rancher-desktop

LOW

maintainer dgiebert 10 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The flagged 'undeclared external package' install via yarn is part of the standard build process for the project's own source code from the official GitHub repository, not an unauthorized or hidden dependency injection.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The flagged 'undeclared external package' install via yarn is part of the standard build process for the project's own source code from the official GitHub repository, not an unauthorized or hidden dependency injection.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:52 npm install --global yarn

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Dominic Giebert <dominic.giebert@gmail.com>
    
      2# Contributor: Parker Johansen <johansen.parker@gmail.com>
    
      3
    
      4pkgname=rancher-desktop
    
      5pkgdesc='Rancher Desktop is an open-source project to bring Kubernetes and container management to the desktop'
    
      6pkgver=1.24.0
    
      7pkgrel=1
    
      8arch=('x86_64')
    
      9license=('Apache')
    
      10url='https://rancherdesktop.io/'
    
      11makedepends=('npm' 'nvm' 'nodejs' 'imagemagick' 'go')
    
      12provides=('rancher-desktop' 'docker' 'helm' 'kubectl' 'nerdctl' 'limactl')
    
      13depends=('qemu')
    
      14source=("https://github.com/rancher-sandbox/rancher-desktop/archive/refs/tags/v${pkgver}.tar.gz")
    
      15sha256sums=('300b80a958cff00515229b5de58724fb63523f06c335f949139befd1fd7317f4')
    
      16options=(!debug)
    
      17
    
      18# https://wiki.archlinux.org/title/Node.js_package_guidelines#Using_nvm
    
      19_ensure_local_nvm() {
    
      20    which nvm >/dev/null 2>&1 && nvm deactivate && nvm unload
    
      21    export NVM_DIR="${srcdir}/.nvm"
    
      22    source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
    
      23}
    
      24
    
      25prepare() {
    
      26    _ensure_local_nvm
    
      27    nvm install 22
    
      28
    
      29		yarn set version stable
    
      30
    
      31    cd "${pkgname}-${pkgver}"
    
      32    sed -i "s|childProcess.execFileSync('git', \['describe', '--tags'\]).toString().trim()|'v${pkgver}'|g" scripts/package.ts
    
      33
    
      34}
    
      35
    
      36build() {
    
      37   _ensure_local_nvm
    
      38  cd "${pkgname}-${pkgver}"
    
      39  # Generate icons
    
      40    icon="resources/icons/logo-square-512.png"
    
      41    for size in 512x512 256x256 128x128 96x96 64x64 48x48 32x32 24x24 16x16; do
    
      42        mkdir "share/icons/hicolor/${size}/apps" -p
    
      43        magick "${icon}" -resize "${size}" "share/icons/hicolor/${size}/apps/${pkgname}.png"
    
      44    done
    
      45
    
      46  sed -i "s|target: \[ zip \]|target: [ dir ]|g" packaging/electron-builder.yml
    
      47
    
      48  # Remove Flatpak and appimage as they are not needed
    
      49  rm packaging/linux/appimage.yml
    
      50  rm packaging/linux/flatpak.yaml
    
      51  # https://github.com/rancher-sandbox/rancher-desktop#how-to-run
    
      52  npm install --global yarn
    
      53  yarn
    
      54  yarn build
    
      55  yarn package --publish=never
    
      56}
    
      57
    
      58package() {
    
      59  cd "${pkgname%-bin}-$pkgver"
    
      60
    
      61  # Copy over the data
    
      62  install -d "$pkgdir/opt/${pkgname}"
    
      63  install -d "$pkgdir/usr/share/icons/hicolor/"
    
      64  cp -r dist/linux-unpacked/* "$pkgdir/opt/${pkgname}/"
    
      65  cp -r share/icons/hicolor/* "$pkgdir/usr/share/icons/hicolor/"
    
      66  install -Dm644 LICENSE -t "${pkgdir}/usr/share/licenses/${pkgname}"
    
      67
    
      68  # Some weird fix
    
      69  # Add integration for desktop env
    
      70  install -Dm644 dist/linux-unpacked/resources/resources/linux/rancher-desktop.desktop -t "$pkgdir/usr/share/applications"
    
      71  install -Dm644 dist/linux-unpacked/resources/resources/linux/rancher-desktop.appdata.xml -t "$pkgdir/usr/share/metainfo"
    
      72
    
      73  # Creating the symlink for better usage
    
      74  install -d "$pkgdir"/usr/bin/
    
      75  ln -sf /opt/${pkgname}/${pkgname} ${pkgdir}/usr/bin/${pkgname}
    
      76}
    
      77

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2