prepros-bin

LOW

maintainer zxp19821005 5 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads a prebuilt .deb from the official project domain (prepros.io), which is a legitimate source for the application;虽host未在白名单，但属项目自有发布基础设施，非恶意第三方，且安装内容为常规应用文件，无远程代码执行或隐蔽行为。

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt .deb from the official project domain (prepros.io), which is a legitimate source for the application;虽host未在白名单，但属项目自有发布基础设施，非恶意第三方，且安装内容为常规应用文件，无远程代码执行或隐蔽行为。

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:25 "${pkgname%-bin}-${pkgver}.deb::https://downloads.prepros.io/v7/${pkgver}/${_pkgname}-${pkgver}.deb"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
    
      2# Contributor: Thomas Höß <hi@thomsn.de>
    
      3# Contributor: Prepros <hi@prepros.io>
    
      4# Contributor: solopasha <daron439 at gmail dot com>
    
      5# Contributor: Martin
    
      6# Contributor: Adam Rustler
    
      7pkgname=prepros-bin
    
      8_pkgname=Prepros
    
      9pkgver=7.39.0
    
      10_electronversion=25
    
      11pkgrel=1
    
      12pkgdesc="Prepros compiles your files, transpiles your JavaScript, reloads your browsers and makes it really easy to develop & test your websites so you can focus on making them perfect.(Prebuilt version.Use system-wide electron)"
    
      13arch=('x86_64')
    
      14url="https://prepros.io"
    
      15license=('LicenseRef-custom')
    
      16depends=(
    
      17    "electron${_electronversion}"
    
      18    'perl'
    
      19    'ruby'
    
      20    'libva>=2.20.0'
    
      21    '7zip'
    
      22)
    
      23options=('!strip')
    
      24source=(
    
      25    "${pkgname%-bin}-${pkgver}.deb::https://downloads.prepros.io/v7/${pkgver}/${_pkgname}-${pkgver}.deb"
    
      26    "${pkgname%-bin}.sh"
    
      27)
    
      28sha256sums=('0c24d5942c74b0a3175517c9dd0d130a91be1f6c4dcb940cfe22dca1e8b78638'
    
      29            '31ad33b633744f5361abd964be306cea53ae1050e760c787115f7eca60045ae6')
    
      30_get_electron_version() {
    
      31    _elec_ver="$(strings "${srcdir}/usr/lib/${pkgname%-bin}/${_pkgname}" | grep '^Chrome/[0-9.]* Electron/[0-9]' | cut -d'/' -f3 | cut -d'.' -f1)"
    
      32    echo -e "The electron version is: \033[1;31m${_elec_ver}\033[0m"
    
      33}
    
      34prepare() {
    
      35    sed -i -e "
    
      36        s/@electronversion@/${_electronversion}/g
    
      37        s/@appname@/${pkgname%-bin}/g
    
      38        s/@runname@/app.asar/g
    
      39        s/@cfgdirname@/${_pkgname}-7/g
    
      40        s/@options@//g
    
      41    " "${srcdir}/${pkgname%-bin}.sh"
    
      42    bsdtar -xf "${srcdir}/data."*
    
      43    _get_electron_version
    
      44    rm -rf "${srcdir}/usr/lib/${pkgname%-bin}/resources/app.asar.unpacked/node_modules/@prepros/node/node_modules/7zip-bin/"{linux/{arm*,ia32},mac,win} \
    
      45        "${srcdir}/usr/lib/${pkgname%-bin}/resources/app.asar.unpacked/node_modules/@prepros/ruby/node_modules/7zip-bin/"{linux/{arm*,ia32},mac,win} \
    
      46        "${srcdir}/usr/lib/${pkgname%-bin}/resources/app.asar.unpacked/node_modules/@sbspk/mozjpeg-bin/vendor/"{darwin-*,win32-*} \
    
      47        "${srcdir}/usr/lib/${pkgname%-bin}/resources/app.asar.unpacked/node_modules/@sbspk/pngquant-bin/vendor/"{darwin-*,win32-*}
    
      48    ln -sf "/usr/bin/7za" "${srcdir}/usr/lib/${pkgname%-bin}/resources/app.asar.unpacked/node_modules/@prepros/node/node_modules/7zip-bin/linux/x64/7za"
    
      49    ln -sf "/usr/bin/7za" "${srcdir}/usr/lib/${pkgname%-bin}/resources/app.asar.unpacked/node_modules/@prepros/ruby/node_modules/7zip-bin/linux/x64/7za"
    
      50}
    
      51package() {
    
      52    install -Dm755 "${srcdir}/${pkgname%-bin}.sh" "${pkgdir}/usr/bin/${pkgname%-bin}"
    
      53    install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-bin}"
    
      54	find "${srcdir}/usr/lib/${pkgname%-bin}/resources" -maxdepth 1 -type f -exec install -Dm644 -t "${pkgdir}/usr/lib/${pkgname%-bin}" {} +
    
      55    if find "${srcdir}/usr/lib/${pkgname%-bin}/resources" -mindepth 1 -maxdepth 1 -type d | read; then
    
      56        for _subdir in "${srcdir}/usr/lib/${pkgname%-bin}/resources/"*; do
    
      57            if [ -d "${_subdir}" ]; then
    
      58                cp -Pr --no-preserve=ownership "${_subdir}" "${pkgdir}/usr/lib/${pkgname%-bin}"
    
      59            fi
    
      60        done
    
      61    fi
    
      62    install -Dm644 "${srcdir}/usr/lib/${pkgname%-bin}/resources/icon.png" -t "${pkgdir}/usr/lib/${pkgname%-bin}"
    
      63    install -Dm644 "${srcdir}/usr/share/applications/${pkgname%-bin}.desktop" -t "${pkgdir}/usr/share/applications"
    
      64    install -Dm644 "${srcdir}/usr/share/doc/${pkgname%-bin}/copyright" "${pkgdir}/usr/share/licenses/${pkgname}/license"
    
      65    install -Dm644 "${srcdir}/usr/share/pixmaps/${pkgname%-bin}.png" -t "${pkgdir}/usr/share/pixmaps"
    
      66}
    
      67

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2