podman-desktop-git

LOW
maintainer zxp19821005 0 votes scanned 2026-11-01 00:21:48.120785
View on AUR
Why flagged

The package builds from a legitimate project source (GitHub) and uses standard development tools; the flagged npm/pnpm install is part of the project's own build process with no evidence of remote code execution or malicious payloads.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The package builds from a legitimate project source (GitHub) and uses standard development tools; the flagged npm/pnpm install is part of the project's own build process with no evidence of remote code execution or malicious payloads.

  • PKGBUILD:110 npm install -g "pnpm@${_pnpmver}" --prefix "${HOME}/.pnpm" \
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

  • PKGBUILD:133 pnpm add -D -w node-addon-api

PKGBUILD

2 offending line(s) highlighted
1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2pkgname=podman-desktop-git
3_pkgname='Podman Desktop'
4_flatpakname="io.podman_desktop.${_pkgname// /}"
5pkgver=r11608.5f4a873
6_electronversion=44
7_nodeversion=24
8pkgrel=1
9pkgdesc="A graphical tool for developing on containers and Kubernetes."
10arch=('any')
11url="https://podman-desktop.io/"
12_ghurl="https://github.com/podman-desktop/podman-desktop"
13license=('Apache-2.0')
14conflicts=("${pkgname%-git}")
15provides=("${pkgname%-git}=${pkgver%.r*}")
16depends=(
17 "electron${_electronversion}"
18 'docker-compose'
19 'podman'
20 'docker'
21)
22makedepends=(
23 'npm'
24 'nvm'
25 'git'
26 'pnpm'
27 'jq'
28)
29optdepends=(
30 "crc: crc plugin"
31 "lima: lima plugin"
32 "xdg-utils: open URLs with desktop's default (xdg-email, xdg-open)"
33 "trash-cli: file deletion support (trash-put)"
34 "libappindicator-gtk3: StatusNotifierItem support"
35 "pipewire: WebRTC desktop sharing under Wayland"
36 "qt5-base: enable Qt5 with --enable-features=AllowQt"
37)
38options=(
39 '!strip'
40 '!emptydirs'
41)
42source=(
43 "${pkgname%-git}.git::git+${_ghurl}"
44 "${pkgname%-git}.sh"
45)
46sha256sums=('SKIP'
47 'dfcd6603d29c7b8d88e019b517a2e5c1a7b5ab905a0961a8b81adfa508b258b8')
48_get_project_dir() {
49 local d
50 while IFS= read -r d; do
51 find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
52 done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
53}
54pkgver() {
55 cd "$(_get_project_dir)"
56 set -o pipefail
57 git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
58 printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
59}
60_ensure_local_nvm() {
61 local NVM_DIR="${srcdir}/.nvm"
62 source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
63 nvm install "${_nodeversion}"
64 nvm use "${_nodeversion}"
65}
66_get_app_dir() {
67 find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -printf '%h\n' 2>/dev/null \
68 | while read -r d; do [[ -d "${d}/resources" ]] && { echo "$d"; return 0; }; done
69}
70_get_electron_version() {
71 _elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
72 | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
73 | grep -oE '[0-9]+' | head -1)
74 [[ -z "${_elec_ver}" ]] && return 1
75 (( _elec_ver == _electronversion )) && c=32 || c=31
76 echo -e "Electron version: \033[1;${c}m${_elec_ver}$([[ $c -eq 31 ]] && echo " (expected ${_electronversion})")\033[0m"
77}
78_set_build_env() {
79 export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
80 export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
81 export ELECTRON_SKIP_BINARY_DOWNLOAD=1
82 export ELECTRON_BUILDER_OFFLINE=true
83 export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
84 export HOME="${srcdir}/.home"
85 export XDG_CACHE_HOME="${HOME}/.cache"
86 export XDG_CONFIG_HOME="${HOME}/.config"
87 export XDG_DATA_HOME="${HOME}/.local/share"
88 export XDG_STATE_HOME="${HOME}/.local/state"
89 export PNPM_HOME="${HOME}/.pnpm/bin"
90 export pnpm_config_cache_dir="${HOME}/.pnpm_cache"
91 export pnpm_config_store_dir="${HOME}/.pnpm_store"
92 export pnpm_config_global_dir="${HOME}/.pnpm/global"
93 export pnpm_config_state_dir="${HOME}/.pnpm/state"
94 export pnpm_config_node_linker=hoisted
95 export pnpm_config_minimum_release_age=0
96 export pnpm_config_update_notifier=false
97 export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
98 export COREPACK_HOME="${HOME}/.corepack"
99 mkdir -p "${HOME}" "${PNPM_HOME}" "${pnpm_config_cache_dir}" "${pnpm_config_store_dir}" "${pnpm_config_global_dir}" "${pnpm_config_state_dir}" "${COREPACK_HOME}"
100 export PATH="${PNPM_HOME}:${PATH}"
101 local _pnpmver=""
102 local _pkgjson="$(_get_project_dir)/package.json"
103 if [ -f "${_pkgjson}" ]; then
104 _pnpmver="$(grep -o '"packageManager"[^,]*' "${_pkgjson}" 2>/dev/null | grep -oE 'pnpm@[^"+]+' | head -n1 | sed 's/^pnpm@//')"
105 if [ -z "${_pnpmver}" ]; then
106 _pnpmver="$(grep -oE '"pnpm"[[:space:]]*:[[:space:]]*"[^"]+"' "${_pkgjson}" 2>/dev/null | grep -oE '[0-9][0-9.]*' | head -n1)"
107 fi
108 fi
109 if [ -n "${_pnpmver}" ]; then
110 npm install -g "pnpm@${_pnpmver}" --prefix "${HOME}/.pnpm" \
111 --registry "${COREPACK_NPM_REGISTRY}"
112 fi
113}
114prepare() {
115 cd "$(_get_project_dir)"
116 sed -i -e "
117 s/@electronversion@/${_electronversion}/g
118 s/@appname@/${pkgname%-git}/g
119 " "${srcdir}/${pkgname%-git}.sh"
120 _get_electron_version
121 find packages -type f -exec sed -i "s/process.resourcesPath/\'\/usr\/lib\/${pkgname%-git}\'/" {} +
122 sed -i -e "
123 s/run.sh/${pkgname%-git}/g
124 s/${_flatpakname}/${pkgname%-git}/g
125 /X-Flatpak/d
126 " .flatpak.desktop
127 sed -i "s/${_flatpakname}/${pkgname%-git}/" .flatpak-appdata.xml
128 sed -i "s/\'flatpak\', \'tar.gz\'/\'dir\'/" .electron-builder.config.cjs
129 jq --arg ver "${SYSTEM_ELECTRON_VERSION}" '.devDependencies.electron = $ver' package.json > package.json.tmp && mv package.json.tmp package.json
130 _ensure_local_nvm
131 _set_build_env
132 export NODE_ENV=development
133 pnpm add -D -w node-addon-api
134 pnpm install --no-lockfile
135}
136build() {
137 cd "$(_get_project_dir)"
138 _ensure_local_nvm
139 _set_build_env
140 export NODE_ENV=production
141 for _target in main preload preload-docker-extension preload-webview preload:types ui renderer extensions; do
142 pnpm run "build:${_target}"
143 done
144 pnpm -c exec "electron-builder build --linux dir -c.electronDist=${ELECTRON_DIST} --config .electron-builder.config.cjs --config.asar=false"
145}
146package() {
147 install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
148 install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-git}"
149 rm -rf "$(_get_app_dir)/resources/default_app.asar"
150 cp -a "$(_get_app_dir)/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"
151 install -Dm644 "$(_get_project_dir)/.flatpak.desktop" "${pkgdir}/usr/share/applications/${pkgname%-git}.desktop"
152 install -Dm644 "$(_get_project_dir)/buildResources/icon.png" "${pkgdir}/usr/share/icons/hicolor/512x512/apps/${pkgname%-git}.png"
153 install -Dm644 "$(_get_project_dir)/buildResources/icon.svg" "${pkgdir}/usr/share/icons/hicolor/scalable/apps/${pkgname%-git}.svg"
154 install -Dm644 "$(_get_project_dir)/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
155}
156

Changes since previous scan

--- PKGBUILD @ 2026-10-14 00:06
+++ PKGBUILD @ 2026-11-01 00:21
@@ -2,8 +2,8 @@
pkgname=podman-desktop-git
_pkgname='Podman Desktop'
_flatpakname="io.podman_desktop.${_pkgname// /}"
-pkgver=r11447.c4129c0
-_electronversion=42
+pkgver=r11608.5f4a873
+_electronversion=44
_nodeversion=24
pkgrel=1
pkgdesc="A graphical tool for developing on containers and Kubernetes."
@@ -23,7 +23,6 @@
'npm'
'nvm'
'git'
- 'curl'
'pnpm'
'jq'
)
@@ -45,33 +44,42 @@
"${pkgname%-git}.sh"
)
sha256sums=('SKIP'
- 'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
+ 'dfcd6603d29c7b8d88e019b517a2e5c1a7b5ab905a0961a8b81adfa508b258b8')
+_get_project_dir() {
+ local d
+ while IFS= read -r d; do
+ find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
+ done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
+}
pkgver() {
- cd "${srcdir}/${pkgname%-git}.git"
- set -o pipefail
- git fetch --tags
- git describe --long --abbrev=7 2>/dev/null | sed 's/\([^-]*-g\)/r\1/;s/-/./g' ||
- printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
+ cd "$(_get_project_dir)"
+ set -o pipefail
+ git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
+ printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
}
_ensure_local_nvm() {
- local NVM_DIR="${srcdir}/.nvm"
- source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
- nvm install "${_nodeversion}"
- nvm use "${_nodeversion}"
+ local NVM_DIR="${srcdir}/.nvm"
+ source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
+ nvm install "${_nodeversion}"
+ nvm use "${_nodeversion}"
}
_get_app_dir() {
- find "${srcdir}" -type d -name "node_modules" -prune -o -type f -name "resources.pak" -print0 | xargs -0 dirname | head -n 1
+ find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -printf '%h\n' 2>/dev/null \
+ | while read -r d; do [[ -d "${d}/resources" ]] && { echo "$d"; return 0; }; done
}
_get_electron_version() {
- _elec_ver=$(find "${srcdir}" -maxdepth 5 -name "package.json" ! -path "*/node_modules/*" \
- -exec grep -l '"electron"' {} + | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null | head -1)
- [[ -z "${_elec_ver}" ]] && return 1
- echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
+ _elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
+ | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
+ | grep -oE '[0-9]+' | head -1)
+ [[ -z "${_elec_ver}" ]] && return 1
+ (( _elec_ver == _electronversion )) && c=32 || c=31
+ echo -e "Electron version: \033[1;${c}m${_elec_ver}$([[ $c -eq 31 ]] && echo " (expected ${_electronversion})")\033[0m"
}
_set_build_env() {
export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
export ELECTRON_SKIP_BINARY_DOWNLOAD=1
+ export ELECTRON_BUILDER_OFFLINE=true
export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
export HOME="${srcdir}/.home"
export XDG_CACHE_HOME="${HOME}/.cache"
@@ -90,14 +98,24 @@
export COREPACK_HOME="${HOME}/.corepack"
mkdir -p "${HOME}" "${PNPM_HOME}" "${pnpm_config_cache_dir}" "${pnpm_config_store_dir}" "${pnpm_config_global_dir}" "${pnpm_config_state_dir}" "${COREPACK_HOME}"
export PATH="${PNPM_HOME}:${PATH}"
+ local _pnpmver=""
+ local _pkgjson="$(_get_project_dir)/package.json"
+ if [ -f "${_pkgjson}" ]; then
+ _pnpmver="$(grep -o '"packageManager"[^,]*' "${_pkgjson}" 2>/dev/null | grep -oE 'pnpm@[^"+]+' | head -n1 | sed 's/^pnpm@//')"
+ if [ -z "${_pnpmver}" ]; then
+ _pnpmver="$(grep -oE '"pnpm"[[:space:]]*:[[:space:]]*"[^"]+"' "${_pkgjson}" 2>/dev/null | grep -oE '[0-9][0-9.]*' | head -n1)"
+ fi
+ fi
+ if [ -n "${_pnpmver}" ]; then
+ npm install -g "pnpm@${_pnpmver}" --prefix "${HOME}/.pnpm" \
+ --registry "${COREPACK_NPM_REGISTRY}"
+ fi
}
prepare() {
- cd "${srcdir}/${pkgname%-git}.git"
+ cd "$(_get_project_dir)"
sed -i -e "
s/@electronversion@/${_electronversion}/g
s/@appname@/${pkgname%-git}/g
- s/@runname@/app/g
- s/@cfgdirname@/${_pkgname}/g
" "${srcdir}/${pkgname%-git}.sh"
_get_electron_version
find packages -type f -exec sed -i "s/process.resourcesPath/\'\/usr\/lib\/${pkgname%-git}\'/" {} +
@@ -108,7 +126,7 @@
" .flatpak.desktop
sed -i "s/${_flatpakname}/${pkgname%-git}/" .flatpak-appdata.xml
sed -i "s/\'flatpak\', \'tar.gz\'/\'dir\'/" .electron-builder.config.cjs
- sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/" package.json
+ jq --arg ver "${SYSTEM_ELECTRON_VERSION}" '.devDependencies.electron = $ver' package.json > package.json.tmp && mv package.json.tmp package.json
_ensure_local_nvm
_set_build_env
export NODE_ENV=development
@@ -116,7 +134,7 @@
pnpm install --no-lockfile
}
build() {
- cd "${srcdir}/${pkgname%-git}.git"
+ cd "$(_get_project_dir)"
_ensure_local_nvm
_set_build_env
export NODE_ENV=production
@@ -128,11 +146,11 @@
package() {
install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-git}"
- local _app_dir=$(_get_app_dir)
- cp -a "${_app_dir}/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"
- rm -rf "${pkgdir}/usr/lib/${pkgname%-git}/default_app.asar"
- install -Dm644 "${srcdir}/${pkgname%-git}.git/.flatpak.desktop" "${pkgdir}/usr/share/applications/${pkgname%-git}.desktop"
- install -Dm644 "${srcdir}/${pkgname%-git}.git/buildResources/icon.png" "${pkgdir}/usr/share/pixmaps/${pkgname%-git}.png"
- install -Dm644 "${srcdir}/${pkgname%-git}.git/buildResources/icon.svg" "${pkgdir}/usr/share/icons/hicolor/scalable/apps/${pkgname%-git}.svg"
- install -Dm644 "${srcdir}/${pkgname%-git}.git/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
+ rm -rf "$(_get_app_dir)/resources/default_app.asar"
+ cp -a "$(_get_app_dir)/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"
+ install -Dm644 "$(_get_project_dir)/.flatpak.desktop" "${pkgdir}/usr/share/applications/${pkgname%-git}.desktop"
+ install -Dm644 "$(_get_project_dir)/buildResources/icon.png" "${pkgdir}/usr/share/icons/hicolor/512x512/apps/${pkgname%-git}.png"
+ install -Dm644 "$(_get_project_dir)/buildResources/icon.svg" "${pkgdir}/usr/share/icons/hicolor/scalable/apps/${pkgname%-git}.svg"
+ install -Dm644 "$(_get_project_dir)/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
}
+

Scan history

Scanned at (UTC)SeverityRules
2026-11-01 00:21:48 Low 2
2026-10-31 00:07:41 Low 2
2026-10-30 00:29:30 Low 2
2026-10-29 00:13:55 Low 2
2026-10-28 00:06:54 Low 2
2026-10-27 00:23:28 Low 2
2026-10-26 00:12:40 Low 2
2026-10-25 00:20:48 Low 2
2026-10-24 00:14:55 Low 2
2026-10-23 00:02:19 Low 2
2026-10-22 00:13:10 Low 2
2026-10-21 00:12:50 Low 2
2026-10-20 00:10:31 Low 2
2026-10-19 00:03:55 Low 2
2026-10-18 00:06:55 Low 2
2026-10-17 00:21:55 Low 2
2026-10-16 00:12:47 Low 2
2026-10-15 00:28:05 Low 2
2026-10-14 05:19:21 Medium 1
2026-10-14 00:06:47 Low 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion