
115}
116build() {
117 cd "${srcdir}/${pkgname%-git}.git/src-go"
118 _set_build_env
119 _ensure_local_nvm
120 _VERSION="$(git describe --tags --abbrev=0)"
121 go build -tags=with_gvisor -trimpath \
122 -ldflags "-s -w -X github.com/snakem982/pandora-box/api.Version=${_VERSION}" \
123 -o px
124 cd "${srcdir}/${pkgname%-git}.git"
125 NODE_ENV=production npm run package
126}
127package() {
128 install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
129 install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-git}"
130 local _app_dir=$(_get_app_dir)
131 cp -a "${_app_dir}/resources/". "${pkgdir}/usr/lib/${pkgname%-git}/"
132 install -Dm644 "${srcdir}/${pkgname%-git}.git/build/appicon.png" "${pkgdir}/usr/share/pixmaps/${pkgname%-git}.png"
133 install -Dm644 "${srcdir}/${pkgname%-git}.git/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
134}
135

Changes since previous scan

--- PKGBUILD @ 2026-09-09 00:04
+++ PKGBUILD @ 2026-09-17 00:27
@@ -1,11 +1,11 @@
# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
pkgname=pandora-box-git
_pkgname=Pandora-Box
-pkgver=1.0.22.r0.g8ea7971
+pkgver=1.0.23.r4.g87e16ea
_electronversion=41
_nodeversion=26
pkgrel=1
-pkgdesc="A Simple Mihomo GUI.(Use system-wide electron)"
+pkgdesc="A Simple Mihomo GUI. 一个简易的 Mihomo 桌面客户端"
arch=(
'aarch64'
'x86_64'
@@ -26,6 +26,7 @@
'wget'
'curl'
'jq'
+ 'zip'
)
source=(
"${pkgname%-git}.git::git+${url}"
@@ -100,6 +101,12 @@
find src-electron -type f -exec sed -i "s/process.resourcesPath/\'\/usr\/lib\/${pkgname%-git}\'/g" {} +
sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g" package.json
NODE_ENV=development npm install --legacy-peer-deps
+ local _v="${SYSTEM_ELECTRON_VERSION}"
+ local _zd="${srcdir}/electron-zips"
+ local _zf="${_zd}/electron-v${_v}-linux-x64.zip"
+ install -Dm755 -d "${_zd}"
+ ( cd "${ELECTRON_DIST}" && zip -r -q -0 "${_zf}" . )
+ sed -i "/packagerConfig:[[:space:]]*{/a\\ electronZipDir: '${_zd}'," forge.config.*
cd "${srcdir}/${pkgname%-git}.git/src-go"
go mod tidy
wget -O internal/em/geoip.metadb "https://${_DLURL}/MetaCubeX/meta-rules-dat/releases/download/latest/geoip.metadb"

Scan history

Scanned at (UTC)SeverityRules
2026-09-17 00:27:14 Low 2
2026-09-16 00:03:17 Low 2
2026-09-15 00:25:31 Low 2
2026-09-14 00:27:57 Low 2
2026-09-13 00:19:54 Low 2
2026-09-12 00:25:17 Low 2
2026-09-11 00:19:22 Low 2
2026-09-10 00:22:44 Low 2
2026-09-09 09:19:26 Medium 1
2026-09-09 00:04:09 Low 2
2026-09-08 00:18:08 Low 2
2026-09-07 00:30:15 Low 2
2026-09-06 00:17:06 Low 2
2026-09-05 00:16:27 Low 2
2026-09-04 00:03:13 Low 2
2026-09-03 00:15:47 Low 2
2026-09-02 00:02:31 Low 2
2026-09-01 00:11:19 Low 2
2026-08-31 00:19:57 Low 2
2026-08-30 00:04:14 Low 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion