plein-git

LOW
maintainer zxp19821005 0 votes scanned 2026-11-06 08:11:27.004022
View on AUR
Why flagged

The package builds from a legitimate GitHub source, uses standard build tools, and installs only project files; the flagged variable-based package install refers to pnpm, a known dependency manager, and the low votes/recent upload are quality concerns but not security risks.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from a legitimate GitHub source, uses standard build tools, and installs only project files; the flagged variable-based package install refers to pnpm, a known dependency manager, and the low votes/recent upload are quality concerns but not security risks.

  • PKGBUILD:111 npm install -g "pnpm@${_ver}" --prefix "${HOME}/.pnpm" \

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2pkgname=plein-git
3_pkgname=Plein
4pkgver=0.10.4.r29.g0ed5702
5_electronversion=45
6_nodeversion=26
7pkgrel=1
8pkgdesc=" Start from a single idea, lay out the script, storyboard, shots and voiceover on the canvas, and finish your work together with an AI agent."
9arch=('any')
10url="https://plein.ikuyu.com"
11_ghurl="https://github.com/hoobnn/plein"
12license=('AGPL-3.0-only')
13conflicts=("${pkgname%-git}")
14provides=("${pkgname%-git}=${pkgver%.r*}")
15depends=(
16 "electron${_electronversion}"
17 'ffmpeg'
18 'nodejs'
19 'libass'
20)
21makedepends=(
22 'npm'
23 'git'
24 'nvm'
25 'gendesk'
26 'pnpm'
27 'jq'
28)
29source=(
30 "${pkgname//-/.}::git+${_ghurl}.git"
31 "${pkgname%-git}.js"
32 "${pkgname%-git}.sh"
33)
34options=(
35 '!strip'
36 '!emptydirs'
37)
38sha256sums=('SKIP'
39 '562897be8a17076176f8d985c0d7bc1c685f2e7c9b3a932339ce015963243627'
40 'ace275e253744ca62d2572776df26b947f3c89616239985003126db635fc300e')
41_get_project_dir() {
42 local d
43 while IFS= read -r d; do
44 find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
45 done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
46}
47pkgver() {
48 cd "$(_get_project_dir)"
49 set -o pipefail
50 git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
51 printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
52}
53_ensure_local_nvm() {
54 local NVM_DIR="${srcdir}/.nvm"
55 source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
56 nvm install "${_nodeversion}"
57 nvm use "${_nodeversion}"
58}
59_get_app_dir() {
60 find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -printf '%h\n' 2>/dev/null \
61 | while read -r d; do [[ -d "${d}/resources" ]] && { echo "$d"; return 0; }; done
62}
63_get_electron_version() {
64 local _v
65 _v=$(jq -r '.. | (.electron? // empty) | strings' "$(_get_project_dir)/package.json" 2>/dev/null | head -1)
66 [[ -z "$_v" ]] && _v=$(grep -oE 'electron@[0-9.]+' "$(_get_project_dir)/pnpm-lock.yaml" 2>/dev/null | head -1 | sed 's/^electron@//')
67 [[ -z "$_v" ]] && _v=$(grep -oE 'electron@npm:[0-9.]+' "$(_get_project_dir)/yarn.lock" 2>/dev/null | head -1 | sed 's/^electron@npm://')
68 [[ -z "$_v" ]] && _v=$(jq -r '.packages["node_modules/electron"].version // empty' "$(_get_project_dir)/package-lock.json" 2>/dev/null | head -1)
69 [[ -z "$_v" ]] && _v=$(grep -oE 'electron: ?\[?"?npm:?[0-9.]+' "$(_get_project_dir)/bun.lock" 2>/dev/null | grep -oE '[0-9.]+' | head -1)
70 [[ -z "$_v" ]] && return 1
71 _v="$(printf '%s' "$_v" | sed 's/^[^0-9]*//')"
72 [[ "$_v" =~ ^[0-9] ]] || return 1
73 _v="${_v%%.*}"
74 (( ${_v} == _electronversion )) && echo -e "\033[1;32mElectron version: ${_v}\033[0m" || echo -e "\033[1;31mElectron version: ${_v} (expected ${_electronversion})\033[0m"
75}
76_set_electron_build_env() {
77 export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
78 export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
79 export ELECTRON_SKIP_BINARY_DOWNLOAD=1
80 export ELECTRON_BUILDER_OFFLINE=true
81 export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
82}
83_set_pnpm_build_env() {
84 export HOME="${srcdir}/.home"
85 export XDG_CACHE_HOME="${HOME}/.cache"
86 export XDG_CONFIG_HOME="${HOME}/.config"
87 export XDG_DATA_HOME="${HOME}/.local/share"
88 export XDG_STATE_HOME="${HOME}/.local/state"
89 export PNPM_HOME="${HOME}/.pnpm/bin"
90 export pnpm_config_cache_dir="${HOME}/.pnpm_cache"
91 export pnpm_config_store_dir="${HOME}/.pnpm_store"
92 export pnpm_config_global_dir="${HOME}/.pnpm/global"
93 export pnpm_config_state_dir="${HOME}/.pnpm/state"
94 export pnpm_config_node_linker=hoisted
95 export pnpm_config_minimum_release_age=0
96 export pnpm_config_update_notifier=false
97 export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
98 export COREPACK_HOME="${HOME}/.corepack"
99 mkdir -p "${HOME}" "${PNPM_HOME}" "${pnpm_config_cache_dir}" "${pnpm_config_store_dir}" "${pnpm_config_global_dir}" "${pnpm_config_state_dir}" "${COREPACK_HOME}"
100 export PATH="${PNPM_HOME}:${PATH}"
101 local _detected=""
102 local _pkgjson="$(_get_project_dir)/package.json"
103 if [ -f "${_pkgjson}" ]; then
104 _detected="$(grep -o '"packageManager"[^,]*' "${_pkgjson}" 2>/dev/null | grep -oE 'pnpm@[^"+]+' | head -n1 | sed 's/^pnpm@//')"
105 if [ -z "${_detected}" ]; then
106 _detected="$(grep -oE '"pnpm"[[:space:]]*:[[:space:]]*"[^"]+"' "${_pkgjson}" 2>/dev/null | grep -oE '[0-9][0-9.]*' | head -n1)"
107 fi
108 fi
109 local _ver="${_pnpmver:-${_detected}}"
110 if [ -n "${_ver}" ]; then
111 npm install -g "pnpm@${_ver}" --prefix "${HOME}/.pnpm" \
112 --registry "${COREPACK_NPM_REGISTRY}"
113 fi
114}
115prepare() {
116 cd "$(_get_project_dir)"
117 _get_electron_version
118 sed -i -e "
119 s/@electronversion@/${_electronversion}/g
120 s/@appname@/${pkgname%-git}/g
121 " "${srcdir}/${pkgname%-git}.sh" "${srcdir}/${pkgname%-git}.js"
122 gendesk -q -f -n \
123 --pkgname="${pkgname%-git}" \
124 --pkgdesc="${pkgdesc}" \
125 --categories="AudioVideo" \
126 --name="${_pkgname}" \
127 --exec="${pkgname%-git} %U"
128 _ensure_local_nvm
129 _set_electron_build_env
130 _set_pnpm_build_env
131 jq --arg ver "${SYSTEM_ELECTRON_VERSION}" '.devDependencies.electron = $ver' package.json > package.json.tmp && mv package.json.tmp package.json
132 export NODE_ENV=development
133 pnpm install
134}
135build() {
136 cd "$(_get_project_dir)"
137 _ensure_local_nvm
138 _set_electron_build_env
139 _set_pnpm_build_env
140 export NODE_ENV=production
141 export PLEIN_VERSION="${pkgver%.r*}"
142 pnpm --filter @plein/web build
143 cd apps/desktop
144 pnpm run stage:server
145 pnpm -c exec "electron-builder --linux dir -c.electronDist=${ELECTRON_DIST} --config electron-builder.config.mjs"
146 rm -rf "$(_get_app_dir)/resources/default_app.asar"
147 install -Dm755 -d "$(_get_app_dir)/resources/ffmpeg"
148 ln -sf "/usr/bin/ffmpeg" "$(_get_app_dir)/resources/ffmpeg/ffmpeg"
149 ln -sf "/usr/bin/ffprobe" "$(_get_app_dir)/resources/ffmpeg/ffprobe"
150}
151package() {
152 install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
153 install -Dm644 "${srcdir}/${pkgname%-git}.js" -t "${pkgdir}/usr/lib/${pkgname%-git}"
154 cp -a "$(_get_app_dir)/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"
155 install -Dm644 "$(_get_project_dir)/site/icon.png" "${pkgdir}/usr/share/icons/hicolor/256x256/apps/${pkgname%-git}.png"
156 install -Dm644 "$(_get_project_dir)/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
157 install -Dm644 "$(_get_project_dir)/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
158}
159

Scan history

Scanned at (UTC)SeverityRules
2026-11-06 08:11:27 Low 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion