quarkdown (MEDIUM)

Triggered rules

Medium npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:25 npm install-scripts approve --all

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Caleb Maclennan <caleb@alerque.com>
    
      2
    
      3pkgname=quarkdown
    
      4pkgver=2.6.0
    
      5pkgrel=2
    
      6_jdkver=21
    
      7pkgdesc='a Markdown based typesetting system'
    
      8arch=(any)
    
      9url="https://github.com/iamgio/$pkgname"
    
      10license=(AGPL-3.0-only)
    
      11depends=(bash
    
      12         "java-runtime-openjdk=$_jdkver")
    
      13makedepends=(nodejs-lts-krypton
    
      14             npm
    
      15             "java-environment-openjdk=$_jdkver")
    
      16optdepends=('chromium: generate PDF output')
    
      17_archive="$pkgname-$pkgver"
    
      18source=("$url/archive/v$pkgver/$_archive.tar.gz")
    
      19sha256sums=('67f12e2ef33d62daf80b74e20e634ded1c02c7d4d2a62ed7bdf5e89192f883e0')
    
      20
    
      21build() {
    
      22	export JAVA_HOME="/usr/lib/jvm/java-$_jdkver-openjdk"
    
      23	export PATH="/usr/lib/jvm/java-$_jdkver-openjdk/bin:$PATH"
    
      24	cd "$_archive"
    
      25	npm install-scripts approve --all
    
      26	./gradlew --no-daemon installDist
    
      27}
    
      28
    
      29package() {
    
      30	cd "$_archive"
    
      31	local _sharedir="/usr/share/$pkgname"
    
      32	mkdir -p "$pkgdir/$_sharedir"
    
      33	cp -a build/install/quarkdown/lib "$pkgdir/$_sharedir/"
    
      34	cat <<- EOF | install -Dm0755 /dev/stdin "$pkgdir/usr/bin/$pkgname"
    
      35		#!/usr/bin/env bash
    
      36		export JAVA_HOME='/usr/lib/jvm/java-$_jdkver-openjdk'
    
      37		export QD_CHROME_PATH='/usr/bin/chromium'
    
      38		exec java -cp '$_sharedir/lib/*' com.quarkdown.cli.QuarkdownCliKt "\$@"
    
      39	EOF
    
      40}
    
      41

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-09-08 09:16
@@ -1,40 +1,41 @@
 # Maintainer: Caleb Maclennan <caleb@alerque.com>
 
 pkgname=quarkdown
-pkgver=1.8.0
-pkgrel=1
+pkgver=2.6.0
+pkgrel=2
 _jdkver=21
 pkgdesc='a Markdown based typesetting system'
 arch=(any)
 url="https://github.com/iamgio/$pkgname"
-license=(Apache-2.0)
+license=(AGPL-3.0-only)
 depends=(bash
          "java-runtime-openjdk=$_jdkver")
-makedepends=(gradle
+makedepends=(nodejs-lts-krypton
+             npm
              "java-environment-openjdk=$_jdkver")
-optdepends=('puppeteer: generate PDF output')
+optdepends=('chromium: generate PDF output')
 _archive="$pkgname-$pkgver"
 source=("$url/archive/v$pkgver/$_archive.tar.gz")
-sha256sums=('bb63369ad5380fac9729723c68388ac0cf9f6afc768f6c8314a9d0dcaba891d7')
+sha256sums=('67f12e2ef33d62daf80b74e20e634ded1c02c7d4d2a62ed7bdf5e89192f883e0')
 
 build() {
 	export JAVA_HOME="/usr/lib/jvm/java-$_jdkver-openjdk"
 	export PATH="/usr/lib/jvm/java-$_jdkver-openjdk/bin:$PATH"
 	cd "$_archive"
-	gradle --no-daemon shadowJar
+	npm install-scripts approve --all
+	./gradlew --no-daemon installDist
 }
 
 package() {
 	cd "$_archive"
 	local _sharedir="/usr/share/$pkgname"
-	install -Dm0644 -t "$pkgdir/$_sharedir/java/" "build/libs/$pkgname.jar"
-	install -Dm0644 -t "$pkgdir/$_sharedir/lib/qd/" quarkdown-libs/src/main/resources/*.qd
+	mkdir -p "$pkgdir/$_sharedir"
+	cp -a build/install/quarkdown/lib "$pkgdir/$_sharedir/"
 	cat <<- EOF | install -Dm0755 /dev/stdin "$pkgdir/usr/bin/$pkgname"
 		#!/usr/bin/env bash
 		export JAVA_HOME='/usr/lib/jvm/java-$_jdkver-openjdk'
-		export NODE_PATH='/usr/lib/node_modules'
-		export QD_NPM_PREFIX='/usr/lib'
-		exec java -jar '$_sharedir/java/$pkgname.jar' "\$@"
+		export QD_CHROME_PATH='/usr/bin/chromium'
+		exec java -cp '$_sharedir/lib/*' com.quarkdown.cli.QuarkdownCliKt "\$@"
 	EOF
 }
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-08 09:16:51	Medium	1
2026-06-18 16:11:54	Clean	0