radicle-desktop
maintainer geigerzaehler
· 1 votes
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The source is a git repository from the project's own domain, and the npx tauri build command is part of the standard build process for a Tauri-based application, not remote code execution.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source is a git repository from the project's own domain, and the npx tauri build command is part of the standard build process for a Tauri-based application, not remote code execution.
2 higher static findings superseded - not the current verdict (shown for transparency)
MEDIUM
npx/bunx/deno executes a remote package
remote_code_tool
`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.
-
PKGBUILD:51
npx tauri build --bundles deb
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:38
source=("$pkgname::git+https://seed.radicle.dev/z4D5UCArafTzTQpDZNQRuqswh3ury.git#commit=$_commit")
PKGBUILD
2 offending line(s) highlighted
1
# Maintainer: Thomas Scholtes <geigerzaehler@axiom.fm>
2
#
3
# shellcheck shell=bash disable=SC2034 disable=SC2154 disable=SC2164
4
5
_commit=6e1472d8ab553257c73758b09f47813099468137
6
pkgname=radicle-desktop
7
pkgver='0.14.0'
8
pkgrel='1'
9
pkgdesc='Radicle desktop app'
10
arch=('x86_64')
11
url='https://radicle.dev/'
12
license=('GPL-3.0-only')
13
depends=(
14
'radicle-node'
15
# See https://v2.tauri.app/distribute/aur/#building-from-source
16
'cairo'
17
'desktop-file-utils'
18
'gdk-pixbuf2'
19
'glib2'
20
'gtk3'
21
'hicolor-icon-theme'
22
'libsoup3'
23
'pango'
24
'webkit2gtk-4.1'
25
)
26
makedepends=(
27
# See https://v2.tauri.app/distribute/aur/#building-from-source
28
'git'
29
'openssl'
30
'appmenu-gtk-module'
31
'libappindicator-gtk3'
32
'librsvg'
33
'cargo'
34
'npm'
35
'nodejs'
36
)
37
options=('!strip' '!emptydirs' '!lto')
38
source=("$pkgname::git+https://seed.radicle.dev/z4D5UCArafTzTQpDZNQRuqswh3ury.git#commit=$_commit")
39
sha256sums=('SKIP')
40
41
prepare() {
42
cd "$pkgname"
43
44
npm install
45
cargo fetch --locked --target "$(rustc -vV | sed -n 's/host: //p')"
46
}
47
48
build() {
49
cd "$pkgname"
50
51
npx tauri build --bundles deb
52
}
53
54
package() {
55
cp -a $pkgname/target/release/bundle/deb/${pkgname}_${pkgver}_*/data/* "${pkgdir}"
56
}
57
Changes since previous scan
--- PKGBUILD @ 2026-07-27 00:24+++ PKGBUILD @ 2026-08-03 00:08@@ -2,9 +2,9 @@ # # shellcheck shell=bash disable=SC2034 disable=SC2154 disable=SC2164 -_commit=e7b6d054d420e6bf2fe877155d7f1fc7a046b672+_commit=6e1472d8ab553257c73758b09f47813099468137 pkgname=radicle-desktop-pkgver='0.13.0'+pkgver='0.14.0' pkgrel='1' pkgdesc='Radicle desktop app' arch=('x86_64')Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 3 |
| 2026-08-02 00:16:08 | LOW | 3 |
| 2026-08-01 00:11:18 | LOW | 3 |
| 2026-07-31 00:14:10 | LOW | 3 |
| 2026-07-30 00:17:23 | LOW | 3 |
| 2026-07-29 00:25:53 | LOW | 3 |
| 2026-07-28 00:07:28 | LOW | 3 |
| 2026-07-27 17:35:03 | MEDIUM | 2 |
| 2026-07-27 00:24:32 | LOW | 3 |
| 2026-07-26 00:07:32 | LOW | 3 |
| 2026-07-25 00:13:44 | LOW | 3 |
| 2026-07-24 00:02:28 | LOW | 3 |
| 2026-07-23 00:14:47 | LOW | 3 |
| 2026-07-22 00:29:32 | LOW | 3 |
| 2026-07-21 00:24:15 | LOW | 3 |
| 2026-07-20 00:19:49 | LOW | 3 |
| 2026-07-19 00:17:08 | LOW | 3 |
| 2026-07-18 00:14:48 | LOW | 3 |
| 2026-07-17 00:06:16 | LOW | 3 |
| 2026-07-16 00:05:41 | LOW | 3 |