pi-harness-bin

MEDIUM
maintainer zxp19821005 0 votes scanned 2026-10-17 00:21:55.226236
View on AUR
Why flagged

The package extracts and modifies an AppImage from an untrusted release URL, which could allow supply-chain attacks if the AppImage is swapped; while it rebuilds parts of the app, the original binary is still executed and comes from a non-whitelisted, potentially swappable source.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 85%): The package extracts and modifies an AppImage from an untrusted release URL, which could allow supply-chain attacks if the AppImage is swapped; while it rebuilds parts of the app, the original binary is still executed and comes from a non-whitelisted, potentially swappable source.

PKGBUILD

1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2pkgname=pi-harness-bin
3_pkgname=Pi-Harness
4pkgver=2.0.0
5_electronversion=44
6pkgrel=1
7pkgdesc="Operational Superset Harness and Desktop Control Plane for Pi Coding Agent."
8arch=('x86_64')
9url="https://github.com/wangmiaozero/pi-harness"
10license=('AGPL-3.0-only')
11provides=("${pkgname%-bin}=${pkgver}")
12conflicts=("${pkgname%-bin}")
13depends=(
14 "electron${_electronversion}"
15 'nodejs'
16 'npm'
17 'pi-coding-agent'
18)
19makedepends=(
20 'asar'
21)
22source=(
23 "${pkgname%-bin}-${pkgver}-x86_64.AppImage::${url}/releases/download/v${pkgver}/${_pkgname}-${pkgver}.AppImage"
24 "${pkgname%-bin}.sh"
25)
26sha256sums=('294abe652853e5d1a6f8ec6ed1423693dbba89f5076ab20de117c93cd47b1747'
27 'dfcd6603d29c7b8d88e019b517a2e5c1a7b5ab905a0961a8b81adfa508b258b8')
28_get_app_dir() {
29 find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -printf '%h\n' 2>/dev/null \
30 | while read -r d; do [[ -d "${d}/resources" ]] && { echo "$d"; return 0; }; done
31}
32_check_electron_version() {
33 local _v=$(strings "$(find "$(_get_app_dir)" -maxdepth 1 -type f \
34 -executable -printf '%s %p\n' | sort -nr | head -1 | cut -d' ' -f2-)" \
35 | grep -oP 'Electron/\K[0-9]+' | head -1)
36 [[ -z "$_v" ]] && { echo -e "\033[1;33mNote: Could not check version.\033[0m"; return; }
37 (( _v == _electronversion )) && c=32 || c=31
38 echo -e "Electron version: \033[1;${c}m$_v$([[ $c -eq 31 ]] && echo " (expected $_electronversion)")\033[0m"
39}
40prepare() {
41 sed -i -e "
42 s/@electronversion@/${_electronversion}/g
43 s/@appname@/${pkgname%-bin}/g
44 " "${srcdir}/${pkgname%-bin}.sh"
45 if [ ! -x "${srcdir}/${pkgname%-bin}-${pkgver}-${CARCH}.AppImage" ];then
46 chmod +x "${srcdir}/${pkgname%-bin}-${pkgver}-${CARCH}.AppImage"
47 fi
48 if [ -d "${srcdir}/squashfs-root" ];then
49 rm -rf "${srcdir}/squashfs-root"
50 fi
51 "${srcdir}/${pkgname%-bin}-${pkgver}-${CARCH}.AppImage" --appimage-extract > /dev/null
52 _check_electron_version
53 sed -i "s/AppRun --no-sandbox/${pkgname%-bin}/g" "$(_get_app_dir)/${pkgname%-bin}.desktop"
54 asar e "$(_get_app_dir)/resources/app.asar" "${srcdir}/app.asar.unpacked"
55 find "${srcdir}/app.asar.unpacked/out" -type f -exec sed -i "s/process.resourcesPath/\'\/usr\/lib\/${pkgname%-bin}\'/g" {} +
56 find "${srcdir}" -type d \( -name "*darwin*" -o -name "*win32*" -o -name "*-arm*" \) -exec rm -rf {} +
57 asar p "${srcdir}/app.asar.unpacked" "$(_get_app_dir)/resources/app.asar"
58 find "$(_get_app_dir)/resources" -type d -perm 700 -exec chmod 755 {} +
59}
60package() {
61 install -Dm755 "${srcdir}/${pkgname%-bin}.sh" "${pkgdir}/usr/bin/${pkgname%-bin}"
62 install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-bin}"
63 cp -a "$(_get_app_dir)/resources/." "${pkgdir}/usr/lib/${pkgname%-bin}/"
64 find "${srcdir}" -type f \( -name "*.png" -o -name "*.svg" \) -path "*share/icons/*" | while read -r _i; do
65 _extension="${_i##*.}"
66 _icon_path="${_i#*share/icons/}"
67 _target_dir="/usr/share/icons/$(dirname "${_icon_path}")"
68 install -Dm644 "${_i}" "${pkgdir}${_target_dir}/${pkgname%-bin}.${_extension}"
69 done
70 install -Dm644 "$(_get_app_dir)/${pkgname%-bin}.desktop" -t "${pkgdir}/usr/share/applications"
71}
72

Changes since previous scan

--- PKGBUILD @ 2026-10-14 00:06
+++ PKGBUILD @ 2026-10-17 00:21
@@ -1,7 +1,7 @@
# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
pkgname=pi-harness-bin
_pkgname=Pi-Harness
-pkgver=1.9.0
+pkgver=2.0.0
_electronversion=44
pkgrel=1
pkgdesc="Operational Superset Harness and Desktop Control Plane for Pi Coding Agent."
@@ -23,10 +23,11 @@
"${pkgname%-bin}-${pkgver}-x86_64.AppImage::${url}/releases/download/v${pkgver}/${_pkgname}-${pkgver}.AppImage"
"${pkgname%-bin}.sh"
)
-sha256sums=('042d82172e8681d9767784e6c7e2ba7f872a8db3e5ee5f6d2ce832b3bd7f764e'
+sha256sums=('294abe652853e5d1a6f8ec6ed1423693dbba89f5076ab20de117c93cd47b1747'
'dfcd6603d29c7b8d88e019b517a2e5c1a7b5ab905a0961a8b81adfa508b258b8')
_get_app_dir() {
- find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -print 2>/dev/null | while read f; do [ -d "${f%/*}/resources" ] && echo "${f%/*}" && break; done
+ find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -printf '%h\n' 2>/dev/null \
+ | while read -r d; do [[ -d "${d}/resources" ]] && { echo "$d"; return 0; }; done
}
_check_electron_version() {
local _v=$(strings "$(find "$(_get_app_dir)" -maxdepth 1 -type f \
@@ -49,25 +50,23 @@
fi
"${srcdir}/${pkgname%-bin}-${pkgver}-${CARCH}.AppImage" --appimage-extract > /dev/null
_check_electron_version
- local _app_dir="$(_get_app_dir)"
- sed -i "s/AppRun --no-sandbox/${pkgname%-bin}/g" "${_app_dir}/${pkgname%-bin}.desktop"
- asar e "${_app_dir}/resources/app.asar" "${srcdir}/app.asar.unpacked"
+ sed -i "s/AppRun --no-sandbox/${pkgname%-bin}/g" "$(_get_app_dir)/${pkgname%-bin}.desktop"
+ asar e "$(_get_app_dir)/resources/app.asar" "${srcdir}/app.asar.unpacked"
find "${srcdir}/app.asar.unpacked/out" -type f -exec sed -i "s/process.resourcesPath/\'\/usr\/lib\/${pkgname%-bin}\'/g" {} +
find "${srcdir}" -type d \( -name "*darwin*" -o -name "*win32*" -o -name "*-arm*" \) -exec rm -rf {} +
- asar p "${srcdir}/app.asar.unpacked" "${_app_dir}/resources/app.asar"
- find "${_app_dir}/resources" -type d -perm 700 -exec chmod 755 {} +
+ asar p "${srcdir}/app.asar.unpacked" "$(_get_app_dir)/resources/app.asar"
+ find "$(_get_app_dir)/resources" -type d -perm 700 -exec chmod 755 {} +
}
package() {
install -Dm755 "${srcdir}/${pkgname%-bin}.sh" "${pkgdir}/usr/bin/${pkgname%-bin}"
install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-bin}"
- local _app_dir="$(_get_app_dir)"
- cp -a "${_app_dir}/resources/." "${pkgdir}/usr/lib/${pkgname%-bin}/"
+ cp -a "$(_get_app_dir)/resources/." "${pkgdir}/usr/lib/${pkgname%-bin}/"
find "${srcdir}" -type f \( -name "*.png" -o -name "*.svg" \) -path "*share/icons/*" | while read -r _i; do
_extension="${_i##*.}"
_icon_path="${_i#*share/icons/}"
_target_dir="/usr/share/icons/$(dirname "${_icon_path}")"
install -Dm644 "${_i}" "${pkgdir}${_target_dir}/${pkgname%-bin}.${_extension}"
done
- install -Dm644 "${_app_dir}/${pkgname%-bin}.desktop" -t "${pkgdir}/usr/share/applications"
+ install -Dm644 "$(_get_app_dir)/${pkgname%-bin}.desktop" -t "${pkgdir}/usr/share/applications"
}

Scan history

Scanned at (UTC)SeverityRules
2026-10-17 00:21:55 Medium 2
2026-10-16 00:12:47 Medium 2
2026-10-15 00:28:05 Medium 2
2026-10-14 15:20:15 Medium 2
2026-10-14 00:06:47 Medium 2
2026-10-13 07:16:10 Medium 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion