pudu-launcher-git

LOW

maintainer gillesgillespie 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The npx tauri build command is used to build the project from its own source code, which is checked out from the project's official Git repository; this is a normal part of the build process for Tauri-based applications and does not execute arbitrary remote code.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The npx tauri build command is used to build the project from its own source code, which is checked out from the project's official Git repository; this is a normal part of the build process for Tauri-based applications and does not execute arbitrary remote code.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:64 npx tauri build -b deb

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer:
    
      2pkgname=pudu-launcher-git
    
      3pkgver=r12.d57587d
    
      4pkgrel=2
    
      5pkgdesc="Alternative game launcher for Unitystation"
    
      6arch=('x86_64')
    
      7url="https://github.com/corp-0/PuduLauncher"
    
      8license=('MIT')
    
      9depends=(
    
      10  'cairo'
    
      11  'desktop-file-utils'
    
      12  'gdk-pixbuf2'
    
      13  'glib2'
    
      14  'gtk3'
    
      15  'hicolor-icon-theme'
    
      16  'libsoup3'
    
      17  'openssl'
    
      18  'pango'
    
      19  'webkit2gtk-4.1'
    
      20)
    
      21makedepends=(
    
      22  'clang'
    
      23  'dotnet-sdk-10.0'
    
      24  'git'
    
      25  'libappindicator-gtk3'
    
      26  'librsvg'
    
      27  'nodejs'
    
      28  'npm'
    
      29  'patchelf'
    
      30  'rust'
    
      31  'zlib'
    
      32)
    
      33install=pudu-launcher.install
    
      34provides=('pudu-launcher')
    
      35conflicts=('pudu-launcher')
    
      36options=(!lto)  # ring crate's assembly objects break with Arch's system-wide -flto
    
      37source=("git+${url}.git")
    
      38sha256sums=('SKIP')
    
      39
    
      40pkgver() {
    
      41  cd PuduLauncher
    
      42  ( set -o pipefail
    
      43    git describe --long --abbrev=7 2>/dev/null | sed 's/\([^-]*-g\)/r\1/;s/-/./g' ||
    
      44    printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
    
      45  )
    
      46}
    
      47
    
      48prepare() {
    
      49  cd PuduLauncher
    
      50  git submodule update --init --recursive
    
      51  # `generate-ts` runs `dotnet build -c Debug`; keep AOT/trim for release publish only.
    
      52  sed -i "s|<PublishAot>true</PublishAot>|<PublishAot Condition=\"'\\\$(Configuration)' == 'Release'\">true</PublishAot>|" src-dotnet/PuduLauncher/PuduLauncher.csproj
    
      53  sed -i "s|<PublishTrimmed>true</PublishTrimmed>|<PublishTrimmed Condition=\"'\\\$(Configuration)' == 'Release'\">true</PublishTrimmed>|" src-dotnet/PuduLauncher/PuduLauncher.csproj
    
      54  # Disable signed updater artifacts - AUR users don't have the private key
    
      55  sed -i 's/"createUpdaterArtifacts": true/"createUpdaterArtifacts": false/' src-tauri/tauri.conf.json
    
      56  npm ci
    
      57}
    
      58
    
      59build() {
    
      60  cd PuduLauncher
    
      61  export DOTNET_CLI_TELEMETRY_OPTOUT=1
    
      62  export DOTNET_SKIP_FIRST_TIME_EXPERIENCE=1
    
      63  export AllowMissingPrunePackageData=true
    
      64  npx tauri build -b deb
    
      65}
    
      66
    
      67package() {
    
      68  cd "${srcdir}/PuduLauncher/src-tauri/target/release/bundle/deb"
    
      69  cp -a pudu-launcher_*/data/usr "${pkgdir}/"
    
      70}
    
      71

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2