proton-pass
MEDIUM
maintainer DodoGTA
21 votes
scanned 2026-10-26 11:44:54.928123
Why flagged
Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.
Triggered rules
Medium
npm/yarn/pnpm install of an undeclared external package
npm_install_external
Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.
-
PKGBUILD:53
pnpm add '@protontech/logger@1.0.0' --ignore-scripts
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Echo J. <aidas957 at gmail dot com>
2
# Contributor: Paragoumba <aur at paragoumba dot fr>
3
# Contributor: Renaud Littolff <rlittolff@gmail.com>
4
5
# shellcheck shell=bash disable=SC2034,SC2164
6
7
pkgname=proton-pass
8
pkgver=1.43.0
9
pkgrel=1
10
pkgdesc="Open-source and secure identity manager"
11
arch=('aarch64' 'x86_64')
12
url="https://proton.me/pass"
13
license=('GPL-3.0-or-later')
14
depends=('bash' 'gcc-libs' 'glibc' 'electron')
15
makedepends=('nodejs' 'pnpm' 'rust')
16
conflicts=('proton-pass-bin')
17
source=("${pkgname}-${pkgver}.tar.gz::https://github.com/ProtonMail/WebClients/archive/refs/tags/${pkgname}@${pkgver}.tar.gz"
18
"proton-pass.desktop")
19
sha256sums=('4bec62194dfc4c7036a9a8af1229252f4f6bf98c42a5d4f05401d9970412f532'
20
'1c5c6373a3e3be71e34e42fa6c7486601f04a645763496c5a808bc843456e0fc')
21
22
prepare() {
23
cd WebClients-${pkgname}-${pkgver}
24
25
# Only define Pass application packages to avoid problematic Proton repo dependencies
26
sed -i 's@applications/\*@applications/pass*@' pnpm-workspace.yaml
27
28
# Patch out the usage/resolution of problematic tpe packages
29
sed -i '/.*- tests.*/d' pnpm-workspace.yaml
30
sed -i -E '/ tests:/{:a;N;/utilities\/ci-pass:/!ba;s/ tests:.*(utilities\/ci-pass:)/ \1/;}' pnpm-lock.yaml
31
sed -i -E $'/ \'@tpe\/loki-client/{:a;N;/\'@trivago\/prettier-plugin/!ba;s/ \'@tpe\/loki-client.*(\'@trivago\/prettier-plugin)/ \\1/;}' pnpm-lock.yaml
32
33
# Skip broken internal repo for protontech packages
34
sed -i '/@protontech/d' .npmrc
35
36
# Bypass pass-desktop-native build script (removes npm/rustup requirement and Rust target hardcoding)
37
sed -i 's@build"@build:napi \&\& pnpm run build:host"@' applications/pass-desktop/package.json
38
39
# Freeze the lockfile when building the Rust component
40
sed -i 's@--release@--release --locked@' applications/pass-desktop/native/package.json
41
42
# Skip electron-forge in build step (needed for .asar size improvement below)
43
sed -i 's@ && electron-forge package@@' applications/pass-desktop/package.json
44
45
# HACK: Make the tray icon work under system Electron
46
sed -i 's@process.resourcesPath@"/usr/share/proton-pass"@' applications/pass-desktop/src/main.ts
47
}
48
49
build() {
50
cd WebClients-${pkgname}-${pkgver}/applications/pass-desktop
51
52
# Update Proton logger dependency to a version available on npm
53
pnpm add '@protontech/logger@1.0.0' --ignore-scripts
54
55
# preinstall script is ran from a mysterious missing utilities directory
56
pnpm install --frozen-lockfile --no-runtime --ignore-scripts
57
58
pnpm run build:desktop
59
60
# HACK: Move Rust target directory to avoid asset-relocator including it (reduces size of .asar file)
61
{
62
mv native/target ../rust-target
63
pnpm exec 'NODE_ENV=production electron-forge package'
64
mv ../rust-target native/target
65
}
66
}
67
68
package() {
69
cd WebClients-${pkgname}-${pkgver}/applications/pass-desktop
70
71
# Copy the main application archive/assets
72
install -d "${pkgdir}"/usr/share/${pkgname}
73
cp -ar "out/Proton Pass-linux-"*/resources/* -t "${pkgdir}"/usr/share/${pkgname}
74
75
# Set up the wrapper script
76
install -d "${pkgdir}"/usr/bin
77
echo -e '#!/bin/bash\n\nexec /usr/bin/electron /usr/share/proton-pass/app.asar "$@"' \
78
| tee "${pkgdir}"/usr/bin/${pkgname} > /dev/null
79
chmod +x "${pkgdir}"/usr/bin/${pkgname}
80
81
# Copy the desktop file (and associated icon)
82
install -Dm644 assets/logo.svg "${pkgdir}"/usr/share/pixmaps/${pkgname}.svg
83
install -Dm644 "${srcdir}"/${pkgname}.desktop -t "${pkgdir}"/usr/share/applications
84
}
85
Changes since previous scan
--- PKGBUILD @ 2026-10-25 05:41+++ PKGBUILD @ 2026-10-26 11:44@@ -5,28 +5,39 @@ # shellcheck shell=bash disable=SC2034,SC2164 pkgname=proton-pass-pkgver=1.38.2+pkgver=1.43.0 pkgrel=1 pkgdesc="Open-source and secure identity manager" arch=('aarch64' 'x86_64') url="https://proton.me/pass" license=('GPL-3.0-or-later') depends=('bash' 'gcc-libs' 'glibc' 'electron')-makedepends=('nodejs-lts-jod' 'rust' 'yarn')+makedepends=('nodejs' 'pnpm' 'rust') conflicts=('proton-pass-bin') source=("${pkgname}-${pkgver}.tar.gz::https://github.com/ProtonMail/WebClients/archive/refs/tags/${pkgname}@${pkgver}.tar.gz" "proton-pass.desktop")-sha256sums=('e2f6861dfef51ebb41004631e09d05b3cd4ec32d8b8c75ff4649306f7bc0f73c'- '501210c67fc921a2fb4ba591980192ad1da60e26fb6b2fd7d68aad4075eafac7')+sha256sums=('4bec62194dfc4c7036a9a8af1229252f4f6bf98c42a5d4f05401d9970412f532'+ '1c5c6373a3e3be71e34e42fa6c7486601f04a645763496c5a808bc843456e0fc') prepare() { cd WebClients-${pkgname}-${pkgver} - # Limit workspace applications to avoid mysterious dependency issues- sed -i 's@"applications/\*",@"applications/pass*",@' package.json+ # Only define Pass application packages to avoid problematic Proton repo dependencies+ sed -i 's@applications/\*@applications/pass*@' pnpm-workspace.yaml++ # Patch out the usage/resolution of problematic tpe packages+ sed -i '/.*- tests.*/d' pnpm-workspace.yaml+ sed -i -E '/ tests:/{:a;N;/utilities\/ci-pass:/!ba;s/ tests:.*(utilities\/ci-pass:)/ \1/;}' pnpm-lock.yaml+ sed -i -E $'/ \'@tpe\/loki-client/{:a;N;/\'@trivago\/prettier-plugin/!ba;s/ \'@tpe\/loki-client.*(\'@trivago\/prettier-plugin)/ \\1/;}' pnpm-lock.yaml++ # Skip broken internal repo for protontech packages+ sed -i '/@protontech/d' .npmrc # Bypass pass-desktop-native build script (removes npm/rustup requirement and Rust target hardcoding)- sed -i 's@build"@build:napi \&\& yarn run build:host"@' applications/pass-desktop/package.json+ sed -i 's@build"@build:napi \&\& pnpm run build:host"@' applications/pass-desktop/package.json++ # Freeze the lockfile when building the Rust component+ sed -i 's@--release@--release --locked@' applications/pass-desktop/native/package.json # Skip electron-forge in build step (needed for .asar size improvement below) sed -i 's@ && electron-forge package@@' applications/pass-desktop/package.json@@ -38,15 +49,18 @@ build() { cd WebClients-${pkgname}-${pkgver}/applications/pass-desktop - # HACK: Update to a non-broken nan version (implicitly runs yarn install)- yarn up -R nan+ # Update Proton logger dependency to a version available on npm+ pnpm add '@protontech/logger@1.0.0' --ignore-scripts - yarn run build:desktop+ # preinstall script is ran from a mysterious missing utilities directory+ pnpm install --frozen-lockfile --no-runtime --ignore-scripts++ pnpm run build:desktop # HACK: Move Rust target directory to avoid asset-relocator including it (reduces size of .asar file) { mv native/target ../rust-target- yarn exec 'NODE_ENV=production electron-forge package'+ pnpm exec 'NODE_ENV=production electron-forge package' mv ../rust-target native/target } }Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-26 11:44:54 | Medium | 1 |
| 2026-10-25 05:41:54 | Clean | 0 |
| 2026-07-28 09:37:42 | Clean | 0 |
| 2026-06-18 16:11:54 | Clean | 0 |