quarkdown

LOW

maintainer alerque 2 votes scanned 2026-10-23 00:02:19.781852

View on AUR

Why flagged

The npm command runs 'approve --all' which is part of the project's own build process from source, not an external package install; the source is a verified tarball from the project's GitHub repo.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The npm command runs 'approve --all' which is part of the project's own build process from source, not an external package install; the source is a verified tarball from the project's GitHub repo.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:25 npm install-scripts approve --all

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Caleb Maclennan <caleb@alerque.com>
    
      2
    
      3pkgname=quarkdown
    
      4pkgver=2.6.2
    
      5pkgrel=1
    
      6_jdkver=21
    
      7pkgdesc='a Markdown based typesetting system'
    
      8arch=(any)
    
      9url="https://github.com/iamgio/$pkgname"
    
      10license=(AGPL-3.0-only)
    
      11depends=(bash
    
      12         "java-runtime-openjdk=$_jdkver")
    
      13makedepends=(nodejs-lts-krypton
    
      14             npm
    
      15             "java-environment-openjdk=$_jdkver")
    
      16optdepends=('chromium: generate PDF output')
    
      17_archive="$pkgname-$pkgver"
    
      18source=("$url/archive/v$pkgver/$_archive.tar.gz")
    
      19sha256sums=('79a023a8e67142807418dd561cd9627a954269768353d066a7430c81989b760d')
    
      20
    
      21build() {
    
      22	export JAVA_HOME="/usr/lib/jvm/java-$_jdkver-openjdk"
    
      23	export PATH="/usr/lib/jvm/java-$_jdkver-openjdk/bin:$PATH"
    
      24	cd "$_archive"
    
      25	npm install-scripts approve --all
    
      26	./gradlew --no-daemon installDist
    
      27}
    
      28
    
      29package() {
    
      30	cd "$_archive"
    
      31	local _sharedir="/usr/share/$pkgname"
    
      32	mkdir -p "$pkgdir/$_sharedir"
    
      33	cp -a build/install/quarkdown/lib "$pkgdir/$_sharedir/"
    
      34	cat <<- EOF | install -Dm0755 /dev/stdin "$pkgdir/usr/bin/$pkgname"
    
      35		#!/usr/bin/env bash
    
      36		export JAVA_HOME='/usr/lib/jvm/java-$_jdkver-openjdk'
    
      37		export QD_CHROME_PATH='/usr/bin/chromium'
    
      38		exec java -cp '$_sharedir/lib/*' com.quarkdown.cli.QuarkdownCliKt "\$@"
    
      39	EOF
    
      40}
    
      41

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-23 00:02:19	Low	2
2026-10-22 00:13:10	Low	2
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2
2026-10-13 00:23:45	Low	2
2026-10-12 00:18:51	Low	2
2026-10-11 00:26:05	Low	2
2026-10-10 00:11:52	Low	2
2026-10-09 00:05:33	Low	2
2026-10-08 00:28:03	Low	2
2026-10-07 00:21:34	Low	2
2026-10-06 00:13:36	Low	2
2026-10-05 00:08:03	Low	2
2026-10-04 00:18:08	Low	2