popcorntime
LOW
maintainer ItachiSan
62 votes
scanned 2026-09-01 15:48:43.798595
Why flagged
The package builds from a publicly accessible Git repository with a fixed tag, applies minor patches for build compatibility, and uses yarn to install declared dependencies; no untrusted remote code execution or hidden payloads are present.
Triggered rules
Low
AI review of an ambiguous pattern
llm_review
The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it LOW (confidence 95%): The package builds from a publicly accessible Git repository with a fixed tag, applies minor patches for build compatibility, and uses yarn to install declared dependencies; no untrusted remote code execution or hidden payloads are present.
-
PKGBUILD:84
yarn install "$package"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Giovanni 'ItachiSan' Santini <giovannisantini93@yahoo.it>
2
# Contributor: Vlad M. <vlad@archlinux.net>
3
# Contributor: Attila Bukor <r1pp3rj4ck [at] w4it [dot] eu>
4
# Contributor: Hugo Osvaldo Barrera <hugo@barrera.io>
5
# Contributor: xantares <xantares09@hotmail.com>
6
# Contributor: Eric Engestrom <aur [at] engestrom [dot] ch>
7
# Contributor: Iwan Timmer <irtimmer@gmail.com>
8
# Contributor: Ricardo Band <me [at] xengi [dot] de>
9
10
pkgname=popcorntime
11
pkgver=0.5.1
12
pkgrel=2
13
pkgdesc="Stream movies from torrents. Skip the downloads. Launch, click, watch."
14
arch=(i686 x86_64)
15
url="https://popcorn-time.site/"
16
license=(GPL3)
17
depends=(gtk3 libxss nss ttf-font)
18
makedepends=(git npm yarn)
19
optdepends=('net-tools: vpn.ht client')
20
options=('!strip')
21
#install="popcorntime.install"
22
# Needed variables for sources downloads
23
# Commit ref updated on date: 2021-10-19
24
# Plain version tag (e.g. v0.4.9)
25
_commit_hash="tag=v${pkgver}"
26
_pkgname="popcorn-desktop"
27
28
# NW.js version to use while building
29
#_nwjs="0.44.1" # e.g. 0.31.5
30
# Missing dependencies to install
31
#_missing_deps="underscore@~1.8.3"
32
33
# Build-related stuff
34
[ "$CARCH" = "i686" ] && _platform=linux32
35
[ "$CARCH" = "x86_64" ] && _platform=linux64
36
_srcdir="${_pkgname}"
37
_bpath="${_srcdir}/build/Popcorn-Time/${_platform}"
38
39
# Get sources only here
40
source=(
41
"${_pkgname}::git+https://github.com/popcorn-time-ru/${_pkgname}/#${_commit_hash}"
42
"popcorntime.desktop"
43
"yarn_lock-fixes.patch"
44
"copy-libatomic_fixes.patch"
45
)
46
sha512sums=('eebf29848ef0eb37028031056be5303bd86105af5de258d122a6dfe8757c0b27c226df6ae296930b779c3fc849bde161fcb75a6adfe6cda9c5fef8e913a8db48'
47
'7e6538a7b39465439a62cb089510b6d85a65ad4bfa74d21b692363d1176ee94165ab7b5fef5f3470bf821cfc9f3b3a23763b8e3d8530420d7fa97c66083c3adb'
48
'1cb54fbc2690f4a473e50e786b12f5fcfffffb805cfd421e996bc0b278c13fd1252ab63cde576078eb1d7df060b5763a308a0dec9ffba8a0b568f78a6a326f8b'
49
'492173870773112a170db73a92fd7b06dced4a06db580ef5f9d651702eef62e53b5c45e8c7956262f0038c7055841f7aec2d4087c517c7a42ba24748ea4f7ef6')
50
51
# Building the package
52
prepare() {
53
cd "${srcdir}/${_srcdir}"
54
55
# echo "--> Apply Gulpfile fixes ..."
56
# git apply "$srcdir/gulp-fixes.patch"
57
58
# Some dependencies in the yarn.lock file use "git+ssh", which is unavailable.
59
# Use "git+https" instead.
60
echo "--> Apply Yarn lockfile fixes ..."
61
git apply "$srcdir/yarn_lock-fixes.patch"
62
63
# Fix the libatomic script to work on Arch
64
echo "--> Apply Yarn lockfile fixes ..."
65
git apply "$srcdir/copy-libatomic_fixes.patch"
66
67
# Thanks to Eschwartz for the tip! yarn edition
68
export YARN_CACHE_FOLDER="$srcdir/npm_cache"
69
70
#msg2 "Patching wrong packages versions, if any ..."
71
# Keeping this as example, in case needed in the future
72
#msg "Patching Vodo provider (butter-provider-vodo)..."
73
#sed -E 's|(.*vodo.*)",|\1#f61e70217711b4a29ff50618d28e8d4170d63fe5",|' -i package.json
74
75
# Actually install the stuff
76
echo "--> Installing normal dependencies"
77
yarn install
78
79
echo "--> Install missing dependencies, if any ..."
80
# Here specific version of the packages will be installed
81
for package in $_missing_deps
82
do
83
echo "--> Installing missing dependency $package"
84
yarn install "$package"
85
done
86
87
# Change NW.js version, if defined
88
if [ -n "$_nwjs" ]
89
then
90
echo "--> Changing NW.js version to $_nwjs ..."
91
sed -i "s|\(const nwVersion = '\)[0-9.]\+|\1$_nwjs|" gulpfile.js
92
fi
93
}
94
95
build() {
96
# Re-set all the needed information
97
export YARN_CACHE_FOLDER="$srcdir/npm_cache"
98
99
cd "${srcdir}/${_srcdir}"
100
101
yarn build
102
}
103
104
package() {
105
echo "--> Create required directories ..."
106
cd "${srcdir}/${_bpath}"
107
108
mkdir -p "${pkgdir}/usr/share/${pkgname}"
109
mkdir -p "${pkgdir}/usr/bin"
110
111
echo "--> Fix permissions of the package files ..."
112
find -type f -perm -u+r -exec chmod a+r {} \;
113
find -type f -perm -u+x -exec chmod a+x {} \;
114
115
echo "--> Installing required files ..."
116
cp -a . "${pkgdir}/usr/share/${pkgname}"
117
118
echo "--> Create symlink in \$PATH ..."
119
ln -s "/usr/share/${pkgname}/Popcorn-Time" "${pkgdir}/usr/bin/${pkgname}"
120
121
echo "--> Install .destkop file ..."
122
install -Dm644 "${srcdir}/${_srcdir}/src/app/images/icon.png" "${pkgdir}/usr/share/pixmaps/popcorntime.png"
123
install -Dm644 "${srcdir}/popcorntime.desktop" "${pkgdir}/usr/share/applications/popcorntime.desktop"
124
}
125
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-01 15:48:43 | Low | 1 |
| 2026-06-18 16:11:54 | Clean | 0 |