patreon-dl-gui

LOW

maintainer alllexx88 0 votes scanned 2026-09-06 09:10:50.549465

View on AUR

Why flagged

The package builds from source hosted on GitHub and uses a prebuilt Node.js binary from the official nodejs.org domain, which is trustworthy; the only risk is the lack of a clear license file upstream, but the software itself is not malicious.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from source hosted on GitHub and uses a prebuilt Node.js binary from the official nodejs.org domain, which is trustworthy; the only risk is the lack of a clear license file upstream, but the software itself is not malicious.

PKGBUILD

      1# Maintainer: Alex Potapenko <opotapenko@gmail.com>
    
      2
    
      3pkgname=patreon-dl-gui
    
      4pkgver=2.10.0
    
      5pkgrel=1
    
      6pkgdesc='Patreon downloader with a graphical user interface'
    
      7url='https://github.com/patrickkfkan/patreon-dl-gui'
    
      8arch=('x86_64')
    
      9license=('MIT')
    
      10
    
      11_nodever=24.20.0
    
      12
    
      13depends=(
    
      14  'alsa-lib'
    
      15  'at-spi2-core'
    
      16  'cairo'
    
      17  'dbus'
    
      18  'expat'
    
      19  'gcc-libs'
    
      20  'glib2'
    
      21  'glibc'
    
      22  'gtk3'
    
      23  'hicolor-icon-theme'
    
      24  'libcups'
    
      25  'libnotify'
    
      26  'libx11'
    
      27  'libxcb'
    
      28  'libxcomposite'
    
      29  'libxdamage'
    
      30  'libxext'
    
      31  'libxfixes'
    
      32  'libxkbcommon'
    
      33  'libxrandr'
    
      34  'mesa'
    
      35  'nspr'
    
      36  'nss'
    
      37  'pango'
    
      38  'systemd-libs'
    
      39  'xdg-utils'
    
      40)
    
      41makedepends=(
    
      42  'git'
    
      43  'python'
    
      44  'imagemagick'
    
      45)
    
      46optdepends=(
    
      47  'libpulse: PulseAudio audio support'
    
      48  'gvfs: trash and file-manager integration'
    
      49  'kde-cli-tools: KDE trash integration'
    
      50  'trash-cli: command-line trash support'
    
      51)
    
      52
    
      53options=('!strip' '!debug')
    
      54
    
      55source=(
    
      56    "${pkgname}-${pkgver}.tar.gz::${url}/archive/refs/tags/v${pkgver}.tar.gz"
    
      57    "no-target-identified-url-fallback.diff"
    
      58    "https://nodejs.org/dist/v${_nodever}/node-v${_nodever}-linux-x64.tar.xz"
    
      59    "${pkgname}.desktop"
    
      60)
    
      61
    
      62noextract=("node-v${_nodever}-linux-x64.tar.xz")
    
      63
    
      64sha256sums=('48b94bb10c2f5adcf876c3d876f38d0b4096b03abce5bf4571ec9a10fdf76f52'
    
      65            '2371f87a070ba06a5eca5c954c5ac6473af21f048296fa95a7260f25a00ca9f0'
    
      66            '2f2c0da162318f0de47665410c7c8c2ed3d36c8f3105de4bbc61176c70a7cbf2'
    
      67            'ee44697fe8dcaf4a9e198af8d86e4b2f35c594435d97a5a823440a4f34c6a3ae')
    
      68
    
      69prepare() {
    
      70    bsdtar -xf "node-v${_nodever}-linux-x64.tar.xz"
    
      71
    
      72    cd "${pkgname}-${pkgver}"
    
      73
    
      74    # https://github.com/patrickkfkan/patreon-dl-gui/pull/88
    
      75    # Fall back to the currently loaded browser URL when identifying the
    
      76    # download target from the Patreon page data fails.
    
      77    patch -Np1 -i "${srcdir}/no-target-identified-url-fallback.diff"
    
      78}
    
      79
    
      80build() {
    
      81    export PATH="${srcdir}/node-v${_nodever}-linux-x64/bin:${PATH}"
    
      82
    
      83    # Keep every download the build performs inside $srcdir.
    
      84    export npm_config_cache="${srcdir}/npm-cache"
    
      85    export ELECTRON_CACHE="${srcdir}/electron-cache"
    
      86    export PKG_CACHE_PATH="${srcdir}/pkg-cache"
    
      87
    
      88    # @electron/node-gyp is locked to an ssh:// remote, which needs credentials
    
      89    # nobody building a package has. Fetch it over https instead.
    
      90    export GIT_CONFIG_COUNT=1
    
      91    export GIT_CONFIG_KEY_0='url.https://github.com/.insteadOf'
    
      92    export GIT_CONFIG_VALUE_0='ssh://git@github.com/'
    
      93
    
      94    cd "${pkgname}-${pkgver}"
    
      95
    
      96    npm ci
    
      97    npm run package
    
      98}
    
      99
    
      100package() {
    
      101    cd "${pkgname}-${pkgver}"
    
      102
    
      103    local _appdir="/usr/lib/${pkgname}"
    
      104
    
      105    install -dm755 "${pkgdir}${_appdir}"
    
      106    cp -a "out/${pkgname}-linux-x64/." "${pkgdir}${_appdir}/"
    
      107
    
      108    chmod 755 "${pkgdir}${_appdir}"
    
      109
    
      110    # Some bundled modules ship prebuilt binaries for every platform they
    
      111    # support. Keep only the one this package is built for.
    
      112    local _prebuilds
    
      113    while IFS= read -r -d '' _prebuilds; do
    
      114        find "${_prebuilds}" -mindepth 1 -maxdepth 1 -type d \
    
      115            ! -name linux-x64 -exec rm -rf {} +
    
      116    done < <(find "${pkgdir}${_appdir}/resources/node_modules" \
    
      117        -type d -name prebuilds -print0)
    
      118
    
      119    # Chromium's setuid sandbox helper.
    
      120    chmod 4755 "${pkgdir}${_appdir}/chrome-sandbox"
    
      121
    
      122    install -dm755 "${pkgdir}/usr/bin"
    
      123    ln -s "${_appdir}/${pkgname}" "${pkgdir}/usr/bin/${pkgname}"
    
      124
    
      125    install -Dm644 "${srcdir}/${pkgname}.desktop" \
    
      126        "${pkgdir}/usr/share/applications/${pkgname}.desktop"
    
      127    install -Dm644 "src/resources/packaging/${pkgname}-server-console.desktop" \
    
      128        "${pkgdir}/usr/share/applications/${pkgname}-server-console.desktop"
    
      129
    
      130    install -dm755 "${pkgdir}/usr/share/icons/hicolor/128x128/apps"
    
      131    magick assets/electron.ico \
    
      132        "${pkgdir}/usr/share/icons/hicolor/128x128/apps/${pkgname}.png"
    
      133
    
      134    # Upstream ships no licence file of its own; the bundled Electron runtime
    
      135    # carries the MIT text the project is released under.
    
      136    install -Dm644 "${pkgdir}${_appdir}/LICENSE" \
    
      137        "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      138    install -Dm644 assets/attributions.txt \
    
      139        "${pkgdir}/usr/share/licenses/${pkgname}/attributions.txt"
    
      140}
    
      141

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-06 09:10:50	Low	2