rayburst-git
LOW
maintainer zxp19821005
0 votes
scanned 2026-11-02 00:26:00.633185
Why flagged
The package installs a version-pinned pnpm from npm via a variable derived from package.json, but this is part of a standard, self-contained build process for a project that builds its own application using common Node.js tooling; the source is from the official npm registry and the build occurs in an isolated environment.
Triggered rules
Low
AI review of an ambiguous pattern
llm_review
The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it LOW (confidence 95%): The package installs a version-pinned pnpm from npm via a variable derived from package.json, but this is part of a standard, self-contained build process for a project that builds its own application using common Node.js tooling; the source is from the official npm registry and the build occurs in an isolated environment.
-
PKGBUILD:89
npm install -g "pnpm@${_pnpmver}" --prefix "${HOME}/.pnpm" \
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2
pkgname=rayburst-git
3
_pkgname=Rayburst
4
pkgver=4.1.0.beta.5.r0.g63d2ec6
5
_nodeversion=24
6
pkgrel=1
7
pkgdesc="Redefining the open-source download manager."
8
arch=(
9
'aarch64'
10
'x86_64'
11
)
12
url="https://rayburst.pages.dev/"
13
_ghurl="https://github.com/AnInsomniacy/rayburst"
14
license=('MIT')
15
provides=("${pkgname%-git}=${pkgver%.r*}")
16
conflicts=("${pkgname%-git}")
17
depends=(
18
'gtk3'
19
'gdk-pixbuf2'
20
'webkit2gtk-4.1'
21
'libayatana-appindicator'
22
)
23
makedepends=(
24
'nvm'
25
'git'
26
'rustup'
27
'pnpm'
28
'jq'
29
)
30
source=("${pkgname//-/.}::git+${_ghurl}.git")
31
sha256sums=('SKIP')
32
_get_project_dir() {
33
find "${srcdir}" -name "src-tauri" -type d ! -path "*/node_modules/*" 2>/dev/null | \
34
while read -r tauri_dir; do
35
[ -f "${tauri_dir}/Cargo.toml" ] || continue
36
local dir="${tauri_dir}"
37
until [ -f "${dir}/package.json" ] || [ "$dir" = "${srcdir}" ] || [ "$dir" = "/" ]; do
38
dir="$(dirname "$dir")"
39
done
40
[ -f "${dir}/package.json" ] && { echo "$dir"; return; }
41
done
42
}
43
pkgver() {
44
cd "$(_get_project_dir)"
45
set -o pipefail
46
git describe --long --abbrev=7 2>/dev/null | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//' ||
47
printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
48
}
49
_ensure_local_nvm() {
50
local NVM_DIR="${srcdir}/.nvm"
51
source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
52
nvm install "${_nodeversion}"
53
nvm use "${_nodeversion}"
54
}
55
_set_build_env() {
56
export HOME="${srcdir}/.home"
57
export XDG_CACHE_HOME="${HOME}/.cache"
58
export XDG_CONFIG_HOME="${HOME}/.config"
59
export XDG_DATA_HOME="${HOME}/.local/share"
60
export XDG_STATE_HOME="${HOME}/.local/state"
61
export PNPM_HOME="${HOME}/.pnpm/bin"
62
export pnpm_config_cache_dir="${HOME}/.pnpm_cache"
63
export pnpm_config_store_dir="${HOME}/.pnpm_store"
64
export pnpm_config_global_dir="${HOME}/.pnpm/global"
65
export pnpm_config_state_dir="${HOME}/.pnpm/state"
66
export pnpm_config_node_linker=hoisted
67
export pnpm_config_minimum_release_age=0
68
export pnpm_config_update_notifier=false
69
export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
70
export COREPACK_HOME="${HOME}/.corepack"
71
export CARGO_HOME="${HOME}/.cargo"
72
export CARGO_NET_GIT_FETCH_WITH_CLI=true
73
export CARGO_NET_RETRY=5
74
export CARGO_HTTP_MULTIPLEXING=false
75
export CARGO_INCREMENTAL=0
76
export CARGO_TERM_COLOR=never
77
export CARGO_PROFILE_RELEASE_STRIP=symbols
78
mkdir -p "${HOME}" "${CARGO_HOME}" "${PNPM_HOME}" "${pnpm_config_cache_dir}" "${pnpm_config_store_dir}" "${pnpm_config_global_dir}" "${pnpm_config_state_dir}" "${COREPACK_HOME}"
79
export PATH="${PNPM_HOME}:${PATH}"
80
local _pnpmver=""
81
local _pkgjson="$(_get_project_dir)/package.json"
82
if [ -f "${_pkgjson}" ]; then
83
_pnpmver="$(grep -o '"packageManager"[^,]*' "${_pkgjson}" 2>/dev/null | grep -oE 'pnpm@[^"+]+' | head -n1 | sed 's/^pnpm@//')"
84
if [ -z "${_pnpmver}" ]; then
85
_pnpmver="$(grep -oE '"pnpm"[[:space:]]*:[[:space:]]*"[^"]+"' "${_pkgjson}" 2>/dev/null | grep -oE '[0-9][0-9.]*' | head -n1)"
86
fi
87
fi
88
if [ -n "${_pnpmver}" ]; then
89
npm install -g "pnpm@${_pnpmver}" --prefix "${HOME}/.pnpm" \
90
--registry "${COREPACK_NPM_REGISTRY}"
91
fi
92
}
93
prepare() {
94
cd "$(_get_project_dir)"
95
_ensure_local_nvm
96
_set_build_env
97
jq '.bundle.active = false' src-tauri/tauri.conf.json > tmp.json && mv tmp.json src-tauri/tauri.conf.json
98
sed -i -e "
99
s/{{categories}}/Network;/g
100
s/{{comment}}/${pkgdesc}/g
101
s/{{exec}}/${pkgname%-git}/g
102
s/{{icon}}/${pkgname%-git}/g
103
s/{{name}}/${_pkgname}/g
104
" "src-tauri/linux/${pkgname%-git}.desktop.hbs"
105
cp src-tauri/icons/128x128@2x.png src-tauri/icons/256x256.png
106
rustup update stable
107
rustup default stable
108
export NODE_ENV=development
109
pnpm install
110
}
111
build() {
112
cd "$(_get_project_dir)"
113
export NODE_ENV=production
114
pnpm run tauri build
115
}
116
package() {
117
local _targetdir="$(_get_project_dir)/src-tauri"
118
install -Dm755 "${_targetdir}/target/release/"{aria2-next,"${pkgname%-git}","${pkgname%-git}-browser-launcher"} -t "${pkgdir}/usr/lib/${_pkgname}/bin"
119
install -dm755 "${pkgdir}/usr/bin"
120
ln -s "/usr/lib/${_pkgname}/bin/${pkgname%-git}" "${pkgdir}/usr/bin/${pkgname%-git}"
121
cp -a "${_targetdir}/data" "${pkgdir}/usr/lib/${_pkgname}"
122
install -Dm644 "${_targetdir}/linux/${pkgname%-git}.desktop.hbs" "${pkgdir}/usr/share/applications/${pkgname%-git}.desktop"
123
_icon_sizes=(32x32 64x64 128x128 256x256)
124
for _icons in "${_icon_sizes[@]}";do
125
install -Dm644 "${_targetdir}/icons/${_icons}.png" \
126
-t "${pkgdir}/usr/share/icons/hicolor/${_icons}/apps"
127
done
128
install -Dm644 "$(_get_project_dir)/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
129
}
130
Changes since previous scan
--- PKGBUILD @ 2026-10-15 00:28+++ PKGBUILD @ 2026-11-02 00:26@@ -1,11 +1,14 @@ # Maintainer: zxp19821005 <zxp19821005 at 163 dot com> pkgname=rayburst-git _pkgname=Rayburst-pkgver=4.1.0.beta.1.r0.g86cc8e6+pkgver=4.1.0.beta.5.r0.g63d2ec6 _nodeversion=24 pkgrel=1 pkgdesc="Redefining the open-source download manager."-arch=('any')+arch=(+ 'aarch64'+ 'x86_64'+) url="https://rayburst.pages.dev/" _ghurl="https://github.com/AnInsomniacy/rayburst" license=('MIT')@@ -16,7 +19,6 @@ 'gdk-pixbuf2' 'webkit2gtk-4.1' 'libayatana-appindicator'- 'aria2-next' ) makedepends=( 'nvm'@@ -28,10 +30,15 @@ source=("${pkgname//-/.}::git+${_ghurl}.git") sha256sums=('SKIP') _get_project_dir() {- local d- while IFS= read -r d; do- find "$d" -name "src-tauri" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }- done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')+ find "${srcdir}" -name "src-tauri" -type d ! -path "*/node_modules/*" 2>/dev/null | \+ while read -r tauri_dir; do+ [ -f "${tauri_dir}/Cargo.toml" ] || continue+ local dir="${tauri_dir}"+ until [ -f "${dir}/package.json" ] || [ "$dir" = "${srcdir}" ] || [ "$dir" = "/" ]; do+ dir="$(dirname "$dir")"+ done+ [ -f "${dir}/package.json" ] && { echo "$dir"; return; }+ done } pkgver() { cd "$(_get_project_dir)"@@ -95,9 +102,9 @@ s/{{icon}}/${pkgname%-git}/g s/{{name}}/${_pkgname}/g " "src-tauri/linux/${pkgname%-git}.desktop.hbs"+ cp src-tauri/icons/128x128@2x.png src-tauri/icons/256x256.png rustup update stable rustup default stable- cp src-tauri/icons/128x128@2x.png src-tauri/icons/256x256.png export NODE_ENV=development pnpm install }@@ -107,10 +114,10 @@ pnpm run tauri build } package() {- local _src="$(_get_project_dir)"- local _targetdir="${_src}/src-tauri"- install -Dm755 "${_targetdir}/target/release/"{"${pkgname%-git}","${pkgname%-git}-browser-launcher"} -t "${pkgdir}/usr/bin"- install -dm755 "${pkgdir}/usr/lib/${_pkgname}"+ local _targetdir="$(_get_project_dir)/src-tauri"+ install -Dm755 "${_targetdir}/target/release/"{aria2-next,"${pkgname%-git}","${pkgname%-git}-browser-launcher"} -t "${pkgdir}/usr/lib/${_pkgname}/bin"+ install -dm755 "${pkgdir}/usr/bin"+ ln -s "/usr/lib/${_pkgname}/bin/${pkgname%-git}" "${pkgdir}/usr/bin/${pkgname%-git}" cp -a "${_targetdir}/data" "${pkgdir}/usr/lib/${_pkgname}" install -Dm644 "${_targetdir}/linux/${pkgname%-git}.desktop.hbs" "${pkgdir}/usr/share/applications/${pkgname%-git}.desktop" _icon_sizes=(32x32 64x64 128x128 256x256)@@ -118,6 +125,6 @@ install -Dm644 "${_targetdir}/icons/${_icons}.png" \ -t "${pkgdir}/usr/share/icons/hicolor/${_icons}/apps" done- install -Dm644 "${_src}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"+ install -Dm644 "$(_get_project_dir)/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}" } Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-02 00:26:00 | Low | 1 |
| 2026-11-01 00:21:48 | Low | 1 |
| 2026-10-31 00:07:41 | Low | 1 |
| 2026-10-30 00:29:30 | Low | 1 |
| 2026-10-29 00:13:55 | Low | 1 |
| 2026-10-28 00:06:54 | Low | 1 |
| 2026-10-27 00:23:28 | Low | 1 |
| 2026-10-26 00:12:40 | Low | 1 |
| 2026-10-25 00:20:48 | Low | 1 |
| 2026-10-24 00:14:55 | Low | 1 |
| 2026-10-23 00:02:19 | Low | 1 |
| 2026-10-22 00:13:10 | Low | 1 |
| 2026-10-21 00:12:50 | Low | 1 |
| 2026-10-20 00:10:31 | Low | 1 |
| 2026-10-19 00:03:55 | Low | 1 |
| 2026-10-18 00:06:55 | Low | 1 |
| 2026-10-17 00:21:55 | Low | 1 |
| 2026-10-16 00:12:47 | Low | 1 |
| 2026-10-15 01:21:20 | Low | 1 |
| 2026-10-15 00:28:05 | Low | 1 |