picgo-electron

LOW
maintainer zxp19821005 1 votes scanned 2026-10-07 14:05:47.471701
View on AUR
Why flagged

The package builds from a legitimate project source and uses standard tooling; the variable-named package installation is part of normal pnpm/npm workflow and does not introduce untrusted code execution.

Triggered rules

Low AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it LOW (confidence 95%): The package builds from a legitimate project source and uses standard tooling; the variable-named package installation is part of normal pnpm/npm workflow and does not introduce untrusted code execution.

  • PKGBUILD:79 npm install -g "pnpm@${_pnpmver}" --prefix "${HOME}/.pnpm" \

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2# Contributor: zhullyb <zhullyb [at] outlook [dot] com>
3# Contributor: littzhch <2371050115@qq.com>
4# Contributor: Bruce Zhang
5pkgname=picgo-electron
6_pkgname=PicGo
7pkgver=3.0.3
8_electronversion=38
9_nodeversion=22
10pkgrel=1
11pkgdesc="A simple & beautiful tool for pictures uploading built by electron-vue."
12arch=('any')
13url="https://github.com/Molunerfinn/PicGo"
14license=('MIT')
15conflicts=(
16 "${pkgname%-electron}"
17 "${pkgname}"
18)
19depends=(
20 "electron${_electronversion}"
21)
22makedepends=(
23 'npm'
24 'nvm'
25 'git'
26 'pnpm'
27 'jq'
28)
29source=(
30 "${pkgname}-${pkgver}.tar.gz::${url}/archive/refs/tags/v${pkgver}.tar.gz"
31 "${pkgname}.sh"
32)
33sha256sums=('61f40ed41dba53fb756bf38d4d3535ea48fea7c536e01b242b3e8197ed9e4555'
34 'bd5358d8f323d3c2c2f0733364ee4ea55f551dd86ba0be2a76846210b60897fc')
35_ensure_local_nvm() {
36 local NVM_DIR="${srcdir}/.nvm"
37 source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
38 nvm install "${_nodeversion}"
39 nvm use "${_nodeversion}"
40}
41_get_project_dir() {
42 local d
43 while IFS= read -r d; do
44 find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
45 done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
46}
47_set_build_env() {
48 export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
49 export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
50 export ELECTRON_SKIP_BINARY_DOWNLOAD=1
51 export ELECTRON_BUILDER_OFFLINE=true
52 export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
53 export HOME="${srcdir}/.home"
54 export XDG_CACHE_HOME="${HOME}/.cache"
55 export XDG_CONFIG_HOME="${HOME}/.config"
56 export XDG_DATA_HOME="${HOME}/.local/share"
57 export XDG_STATE_HOME="${HOME}/.local/state"
58 export PNPM_HOME="${HOME}/.pnpm/bin"
59 export pnpm_config_cache_dir="${HOME}/.pnpm_cache"
60 export pnpm_config_store_dir="${HOME}/.pnpm_store"
61 export pnpm_config_global_dir="${HOME}/.pnpm/global"
62 export pnpm_config_state_dir="${HOME}/.pnpm/state"
63 export pnpm_config_node_linker=hoisted
64 export pnpm_config_minimum_release_age=0
65 export pnpm_config_update_notifier=false
66 export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
67 export COREPACK_HOME="${HOME}/.corepack"
68 mkdir -p "${HOME}" "${PNPM_HOME}" "${pnpm_config_cache_dir}" "${pnpm_config_store_dir}" "${pnpm_config_global_dir}" "${pnpm_config_state_dir}" "${COREPACK_HOME}"
69 export PATH="${PNPM_HOME}:${PATH}"
70 local _pnpmver=""
71 local _pkgjson="$(_get_project_dir)/package.json"
72 if [ -f "${_pkgjson}" ]; then
73 _pnpmver="$(grep -o '"packageManager"[^,]*' "${_pkgjson}" 2>/dev/null | grep -oE 'pnpm@[^"+]+' | head -n1 | sed 's/^pnpm@//')"
74 if [ -z "${_pnpmver}" ]; then
75 _pnpmver="$(grep -oE '"pnpm"[[:space:]]*:[[:space:]]*"[^"]+"' "${_pkgjson}" 2>/dev/null | grep -oE '[0-9][0-9.]*' | head -n1)"
76 fi
77 fi
78 if [ -n "${_pnpmver}" ]; then
79 npm install -g "pnpm@${_pnpmver}" --prefix "${HOME}/.pnpm" \
80 --registry "${COREPACK_NPM_REGISTRY}"
81 fi
82}
83_get_app_dir() {
84 find "${srcdir}" -type f -name "resources.pak" -print 2>/dev/null | while read f; do [ -d "${f%/*}/resources" ] && echo "${f%/*}" && break; done
85}
86_get_electron_version() {
87 _elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
88 | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
89 | grep -v '^$' | sed 's/^[^0-9]*//' | head -1)
90 [[ -z "${_elec_ver}" ]] && return 1
91 echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
92}
93prepare() {
94 cd "$(_get_project_dir)"
95 _get_electron_version
96 sed -i -e "
97 s/@electronversion@/${_electronversion}/g
98 s/@appname@/${pkgname}/g
99 s/@runname@/app.asar/g
100 s/@cfgdirname@/${_pkgname}/g
101 " "${srcdir}/${pkgname}.sh"
102 gendesk -q -f -n \
103 --pkgname="${pkgname}" \
104 --pkgdesc="${pkgdesc}" \
105 --categories="Utility" \
106 --name="${_pkgname}" \
107 --exec="${pkgname} %U"
108 _ensure_local_nvm
109 _set_build_env
110 jq --arg ver "${SYSTEM_ELECTRON_VERSION}" '.devDependencies.electron = $ver' package.json > package.json.tmp && mv package.json.tmp package.json
111 rm -rf pnpm-lock.yaml
112 export NODE_ENV=development
113 pnpm install
114}
115build() {
116 cd "$(_get_project_dir)"
117 _ensure_local_nvm
118 _set_build_env
119 export NODE_ENV=development
120 pnpm run build
121 pnpm -c exec "electron-builder --linux dir -c.electronDist=${ELECTRON_DIST}"
122 local _app_dir="$(_get_app_dir)"
123 rm -rf "${_app_dir}/resources/default_app.asar"
124 case "${CARCH}" in
125 aarch64) _archrem=x64 ;;
126 x86_64) _archrem=arm ;;
127 esac
128 find "${_app_dir}/resources/app.asar.unpacked" -type d \
129 \( -name "darwin*" -o -name "win32*" -o -name "*${_archrem}"* \) \
130 -exec rm -rf {} +
131}
132package() {
133 install -Dm755 "${srcdir}/${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
134 install -Dm755 -d "${pkgdir}/usr/lib/${pkgname}"
135 local _app_dir="$(_get_app_dir)"
136 cp -a "${_app_dir}/resources/." "${pkgdir}/usr/lib/${pkgname}/"
137 local _src="$(_get_project_dir)"
138 _icon_sizes=(256x256 512x512)
139 for _icons in "${_icon_sizes[@]}";do
140 install -Dm644 "${_src}/build/icons/${_icons}.png" \
141 "${pkgdir}/usr/share/icons/hicolor/${_icons}/apps/${pkgname}.png"
142 done
143 install -Dm644 "${_src}/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
144 install -Dm644 "${_src}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
145}

Changes since previous scan

--- PKGBUILD @ 2026-08-18 03:38
+++ PKGBUILD @ 2026-10-07 14:05
@@ -4,11 +4,11 @@
# Contributor: Bruce Zhang
pkgname=picgo-electron
_pkgname=PicGo
-pkgver=3.0.2
+pkgver=3.0.3
_electronversion=38
_nodeversion=22
pkgrel=1
-pkgdesc="A simple & beautiful tool for pictures uploading built by electron-vue.(Use system-wide electron)"
+pkgdesc="A simple & beautiful tool for pictures uploading built by electron-vue."
arch=('any')
url="https://github.com/Molunerfinn/PicGo"
license=('MIT')
@@ -23,7 +23,6 @@
'npm'
'nvm'
'git'
- 'curl'
'pnpm'
'jq'
)
@@ -31,51 +30,68 @@
"${pkgname}-${pkgver}.tar.gz::${url}/archive/refs/tags/v${pkgver}.tar.gz"
"${pkgname}.sh"
)
-sha256sums=('08df1c990213caa154da058b3b1cac797376512b9e42aa8b36f0cc979b088833'
- 'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
+sha256sums=('61f40ed41dba53fb756bf38d4d3535ea48fea7c536e01b242b3e8197ed9e4555'
+ 'bd5358d8f323d3c2c2f0733364ee4ea55f551dd86ba0be2a76846210b60897fc')
_ensure_local_nvm() {
local NVM_DIR="${srcdir}/.nvm"
source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
nvm install "${_nodeversion}"
nvm use "${_nodeversion}"
}
+_get_project_dir() {
+ local d
+ while IFS= read -r d; do
+ find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
+ done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
+}
_set_build_env() {
- export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
- export ELECTRON_SKIP_BINARY_DOWNLOAD=1
- export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/v//g')"
- export HOME="${srcdir}/.electron-gyp"
- {
- export PNPM_LINK_WORKSPACE_PACKAGES=true
- export PNPM_FETCH_RETRY_MAXTIMEOUT=10000
- export PNPM_CACHE_DIR="${srcdir}/.pnpm_cache"
- export PNPM_STORE_DIR="${srcdir}/.pnpm_store"
- export PNPM_VIRTUAL_STORE_DIR="${srcdir}/.pnpm_store"
- export PNPM_SHAMEFULLY_HOIST=true
- export PNPM_VIRTUAL_STORE_DIR_MAX_LENGTH=80
- export PNPM_NODE_LINKER=hoisted
- export PNPM_NETWORK_CONCURRENCY=32
- }
- if [[ "$(curl -s ipinfo.io/country)" == *"CN"* ]]; then
- {
- export pnpm_config_registry="https://registry.npmmirror.com"
- export npm_config_registry="https://registry.npmmirror.com"
- export NPM_CONFIG_ELECTRON_MIRROR="https://registry.npmmirror.com/-/binary/electron/"
- export NPM_CONFIG_ELECTRON_BUILDER_BINARIES_MIRROR="https://registry.npmmirror.com/-/binary/electron-builder-binaries/"
- export NODEJS_ORG_MIRROR="https://npmmirror.com/mirrors/node"
- }
- fi
+ export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
+ export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
+ export ELECTRON_SKIP_BINARY_DOWNLOAD=1
+ export ELECTRON_BUILDER_OFFLINE=true
+ export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
+ export HOME="${srcdir}/.home"
+ export XDG_CACHE_HOME="${HOME}/.cache"
+ export XDG_CONFIG_HOME="${HOME}/.config"
+ export XDG_DATA_HOME="${HOME}/.local/share"
+ export XDG_STATE_HOME="${HOME}/.local/state"
+ export PNPM_HOME="${HOME}/.pnpm/bin"
+ export pnpm_config_cache_dir="${HOME}/.pnpm_cache"
+ export pnpm_config_store_dir="${HOME}/.pnpm_store"
+ export pnpm_config_global_dir="${HOME}/.pnpm/global"
+ export pnpm_config_state_dir="${HOME}/.pnpm/state"
+ export pnpm_config_node_linker=hoisted
+ export pnpm_config_minimum_release_age=0
+ export pnpm_config_update_notifier=false
+ export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
+ export COREPACK_HOME="${HOME}/.corepack"
+ mkdir -p "${HOME}" "${PNPM_HOME}" "${pnpm_config_cache_dir}" "${pnpm_config_store_dir}" "${pnpm_config_global_dir}" "${pnpm_config_state_dir}" "${COREPACK_HOME}"
+ export PATH="${PNPM_HOME}:${PATH}"
+ local _pnpmver=""
+ local _pkgjson="$(_get_project_dir)/package.json"
+ if [ -f "${_pkgjson}" ]; then
+ _pnpmver="$(grep -o '"packageManager"[^,]*' "${_pkgjson}" 2>/dev/null | grep -oE 'pnpm@[^"+]+' | head -n1 | sed 's/^pnpm@//')"
+ if [ -z "${_pnpmver}" ]; then
+ _pnpmver="$(grep -oE '"pnpm"[[:space:]]*:[[:space:]]*"[^"]+"' "${_pkgjson}" 2>/dev/null | grep -oE '[0-9][0-9.]*' | head -n1)"
+ fi
+ fi
+ if [ -n "${_pnpmver}" ]; then
+ npm install -g "pnpm@${_pnpmver}" --prefix "${HOME}/.pnpm" \
+ --registry "${COREPACK_NPM_REGISTRY}"
+ fi
}
_get_app_dir() {
- find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1
+ find "${srcdir}" -type f -name "resources.pak" -print 2>/dev/null | while read f; do [ -d "${f%/*}/resources" ] && echo "${f%/*}" && break; done
}
_get_electron_version() {
- _elec_ver=$(find "${srcdir}" -maxdepth 5 -name "package.json" ! -path "*/node_modules/*" \
- -exec grep -l '"electron"' {} + | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null | head -1)
- [[ -z "${_elec_ver}" ]] && return 1
- echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
+ _elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
+ | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
+ | grep -v '^$' | sed 's/^[^0-9]*//' | head -1)
+ [[ -z "${_elec_ver}" ]] && return 1
+ echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
}
prepare() {
- cd "${srcdir}/${_pkgname}-${pkgver}"
+ cd "$(_get_project_dir)"
_get_electron_version
sed -i -e "
s/@electronversion@/${_electronversion}/g
@@ -89,32 +105,41 @@
--categories="Utility" \
--name="${_pkgname}" \
--exec="${pkgname} %U"
+ _ensure_local_nvm
_set_build_env
- _ensure_local_nvm
- sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g" package.json
- sed -i "s/set this to true or false/true/g" pnpm-workspace.yaml
- sed -i "/vue-demi/a\ - msw" pnpm-workspace.yaml
- NODE_ENV=development pnpm install
+ jq --arg ver "${SYSTEM_ELECTRON_VERSION}" '.devDependencies.electron = $ver' package.json > package.json.tmp && mv package.json.tmp package.json
+ rm -rf pnpm-lock.yaml
+ export NODE_ENV=development
+ pnpm install
}
build() {
- cd "${srcdir}/${_pkgname}-${pkgver}"
+ cd "$(_get_project_dir)"
+ _ensure_local_nvm
_set_build_env
- _ensure_local_nvm
- NODE_ENV=development pnpm run build
- NODE_ENV=production pnpm -c exec "electron-builder --linux dir -c.electronDist=${ELECTRON_DIST}"
+ export NODE_ENV=development
+ pnpm run build
+ pnpm -c exec "electron-builder --linux dir -c.electronDist=${ELECTRON_DIST}"
+ local _app_dir="$(_get_app_dir)"
+ rm -rf "${_app_dir}/resources/default_app.asar"
+ case "${CARCH}" in
+ aarch64) _archrem=x64 ;;
+ x86_64) _archrem=arm ;;
+ esac
+ find "${_app_dir}/resources/app.asar.unpacked" -type d \
+ \( -name "darwin*" -o -name "win32*" -o -name "*${_archrem}"* \) \
+ -exec rm -rf {} +
}
package() {
install -Dm755 "${srcdir}/${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
install -Dm755 -d "${pkgdir}/usr/lib/${pkgname}"
- local _app_dir=$(_get_app_dir)
- cp -a "${_app_dir}/resources/". "${pkgdir}/usr/lib/${pkgname}/"
- rm -rf "${pkgdir}/usr/lib/${pkgname}/default_app.asar"
+ local _app_dir="$(_get_app_dir)"
+ cp -a "${_app_dir}/resources/." "${pkgdir}/usr/lib/${pkgname}/"
+ local _src="$(_get_project_dir)"
_icon_sizes=(256x256 512x512)
for _icons in "${_icon_sizes[@]}";do
- install -Dm644 "${srcdir}/${_pkgname}-${pkgver}/build/icons/${_icons}.png" \
+ install -Dm644 "${_src}/build/icons/${_icons}.png" \
"${pkgdir}/usr/share/icons/hicolor/${_icons}/apps/${pkgname}.png"
done
- install -Dm644 "${srcdir}/${_pkgname}-${pkgver}/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
- install -Dm644 "${srcdir}/${_pkgname}-${pkgver}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
+ install -Dm644 "${_src}/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
+ install -Dm644 "${_src}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
}
-

Scan history

Scanned at (UTC)SeverityRules
2026-10-07 14:05:47 Low 1
2026-08-18 03:38:23 Clean 0
2026-07-13 05:40:50 Clean 0
2026-07-02 02:43:37 Clean 0
2026-06-18 16:11:54 Clean 0

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion