podman-desktop-git

LOW
maintainer zxp19821005 0 votes scanned 2026-09-17 00:27:14.276658
View on AUR
Why flagged

The flagged pattern involves npm/yarn/pnpm installing dependencies, but this occurs within the context of building the project from its own git source; the packages are declared in the project's package.json and are part of normal build workflow, not an external unreviewed package injection.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The flagged pattern involves npm/yarn/pnpm installing dependencies, but this occurs within the context of building the project from its own git source; the packages are declared in the project's package.json and are part of normal build workflow, not an external unreviewed package injection.

1 higher static finding superseded - not the current verdict (shown for transparency)
Medium npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

  • PKGBUILD:111 NODE_ENV=development pnpm add -D -w node-addon-api

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2pkgname=podman-desktop-git
3_pkgname='Podman Desktop'
4_flatpakname="io.podman_desktop.${_pkgname// /}"
5pkgver=r10517.1c9ae4a
6_electronversion=42
7_nodeversion=24
8pkgrel=1
9pkgdesc="A graphical tool for developing on containers and Kubernetes.(Use system-wide electron)"
10arch=('any')
11url="https://podman-desktop.io/"
12_ghurl="https://github.com/podman-desktop/podman-desktop"
13license=('Apache-2.0')
14conflicts=("${pkgname%-git}")
15provides=("${pkgname%-git}=${pkgver%.r*}")
16depends=(
17 "electron${_electronversion}"
18 'docker-compose'
19 'podman'
20 'docker'
21 'python'
22)
23makedepends=(
24 'npm'
25 'nvm'
26 'git'
27 'curl'
28 'pnpm'
29 'jq'
30 'node-gyp'
31)
32optdepends=(
33 "crc: crc plugin"
34 "lima: lima plugin"
35 "xdg-utils: open URLs with desktop's default (xdg-email, xdg-open)"
36 "trash-cli: file deletion support (trash-put)"
37 "libappindicator-gtk3: StatusNotifierItem support"
38 "pipewire: WebRTC desktop sharing under Wayland"
39 "qt5-base: enable Qt5 with --enable-features=AllowQt"
40)
41options=(
42 '!strip'
43 '!emptydirs'
44)
45source=(
46 "${pkgname%-git}.git::git+${_ghurl}"
47 "${pkgname%-git}.sh"
48)
49sha256sums=('SKIP'
50 'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
51pkgver() {
52 cd "${srcdir}/${pkgname%-git}.git"
53 set -o pipefail
54 git fetch --tags
55 git describe --long --abbrev=7 2>/dev/null | sed 's/\([^-]*-g\)/r\1/;s/-/./g' ||
56 printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
57}
58_ensure_local_nvm() {
59 local NVM_DIR="${srcdir}/.nvm"
60 source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
61 nvm install "${_nodeversion}"
62 nvm use "${_nodeversion}"
63}
64_get_electron_version() {
65 _elec_ver=$(find "${srcdir}" -maxdepth 5 -name "package.json" ! -path "*/node_modules/*" \
66 -exec grep -l '"electron"' {} + | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null | head -1)
67 [[ -z "${_elec_ver}" ]] && return 1
68 echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
69}
70prepare() {
71 cd "${srcdir}/${pkgname%-git}.git"
72 sed -i -e "
73 s/@electronversion@/${_electronversion}/g
74 s/@appname@/${pkgname%-git}/g
75 s/@runname@/app/g
76 s/@cfgdirname@/${_pkgname}/g
77 " "${srcdir}/${pkgname%-git}.sh"
78 _get_electron_version
79 export ELECTRON_SKIP_BINARY_DOWNLOAD=1
80 export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/v//g')"
81 HOME="${srcdir}/.electron-gyp"
82 {
83 export PNPM_LINK_WORKSPACE_PACKAGES=true
84 export PNPM_FETCH_RETRY_MAXTIMEOUT=10000
85 export PNPM_CACHE_DIR="${srcdir}/.pnpm_cache"
86 export PNPM_STORE_DIR="${srcdir}/.pnpm_store"
87 export PNPM_VIRTUAL_STORE_DIR="${srcdir}/.pnpm_store"
88 export PNPM_SHAMEFULLY_HOIST=true
89 export PNPM_VIRTUAL_STORE_DIR_MAX_LENGTH=80
90 export PNPM_NODE_LINKER=hoisted
91 export PNPM_NETWORK_CONCURRENCY=32
92 }
93 if [[ "$(curl -s ipinfo.io/country)" == *"CN"* ]]; then
94 {
95 export NPM_CONFIG_REGISTRY="https://registry.npmmirror.com"
96 export NPM_CONFIG_ELECTRON_MIRROR="https://registry.npmmirror.com/-/binary/electron/"
97 export NPM_CONFIG_ELECTRON_BUILDER_BINARIES_MIRROR="https://registry.npmmirror.com/-/binary/electron-builder-binaries/"
98 export NODEJS_ORG_MIRROR="https://npmmirror.com/mirrors/node"
99 }
100 fi
101 _ensure_local_nvm
102 find packages -type f -exec sed -i "s/process.resourcesPath/\'\/usr\/lib\/${pkgname%-git}\'/" {} +
103 sed -i -e "
104 s/run.sh/${pkgname%-git}/g
105 s/${_flatpakname}/${pkgname%-git}/g
106 /X-Flatpak/d
107 " .flatpak.desktop
108 sed -i "s/${_flatpakname}/${pkgname%-git}/" .flatpak-appdata.xml
109 sed -i "s/\'flatpak\', \'tar.gz\'/\'dir\'/" .electron-builder.config.cjs
110 sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/" package.json
111 NODE_ENV=development pnpm add -D -w node-addon-api
112 NODE_ENV=development pnpm install --no-lockfile
113}
114build() {
115 cd "${srcdir}/${pkgname%-git}.git"
116 _ensure_local_nvm
117 export ELECTRON_SKIP_BINARY_DOWNLOAD=1
118 local electronDist="/usr/lib/electron${_electronversion}"
119 NODE_ENV=production pnpm run build:main
120 NODE_ENV=production pnpm run build:preload
121 NODE_ENV=production pnpm run build:preload-docker-extension
122 NODE_ENV=production pnpm run build:preload-webview
123 NODE_ENV=production pnpm run build:preload:types
124 NODE_ENV=production pnpm run build:ui
125 NODE_ENV=production pnpm run build:renderer
126 NODE_ENV=production pnpm run build:extensions
127 NODE_ENV=production pnpm -c exec "electron-builder build --linux dir -c.electronDist=${electronDist} --config .electron-builder.config.cjs --config.asar=false"
128}
129package() {
130 install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
131 install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-git}"
132 local _app_dir=$(find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -exec dirname {} + | head -n 1)
133 cp -a "${_app_dir}/resources/". "${pkgdir}/usr/lib/${pkgname%-git}/"
134 install -Dm644 "${srcdir}/${pkgname%-git}.git/.flatpak.desktop" "${pkgdir}/usr/share/applications/${pkgname%-git}.desktop"
135 install -Dm644 "${srcdir}/${pkgname%-git}.git/buildResources/icon.png" "${pkgdir}/usr/share/pixmaps/${pkgname%-git}.png"
136 install -Dm644 "${srcdir}/${pkgname%-git}.git/buildResources/icon.svg" "${pkgdir}/usr/share/icons/hicolor/scalable/apps/${pkgname%-git}.svg"
137 install -Dm644 "${srcdir}/${pkgname%-git}.git/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
138}
139

Scan history

Scanned at (UTC)SeverityRules
2026-09-17 00:27:14 Low 2
2026-09-16 00:03:17 Low 2
2026-09-15 00:25:31 Low 2
2026-09-14 00:27:57 Low 2
2026-09-13 00:19:54 Low 2
2026-09-12 00:25:17 Low 2
2026-09-11 00:19:22 Low 2
2026-09-10 00:22:44 Low 2
2026-09-09 00:04:09 Low 2
2026-09-08 00:18:08 Low 2
2026-09-07 00:30:15 Low 2
2026-09-06 00:17:06 Low 2
2026-09-05 00:16:27 Low 2
2026-09-04 00:03:13 Low 2
2026-09-03 00:15:47 Low 2
2026-09-02 00:02:31 Low 2
2026-09-01 00:11:19 Low 2
2026-08-31 00:19:57 Low 2
2026-08-30 00:04:14 Low 2
2026-08-29 00:29:17 Low 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion