postybirb-git

LOW
maintainer zxp19821005 0 votes scanned 2026-11-01 00:21:48.120785
View on AUR
Why flagged

The package builds from the project's own GitHub source using standard npm/yarn workflows; the flagged patterns involve internal development dependencies and environment setup, not untrusted external code execution.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from the project's own GitHub source using standard npm/yarn workflows; the flagged patterns involve internal development dependencies and environment setup, not untrusted external code execution.

  • PKGBUILD:102 npm install -g "@yarnpkg/cli-dist@${_yarnver}" --prefix "${_yarnhome}" --registry "${npm_config_registry}"
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

  • PKGBUILD:143 yarn add -D node-addon-api

PKGBUILD

2 offending line(s) highlighted
1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2pkgname=postybirb-git
3_pkgname=PostyBirb
4pkgver=4.1.2.r0.gf143d2b
5_electronversion=42
6_nodeversion=24
7pkgrel=1
8pkgdesc="An application that helps artists post art and other multimedia to multiple websites more quickly."
9arch=(
10 'aarch64'
11 'x86_64'
12)
13url="https://www.postybirb.com/"
14_ghurl="https://github.com/mvdicarlo/postybirb"
15license=('BSD-3-Clause')
16provides=("${pkgname%-git}=${pkgver%.r*}")
17conflicts=(
18 "${pkgname%-git}"
19 "${pkgname%-git}-plus"
20)
21depends=(
22 "electron${_electronversion}"
23)
24makedepends=(
25 'npm'
26 'yarn'
27 'git'
28 'nvm'
29 'gendesk'
30 'jq'
31)
32source=(
33 "${pkgname//-/.}::git+${_ghurl}.git"
34 "${pkgname%-git}.sh"
35)
36sha256sums=('SKIP'
37 'dfcd6603d29c7b8d88e019b517a2e5c1a7b5ab905a0961a8b81adfa508b258b8')
38_get_project_dir() {
39 local d
40 while IFS= read -r d; do
41 find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
42 done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
43}
44pkgver() {
45 cd "$(_get_project_dir)"
46 set -o pipefail
47 git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
48 printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
49}
50_ensure_local_nvm() {
51 local NVM_DIR="${srcdir}/.nvm"
52 source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
53 nvm install "${_nodeversion}"
54 nvm use "${_nodeversion}"
55}
56_get_app_dir() {
57 find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -printf '%h\n' 2>/dev/null \
58 | while read -r d; do [[ -d "${d}/resources" ]] && { echo "$d"; return 0; }; done
59}
60_get_electron_version() {
61 _elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
62 | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
63 | grep -oE '[0-9]+' | head -1)
64 [[ -z "${_elec_ver}" ]] && return 1
65 (( _elec_ver == _electronversion )) && c=32 || c=31
66 echo -e "Electron version: \033[1;${c}m${_elec_ver}$([[ $c -eq 31 ]] && echo " (expected ${_electronversion})")\033[0m"
67}
68_set_build_env() {
69 export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
70 export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
71 export ELECTRON_SKIP_BINARY_DOWNLOAD=1
72 export ELECTRON_BUILDER_OFFLINE=true
73 export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
74 export HOME="${srcdir}/.home"
75 export XDG_CACHE_HOME="${HOME}/.cache"
76 export XDG_CONFIG_HOME="${HOME}/.config"
77 export XDG_DATA_HOME="${HOME}/.local/share"
78 export YARN_CACHE_FOLDER="${HOME}/.yarn/cache"
79 export YARN_NETWORK_CONCURRENCY=32
80 export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
81 export COREPACK_HOME="${HOME}/.corepack"
82 export npm_config_registry="${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}"
83 local _yarnver _yarnmajor=0
84 _yarnver="$(node -p "require('./package.json').packageManager?.split('@')[1]?.split('-')[0] || ''" 2>/dev/null)"
85 _yarnmajor="${_yarnver%%.*}"
86 _yarnmajor="${_yarnmajor:-0}"
87 if [[ "${_yarnmajor}" -ge 2 ]] 2>/dev/null || [[ -f .yarnrc.yml ]]; then
88 export XDG_STATE_HOME="${HOME}/.local/state"
89 export YARN_ENABLE_GLOBAL_CACHE=false
90 export YARN_ENABLE_MIRROR=false
91 export YARN_GLOBAL_FOLDER="${HOME}/.yarn/berry"
92 export YARN_NODE_LINKER=node-modules
93 export YARN_NM_MODE=hardlinks-local
94 export YARN_ENABLE_TELEMETRY=false
95 export YARN_ENABLE_SCRIPTS=true
96 export YARN_HTTP_TIMEOUT=600000
97 export YARN_HTTP_RETRY=5
98 export YARN_NPM_REGISTRY_SERVER="${YARN_NPM_REGISTRY_SERVER:-${NPM_CONFIG_REGISTRY:-https://registry.yarnpkg.com}}"
99 local _yarnhome="${HOME}/.yarn/install"
100 mkdir -p "${HOME}" "${YARN_CACHE_FOLDER}" "${YARN_GLOBAL_FOLDER}" "${COREPACK_HOME}" "${_yarnhome}"
101 if [[ -n "${_yarnver}" ]]; then
102 npm install -g "@yarnpkg/cli-dist@${_yarnver}" --prefix "${_yarnhome}" --registry "${npm_config_registry}"
103 export PATH="${_yarnhome}/bin:${PATH}"
104 fi
105 else
106 export YARN_GLOBAL_FOLDER="${HOME}/.yarn/global"
107 export YARN_LINK_FOLDER="${HOME}/.yarn/link"
108 export YARN_TEMP_FOLDER="${HOME}/.yarn/tmp"
109 export YARN_NETWORK_TIMEOUT=600000
110 export YARN_CHILD_CONCURRENCY="$(nproc)"
111 export YARN_FROZEN_LOCKFILE=true
112 export YARN_IGNORE_ENGINES=true
113 export YARN_PRODUCTION=false
114 mkdir -p "${HOME}" "${YARN_CACHE_FOLDER}" "${YARN_GLOBAL_FOLDER}" "${YARN_LINK_FOLDER}" "${YARN_TEMP_FOLDER}" "${COREPACK_HOME}"
115 fi
116 local _reg="${NPM_CONFIG_REGISTRY:-https://registry.yarnpkg.com}"
117 _reg="${_reg%/}"
118 if [[ -f .yarnrc ]]; then
119 sed -i "s|^registry .*|registry \"${_reg}\"|" .yarnrc
120 fi
121 if [[ -f yarn.lock ]] && grep -q 'resolved "https://registry.yarnpkg.com' yarn.lock; then
122 sed -i "s|https://registry.yarnpkg.com/|${_reg}/|g" yarn.lock
123 fi
124}
125prepare() {
126 cd "$(_get_project_dir)"
127 _get_electron_version
128 sed -i -e "
129 s/@electronversion@/${_electronversion}/g
130 s/@appname@/${pkgname%-git}/g
131 " "${srcdir}/${pkgname%-git}.sh"
132 gendesk -q -f -n \
133 --pkgname="${pkgname%-git}" \
134 --pkgdesc="${pkgdesc}" \
135 --categories="Utility" \
136 --name="${_pkgname}" \
137 --exec="${pkgname%-git} %U"
138 _ensure_local_nvm
139 _set_build_env
140 export PATH="$(npm root -g)/../bin:${PATH}"
141 jq --arg ver "${SYSTEM_ELECTRON_VERSION}" '.devDependencies.electron = $ver' package.json > package.json.tmp && mv package.json.tmp package.json
142 export NODE_ENV=development
143 yarn add -D node-addon-api
144 yarn install
145}
146build() {
147 cd "$(_get_project_dir)"
148 _ensure_local_nvm
149 _set_build_env
150 export NODE_ENV=production
151 yarn run build:prod
152 yarn electron-builder --linux dir -c.electronDist="${ELECTRON_DIST}" --config electron-builder.yml
153 local _archrem=$([[ "${CARCH}" == "aarch64" ]] && echo x64 || echo arm)
154 find "$(_get_app_dir)" -type d \
155 \( -name 'darwin*' -o -name '*android*' -o -name 'win32*' -o -name "*${_archrem}*" -o -name "default_app.asar" \) \
156 -prune -exec rm -rf {} +
157}
158package() {
159 install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
160 install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-git}"
161 cp -a "$(_get_app_dir)/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"
162 install -Dm644 "$(_get_project_dir)/packaging-resources/icon.png" "${pkgdir}/usr/share/pixmaps/${pkgname%-git}.png"
163 install -Dm644 "$(_get_project_dir)/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
164 install -Dm644 "$(_get_project_dir)/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
165}
166

Changes since previous scan

--- PKGBUILD @ 2026-10-14 00:06
+++ PKGBUILD @ 2026-11-01 00:21
@@ -1,7 +1,7 @@
# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
pkgname=postybirb-git
_pkgname=PostyBirb
-pkgver=4.1.1.r0.ge9840dc
+pkgver=4.1.2.r0.gf143d2b
_electronversion=42
_nodeversion=24
pkgrel=1
@@ -34,7 +34,7 @@
"${pkgname%-git}.sh"
)
sha256sums=('SKIP'
- 'fe033c7446c688abcb9a007d75f40eb9ca62756880cfde6be54fdf27a5bd94a8')
+ 'dfcd6603d29c7b8d88e019b517a2e5c1a7b5ab905a0961a8b81adfa508b258b8')
_get_project_dir() {
local d
while IFS= read -r d; do
@@ -42,26 +42,28 @@
done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
}
pkgver() {
- cd "$(_get_project_dir)"
- set -o pipefail
- git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
- printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
+ cd "$(_get_project_dir)"
+ set -o pipefail
+ git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
+ printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
}
_ensure_local_nvm() {
- local NVM_DIR="${srcdir}/.nvm"
- source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
- nvm install "${_nodeversion}"
- nvm use "${_nodeversion}"
+ local NVM_DIR="${srcdir}/.nvm"
+ source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
+ nvm install "${_nodeversion}"
+ nvm use "${_nodeversion}"
}
_get_app_dir() {
- find "${srcdir}" -type f -name "resources.pak" -print 2>/dev/null | while read f; do [ -d "${f%/*}/resources" ] && echo "${f%/*}" && break; done
+ find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -printf '%h\n' 2>/dev/null \
+ | while read -r d; do [[ -d "${d}/resources" ]] && { echo "$d"; return 0; }; done
}
_get_electron_version() {
_elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
| xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
- | grep -v '^$' | sed 's/^[^0-9]*//' | head -1)
+ | grep -oE '[0-9]+' | head -1)
[[ -z "${_elec_ver}" ]] && return 1
- echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
+ (( _elec_ver == _electronversion )) && c=32 || c=31
+ echo -e "Electron version: \033[1;${c}m${_elec_ver}$([[ $c -eq 31 ]] && echo " (expected ${_electronversion})")\033[0m"
}
_set_build_env() {
export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
@@ -126,7 +128,6 @@
sed -i -e "
s/@electronversion@/${_electronversion}/g
s/@appname@/${pkgname%-git}/g
- s/@runname@/app.asar/g
" "${srcdir}/${pkgname%-git}.sh"
gendesk -q -f -n \
--pkgname="${pkgname%-git}" \
@@ -149,17 +150,17 @@
export NODE_ENV=production
yarn run build:prod
yarn electron-builder --linux dir -c.electronDist="${ELECTRON_DIST}" --config electron-builder.yml
- local _app_dir="$(_get_app_dir)"
- find "${_app_dir}/resources/app.asar.unpacked" -type d \( -name "*darwin*" -o -name "*win32*" \) -exec rm -rf {} +
+ local _archrem=$([[ "${CARCH}" == "aarch64" ]] && echo x64 || echo arm)
+ find "$(_get_app_dir)" -type d \
+ \( -name 'darwin*' -o -name '*android*' -o -name 'win32*' -o -name "*${_archrem}*" -o -name "default_app.asar" \) \
+ -prune -exec rm -rf {} +
}
package() {
install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-git}"
- local _app_dir="$(_get_app_dir)"
- cp -a "${_app_dir}/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"
- local _src="$(_get_project_dir)"
- install -Dm644 "${_src}/packaging-resources/icon.png" "${pkgdir}/usr/share/pixmaps/${pkgname%-git}.png"
- install -Dm644 "${_src}/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
- install -Dm644 "${_src}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
+ cp -a "$(_get_app_dir)/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"
+ install -Dm644 "$(_get_project_dir)/packaging-resources/icon.png" "${pkgdir}/usr/share/pixmaps/${pkgname%-git}.png"
+ install -Dm644 "$(_get_project_dir)/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
+ install -Dm644 "$(_get_project_dir)/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
}

Scan history

Scanned at (UTC)SeverityRules
2026-11-01 00:21:48 Low 2
2026-10-31 00:07:41 Low 2
2026-10-30 00:29:30 Low 2
2026-10-29 00:13:55 Low 2
2026-10-28 00:06:54 Low 2
2026-10-27 00:23:28 Low 2
2026-10-26 00:12:40 Low 2
2026-10-25 00:20:48 Low 2
2026-10-24 00:14:55 Low 2
2026-10-23 00:02:19 Low 2
2026-10-22 00:13:10 Low 2
2026-10-21 00:12:50 Low 2
2026-10-20 00:10:31 Low 2
2026-10-19 00:03:55 Low 2
2026-10-18 00:06:55 Low 2
2026-10-17 00:21:55 Low 2
2026-10-16 00:12:47 Low 2
2026-10-15 00:28:05 Low 2
2026-10-14 07:19:30 Medium 1
2026-10-14 00:06:47 Low 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion