picgo-git

LOW
maintainer zxp19821005 0 votes scanned 2026-10-07 14:05:47.471701
View on AUR
Why flagged

The package builds from the project's own Git repository and uses pnpm to install dependencies declared in the project's package.json; the variable-named package install refers to the project's own pnpm version, not an untrusted external package.

Triggered rules

Low AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it LOW (confidence 95%): The package builds from the project's own Git repository and uses pnpm to install dependencies declared in the project's package.json; the variable-named package install refers to the project's own pnpm version, not an untrusted external package.

  • PKGBUILD:83 npm install -g "pnpm@${_pnpmver}" --prefix "${HOME}/.pnpm" \

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2pkgname=picgo-git
3_pkgname=PicGo
4pkgver=3.0.3.r4.gb6ad099
5_electronversion=38
6_nodeversion=22
7pkgrel=1
8pkgdesc="🚀 The Ultimate Image Uploader for Efficient Creators. Supports Obsidian, Typora, VS Code etc. and 60+ image hosting services (S3, GitHub, Cloudflare R2, Imgur, Aliyun OSS...). Paste, upload, done."
9arch=('any')
10url="https://picgo.app/"
11_ghurl="https://github.com/Molunerfinn/PicGo"
12license=('MIT')
13depends=(
14 "electron${_electronversion}"
15)
16makedepends=(
17 'npm'
18 'git'
19 'nvm'
20 'gendesk'
21 'pnpm'
22 'jq'
23)
24source=(
25 "${pkgname//-/.}::git+${_ghurl}.git"
26 "${pkgname%-git}.sh"
27)
28sha256sums=('SKIP'
29 'bd5358d8f323d3c2c2f0733364ee4ea55f551dd86ba0be2a76846210b60897fc')
30_get_project_dir() {
31 local d
32 while IFS= read -r d; do
33 find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
34 done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
35}
36pkgver() {
37 cd "$(_get_project_dir)"
38 set -o pipefail
39 git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
40 printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
41}
42_get_app_dir() {
43 find "${srcdir}" -type f -name "resources.pak" -print 2>/dev/null | while read f; do [ -d "${f%/*}/resources" ] && echo "${f%/*}" && break; done
44}
45_ensure_local_nvm() {
46 local NVM_DIR="${srcdir}/.nvm"
47 source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
48 nvm install "${_nodeversion}"
49 nvm use "${_nodeversion}"
50}
51_set_build_env() {
52 export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
53 export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
54 export ELECTRON_SKIP_BINARY_DOWNLOAD=1
55 export ELECTRON_BUILDER_OFFLINE=true
56 export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
57 export HOME="${srcdir}/.home"
58 export XDG_CACHE_HOME="${HOME}/.cache"
59 export XDG_CONFIG_HOME="${HOME}/.config"
60 export XDG_DATA_HOME="${HOME}/.local/share"
61 export XDG_STATE_HOME="${HOME}/.local/state"
62 export PNPM_HOME="${HOME}/.pnpm/bin"
63 export pnpm_config_cache_dir="${HOME}/.pnpm_cache"
64 export pnpm_config_store_dir="${HOME}/.pnpm_store"
65 export pnpm_config_global_dir="${HOME}/.pnpm/global"
66 export pnpm_config_state_dir="${HOME}/.pnpm/state"
67 export pnpm_config_node_linker=hoisted
68 export pnpm_config_minimum_release_age=0
69 export pnpm_config_update_notifier=false
70 export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
71 export COREPACK_HOME="${HOME}/.corepack"
72 mkdir -p "${HOME}" "${PNPM_HOME}" "${pnpm_config_cache_dir}" "${pnpm_config_store_dir}" "${pnpm_config_global_dir}" "${pnpm_config_state_dir}" "${COREPACK_HOME}"
73 export PATH="${PNPM_HOME}:${PATH}"
74 local _pnpmver=""
75 local _pkgjson="$(_get_project_dir)/package.json"
76 if [ -f "${_pkgjson}" ]; then
77 _pnpmver="$(grep -o '"packageManager"[^,]*' "${_pkgjson}" 2>/dev/null | grep -oE 'pnpm@[^"+]+' | head -n1 | sed 's/^pnpm@//')"
78 if [ -z "${_pnpmver}" ]; then
79 _pnpmver="$(grep -oE '"pnpm"[[:space:]]*:[[:space:]]*"[^"]+"' "${_pkgjson}" 2>/dev/null | grep -oE '[0-9][0-9.]*' | head -n1)"
80 fi
81 fi
82 if [ -n "${_pnpmver}" ]; then
83 npm install -g "pnpm@${_pnpmver}" --prefix "${HOME}/.pnpm" \
84 --registry "${COREPACK_NPM_REGISTRY}"
85 fi
86}
87_get_electron_version() {
88 _elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
89 | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
90 | grep -v '^$' | sed 's/^[^0-9]*//' | head -1)
91 [[ -z "${_elec_ver}" ]] && return 1
92 echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
93}
94prepare() {
95 cd "$(_get_project_dir)"
96 _get_electron_version
97 sed -i -e "
98 s/@electronversion@/${_electronversion}/g
99 s/@appname@/${pkgname%-git}/g
100 s/@runname@/app.asar/g
101 s/@cfgdirname@/${_pkgname}/g
102 " "${srcdir}/${pkgname%-git}.sh"
103 gendesk -f -n -q \
104 --pkgname="${pkgname%-git}" \
105 --pkgdesc="${pkgdesc}" \
106 --categories="Utility" \
107 --name="${_pkgname}" \
108 --exec="${pkgname%-git} %U"
109 _ensure_local_nvm
110 _set_build_env
111 jq --arg ver "${SYSTEM_ELECTRON_VERSION}" '.devDependencies.electron = $ver' package.json > package.json.tmp && mv package.json.tmp package.json
112 find src -type f -exec sed -i "s/process.resourcesPath/\'\/usr\/lib\/${pkgname%-git}\'/g" {} +
113 rm -rf pnpm-lock.yaml
114 export NODE_ENV=development
115 pnpm install
116}
117build() {
118 cd "$(_get_project_dir)"
119 _ensure_local_nvm
120 _set_build_env
121 export NODE_ENV=production
122 pnpm run build
123 pnpm -c exec "electron-builder --linux dir -c.electronDist=${ELECTRON_DIST} --config electron-builder.config.ts"
124 local _app_dir="$(_get_app_dir)"
125 rm -rf "${_app_dir}/resources/default_app.asar"
126 case "${CARCH}" in
127 aarch64) _archrem=x64 ;;
128 x86_64) _archrem=arm ;;
129 esac
130 find "${_app_dir}/resources/app.asar.unpacked" -type d \
131 \( -name "darwin*" -o -name "win32*" -o -name "*${_archrem}"* \) \
132 -exec rm -rf {} +
133}
134package() {
135 install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
136 install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-git}"
137 local _app_dir="$(_get_app_dir)"
138 cp -a "${_app_dir}/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"
139 local _src="$(_get_project_dir)"
140 install -Dm644 "${_src}/public/logo.png" "${pkgdir}/usr/share/pixmaps/${pkgname%-git}.png"
141 install -Dm644 "${_src}/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
142 install -Dm644 "${_src}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
143}
144

Changes since previous scan

--- PKGBUILD @ 2026-09-11 01:21
+++ PKGBUILD @ 2026-10-07 14:05
@@ -1,7 +1,7 @@
# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
pkgname=picgo-git
_pkgname=PicGo
-pkgver=3.0.2.r6.gd554307
+pkgver=3.0.3.r4.gb6ad099
_electronversion=38
_nodeversion=22
pkgrel=1
@@ -19,7 +19,6 @@
'nvm'
'gendesk'
'pnpm'
- 'curl'
'jq'
)
source=(
@@ -27,15 +26,21 @@
"${pkgname%-git}.sh"
)
sha256sums=('SKIP'
- 'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
+ 'bd5358d8f323d3c2c2f0733364ee4ea55f551dd86ba0be2a76846210b60897fc')
+_get_project_dir() {
+ local d
+ while IFS= read -r d; do
+ find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
+ done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
+}
pkgver() {
- cd "${srcdir}/${pkgname//-/.}"
+ cd "$(_get_project_dir)"
set -o pipefail
git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
}
_get_app_dir() {
- find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1
+ find "${srcdir}" -type f -name "resources.pak" -print 2>/dev/null | while read f; do [ -d "${f%/*}/resources" ] && echo "${f%/*}" && break; done
}
_ensure_local_nvm() {
local NVM_DIR="${srcdir}/.nvm"
@@ -47,31 +52,47 @@
export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
export ELECTRON_SKIP_BINARY_DOWNLOAD=1
- _ev="$(electron${_electronversion} -v)"
- export SYSTEM_ELECTRON_VERSION="${_ev#v}"
- export HOME="${srcdir}/.electron-gyp"
- export XDG_CACHE_HOME="${srcdir}/.cache"
- export XDG_CONFIG_HOME="${srcdir}/.config"
- export XDG_DATA_HOME="${srcdir}/.local/share"
- export npm_config_cache="${srcdir}/.npm_cache"
- export npm_config_devdir="${srcdir}/.node-gyp"
- export npm_config_maxsockets=32
- export npm_config_platform=linux
- export npm_config_arch="${CARCH}"
- export npm_config_audit=false
- export npm_config_fund=false
- export npm_config_progress=false
- export NODE_OPTIONS="--max-old-space-size=4096"
- export npm_config_node_options="--max-old-space-size=4096"
+ export ELECTRON_BUILDER_OFFLINE=true
+ export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
+ export HOME="${srcdir}/.home"
+ export XDG_CACHE_HOME="${HOME}/.cache"
+ export XDG_CONFIG_HOME="${HOME}/.config"
+ export XDG_DATA_HOME="${HOME}/.local/share"
+ export XDG_STATE_HOME="${HOME}/.local/state"
+ export PNPM_HOME="${HOME}/.pnpm/bin"
+ export pnpm_config_cache_dir="${HOME}/.pnpm_cache"
+ export pnpm_config_store_dir="${HOME}/.pnpm_store"
+ export pnpm_config_global_dir="${HOME}/.pnpm/global"
+ export pnpm_config_state_dir="${HOME}/.pnpm/state"
+ export pnpm_config_node_linker=hoisted
+ export pnpm_config_minimum_release_age=0
+ export pnpm_config_update_notifier=false
+ export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
+ export COREPACK_HOME="${HOME}/.corepack"
+ mkdir -p "${HOME}" "${PNPM_HOME}" "${pnpm_config_cache_dir}" "${pnpm_config_store_dir}" "${pnpm_config_global_dir}" "${pnpm_config_state_dir}" "${COREPACK_HOME}"
+ export PATH="${PNPM_HOME}:${PATH}"
+ local _pnpmver=""
+ local _pkgjson="$(_get_project_dir)/package.json"
+ if [ -f "${_pkgjson}" ]; then
+ _pnpmver="$(grep -o '"packageManager"[^,]*' "${_pkgjson}" 2>/dev/null | grep -oE 'pnpm@[^"+]+' | head -n1 | sed 's/^pnpm@//')"
+ if [ -z "${_pnpmver}" ]; then
+ _pnpmver="$(grep -oE '"pnpm"[[:space:]]*:[[:space:]]*"[^"]+"' "${_pkgjson}" 2>/dev/null | grep -oE '[0-9][0-9.]*' | head -n1)"
+ fi
+ fi
+ if [ -n "${_pnpmver}" ]; then
+ npm install -g "pnpm@${_pnpmver}" --prefix "${HOME}/.pnpm" \
+ --registry "${COREPACK_NPM_REGISTRY}"
+ fi
}
_get_electron_version() {
- _elec_ver=$(find "${srcdir}" -maxdepth 5 -name "package.json" ! -path "*/node_modules/*" \
- -exec grep -l '"electron"' {} + | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null | head -1)
- [[ -z "${_elec_ver}" ]] && return 1
- echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
+ _elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
+ | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
+ | grep -v '^$' | sed 's/^[^0-9]*//' | head -1)
+ [[ -z "${_elec_ver}" ]] && return 1
+ echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
}
prepare() {
- cd "${srcdir}/${pkgname//-/.}"
+ cd "$(_get_project_dir)"
_get_electron_version
sed -i -e "
s/@electronversion@/${_electronversion}/g
@@ -85,26 +106,39 @@
--categories="Utility" \
--name="${_pkgname}" \
--exec="${pkgname%-git} %U"
+ _ensure_local_nvm
_set_build_env
- _ensure_local_nvm
- sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g" package.json
+ jq --arg ver "${SYSTEM_ELECTRON_VERSION}" '.devDependencies.electron = $ver' package.json > package.json.tmp && mv package.json.tmp package.json
find src -type f -exec sed -i "s/process.resourcesPath/\'\/usr\/lib\/${pkgname%-git}\'/g" {} +
- NODE_ENV=development npm install --legacy-peer-deps
+ rm -rf pnpm-lock.yaml
+ export NODE_ENV=development
+ pnpm install
}
build() {
- cd "${srcdir}/${pkgname//-/.}"
+ cd "$(_get_project_dir)"
+ _ensure_local_nvm
_set_build_env
- _ensure_local_nvm
- NODE_ENV=production npm run build
- NODE_ENV=production npm exec -c "electron-builder --linux dir -c.electronDist=${ELECTRON_DIST} --config electron-builder.config.ts"
+ export NODE_ENV=production
+ pnpm run build
+ pnpm -c exec "electron-builder --linux dir -c.electronDist=${ELECTRON_DIST} --config electron-builder.config.ts"
+ local _app_dir="$(_get_app_dir)"
+ rm -rf "${_app_dir}/resources/default_app.asar"
+ case "${CARCH}" in
+ aarch64) _archrem=x64 ;;
+ x86_64) _archrem=arm ;;
+ esac
+ find "${_app_dir}/resources/app.asar.unpacked" -type d \
+ \( -name "darwin*" -o -name "win32*" -o -name "*${_archrem}"* \) \
+ -exec rm -rf {} +
}
package() {
install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-git}"
- local _app_dir=$(_get_app_dir)
- cp -a "${_app_dir}/resources/"* "${pkgdir}/usr/lib/${pkgname%-git}/"
- rm -rf "${pkgdir}/usr/lib/${pkgname%-git}/default_app.asar"
- install -Dm644 "${srcdir}/${pkgname//-/.}/public/logo.png" "${pkgdir}/usr/share/pixmaps/${pkgname%-git}.png"
- install -Dm644 "${srcdir}/${pkgname//-/.}/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
- install -Dm644 "${srcdir}/${pkgname//-/.}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
+ local _app_dir="$(_get_app_dir)"
+ cp -a "${_app_dir}/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"
+ local _src="$(_get_project_dir)"
+ install -Dm644 "${_src}/public/logo.png" "${pkgdir}/usr/share/pixmaps/${pkgname%-git}.png"
+ install -Dm644 "${_src}/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
+ install -Dm644 "${_src}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
}
+

Scan history

Scanned at (UTC)SeverityRules
2026-10-07 14:05:47 Low 1
2026-09-11 01:21:31 Clean 0
2026-07-02 02:43:37 Clean 0
2026-06-18 16:11:54 Clean 0

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion