resd-mini

MEDIUM
maintainer taotieren 0 votes scanned 2026-10-27 11:47:37.152749
View on AUR
Why flagged

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

Triggered rules

Medium npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

  • PKGBUILD:70 pnpm install --force --allow-build esbuild --allow-build @parcel/watcher --allow-build vue-demi

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: taotieren <admin@taotieren.com>
2
3pkgname=resd-mini
4pkgver=3.1.3
5pkgrel=3
6pkgdesc="This is the mini version of a high-value, high-performance and diverse resource downloader called res-downloader."
7arch=($CARCH)
8url="https://github.com/putyy/resd-mini"
9license=('Apache-2.0')
10provides=(${pkgname})
11conflicts=(${pkgname})
12# replaces=(${pkgname})
13depends=(
14 glibc
15 hicolor-icon-theme
16)
17makedepends=(
18 pnpm
19 git
20 go
21 nodejs
22)
23optdepends=(
24 'motrix: A full-featured download manager (release version)'
25 'gopeed-bin: High speed downloader that supports all platforms.(Prebuilt version)'
26 'res-downloader: This is a high-value and high-performance and diverse resource downloader called res-downloader'
27)
28backup=()
29options=(!debug !strip !lto)
30install=${pkgname}.install
31source=(
32 "${pkgname}::git+${url}.git#tag=${pkgver}"
33 ${pkgname}.install)
34sha256sums=('b64fd88871ef9b61f7f6adab9a37063b57f367faebc8f314c060f7add364e562'
35 '46feddf76850fb1a3991f8f82e5ee738b28070e34339e02dbc1f52c83dea5a73')
36
37prepare() {
38 git -C "${srcdir}/${pkgname}" clean -dfx
39 cd "${srcdir}/${pkgname}/web"
40 rm -rf node_modules pnpm-lock.yaml
41}
42
43build() {
44 cd "${srcdir}/${pkgname}/"
45
46 export npm_config_allow_remote=all
47 export CGO_CPPFLAGS="${CPPFLAGS}"
48 export CGO_CFLAGS="${CFLAGS}"
49 export CGO_CXXFLAGS="${CXXFLAGS}"
50 export CGO_LDFLAGS="${LDFLAGS}"
51 export GOFLAGS="-buildmode=pie -trimpath -ldflags=-linkmode=external -mod=readonly -modcacherw"
52 export GO111MODULE=on
53 export GOPROXY=https://goproxy.cn,direct
54
55 pushd web
56 export CARGO_HOME="${srcdir}/.cargo"
57 cat > .npmrc <<EOF
58 link-workspace-packages=true
59 fetch-retry-maxtimeout=10000
60 cache-dir=${srcdir}/.pnpm_cache
61 store-dir=${srcdir}/.pnpm_store
62 shamefully-hoist=true
63 virtual-store-dir-max-length=80
64 dangerously-allow-all-builds=true
65EOF
66
67export VITE_DEVTOOLS=false
68export NODE_ENV=production
69 # pnpm install --force --config.dangerouslyAllowAllBuilds=true
70 pnpm install --force --allow-build esbuild --allow-build @parcel/watcher --allow-build vue-demi
71 pnpm run build-only
72 popd
73 # wails build
74 go build -o ${pkgname}
75}
76
77package() {
78 cd "${srcdir}/${pkgname}/"
79
80 install -Dvm755 ${pkgname} -t ${pkgdir}/usr/bin
81 install -Dvm644 web/src/assets/image/logo.png ${pkgdir}/usr/share/icons/hicolor/512x512/apps/${pkgname}.png
82 # install -Dvm644 build/linux/Arch/${pkgname}.desktop ${pkgdir}/usr/share/applications/${pkgname}.desktop
83 install -Dvm644 /dev/stdin ${pkgdir}/usr/share/applications/${pkgname}.desktop <<EOF
84[Desktop Entry]
85Type=Application
86Name=${pkgname}
87Comment=${pkgdesc}
88Exec=${pkgname}
89Icon=${pkgname}.png
90Terminal=false
91Categories=Utility
92
93EOF
94}
95

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-10-27 11:47
@@ -2,7 +2,7 @@
pkgname=resd-mini
pkgver=3.1.3
-pkgrel=1
+pkgrel=3
pkgdesc="This is the mini version of a high-value, high-performance and diverse resource downloader called res-downloader."
arch=($CARCH)
url="https://github.com/putyy/resd-mini"
@@ -18,6 +18,7 @@
pnpm
git
go
+ nodejs
)
optdepends=(
'motrix: A full-featured download manager (release version)'
@@ -36,134 +37,41 @@
prepare() {
git -C "${srcdir}/${pkgname}" clean -dfx
cd "${srcdir}/${pkgname}/web"
- sed -i '/"@vue\/devtools-kit"/d' package.json
-
- cat > vite.config.ts << 'EOF'
-import { defineConfig } from 'vite';
-import vue from '@vitejs/plugin-vue';
-import { fileURLToPath, URL } from 'node:url';
-
-const isNode = typeof process !== 'undefined' && process.versions?.node;
-
-if (isNode && typeof window === 'undefined') {
- const mockStorage = {
- getItem: () => null,
- setItem: () => {},
- removeItem: () => {},
- clear: () => {},
- key: () => null,
- length: 0
- };
-
- (global as any).localStorage = mockStorage;
- (global as any).sessionStorage = mockStorage;
-}
-
-export default defineConfig({
- plugins: [vue({
- template: {
- compilerOptions: {
- isCustomElement: (tag: string) => tag.startsWith('media-')
- }
- }
- })],
- resolve: {
- alias: {
- '@': fileURLToPath(new URL('./src', import.meta.url))
- }
- },
- server: { port: 3000 },
- build: {
- rollupOptions: {
- output: {
- manualChunks: {
- vue: ['vue'],
- vendor: ['vue-router', 'pinia']
- }
- }
- }
- }
-});
-EOF
-
- cat > tsconfig.json << 'EOF'
-{
- "compilerOptions": {
- "target": "ES2020",
- "lib": ["ES2020", "DOM", "DOM.Iterable"],
- "module": "ESNext",
- "skipLibCheck": true,
- "moduleResolution": "bundler",
- "allowImportingTsExtensions": true,
- "resolveJsonModule": true,
- "isolatedModules": true,
- "noEmit": true,
- "jsx": "preserve",
- "strict": true,
- "noUnusedLocals": true,
- "noUnusedParameters": true,
- "noFallthroughCasesInSwitch": true,
- "baseUrl": ".",
- "paths": {
- "@/*": ["./src/*"]
- }
- },
- "include": ["src/**/*.ts", "src/**/*.d.ts", "src/**/*.tsx", "src/**/*.vue"],
- "references": [{ "path": "./tsconfig.node.json" }]
-}
-EOF
-
- cat > tsconfig.node.json << 'EOF'
-{
- "compilerOptions": {
- "composite": true,
- "skipLibCheck": true,
- "module": "ESNext",
- "moduleResolution": "bundler",
- "allowSyntheticDefaultImports": true,
- "strict": true,
- "types": ["node"]
- },
- "include": ["vite.config.ts"]
-}
-EOF
rm -rf node_modules pnpm-lock.yaml
}
build() {
- cd "${srcdir}/${pkgname}/"
+ cd "${srcdir}/${pkgname}/"
+ export npm_config_allow_remote=all
+ export CGO_CPPFLAGS="${CPPFLAGS}"
+ export CGO_CFLAGS="${CFLAGS}"
+ export CGO_CXXFLAGS="${CXXFLAGS}"
+ export CGO_LDFLAGS="${LDFLAGS}"
+ export GOFLAGS="-buildmode=pie -trimpath -ldflags=-linkmode=external -mod=readonly -modcacherw"
+ export GO111MODULE=on
+ export GOPROXY=https://goproxy.cn,direct
- export CGO_CPPFLAGS="${CPPFLAGS}"
- export CGO_CFLAGS="${CFLAGS}"
- export CGO_CXXFLAGS="${CXXFLAGS}"
- export CGO_LDFLAGS="${LDFLAGS}"
- export GOFLAGS="-buildmode=pie -trimpath -ldflags=-linkmode=external -mod=readonly -modcacherw"
- export GO111MODULE=on
- export GOPROXY=https://goproxy.cn,direct
-
- pushd web
- export CARGO_HOME="${srcdir}/.cargo"
- {
- echo -e '\n'
- #echo 'build_from_source=true'
- echo 'link-workspace-packages=true'
- echo 'fetch-retry-maxtimeout=10000'
- echo "cache-dir="${srcdir}"/.pnpm_cache"
- echo "store-dir="${srcdir}"/.pnpm_store"
- echo "shamefully-hoist=true"
- echo "virtual-store-dir-max-length=80"
- } >>.npmrc
+ pushd web
+ export CARGO_HOME="${srcdir}/.cargo"
+ cat > .npmrc <<EOF
+ link-workspace-packages=true
+ fetch-retry-maxtimeout=10000
+ cache-dir=${srcdir}/.pnpm_cache
+ store-dir=${srcdir}/.pnpm_store
+ shamefully-hoist=true
+ virtual-store-dir-max-length=80
+ dangerously-allow-all-builds=true
+EOF
export VITE_DEVTOOLS=false
export NODE_ENV=production
- # NODE_ENV=development pnpm install --force
- # NODE_ENV=production pnpm run build
- pnpm install --force
- pnpm run build-only
- popd
- # wails build
- go build -o ${pkgname}
+ # pnpm install --force --config.dangerouslyAllowAllBuilds=true
+ pnpm install --force --allow-build esbuild --allow-build @parcel/watcher --allow-build vue-demi
+ pnpm run build-only
+ popd
+ # wails build
+ go build -o ${pkgname}
}
package() {

Scan history

Scanned at (UTC)SeverityRules
2026-10-27 11:47:37 Medium 1
2026-06-18 16:11:54 Clean 0

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion