rikkahub-pc
LOW
maintainer laby
0 votes
scanned 2026-08-20 07:12:46.586583
Why flagged
The flagged `bunx tauri build` on line 97 runs the Tauri CLI from the locally installed node_modules (resolved via bunx from the frozen lockfile install), not a remote package fetched at build time; the entire build is a source compilation from the project's own GitHub repository with verified checksums, so there is no unverifiable remote code execution, though the package is new/low-vote and builds from a personal GitHub fork rather than an established upstream.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): The flagged `bunx tauri build` on line 97 runs the Tauri CLI from the locally installed node_modules (resolved via bunx from the frozen lockfile install), not a remote package fetched at build time; the entire build is a source compilation from the project's own GitHub repository with verified checksums, so there is no unverifiable remote code execution, though the package is new/low-vote and builds from a personal GitHub fork rather than an established upstream.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
npx/bunx/deno executes a remote package
remote_code_tool
`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.
-
PKGBUILD:97
(cd web-ui && bunx tauri build --no-bundle)
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Rikkahub contributors <https://github.com/yuh-G/rikkahub-desktop>
2
# Contributor: (add your name/email here when submitting to the AUR)
3
4
# Rikkahub — native multi-provider LLM chat client (Tauri desktop shell + Bun backend).
5
#
6
# This is a *source* build: it compiles the Tauri (Rust) shell and the
7
# Bun-compiled backend sidecar from the tagged release source. The heavy
8
# dependencies (webkit2gtk, cargo, bun) are only needed at build time; at
9
# runtime the app needs webkit2gtk-4.1 + gtk3 + libayatana-appindicator (tray).
10
#
11
# Notes for packagers:
12
# - The in-app updater cannot write to /opt (root-owned), so updates must go
13
# through `pacman -Syu`. Ignore the in-app "update available" prompt.
14
# - User data lives in $XDG_DATA_HOME/rikkahub-pc (default ~/.local/share/
15
# rikkahub-pc) — see resolve-data-dir.patch. The in-app "move data folder"
16
# setting still works because it only overrides the fallback.
17
18
pkgname=rikkahub-pc
19
pkgver=1.5.0
20
pkgrel=2
21
pkgdesc="Rikkahub — native LLM chat client with multi-provider support (Tauri desktop app)"
22
arch=('x86_64')
23
url="https://github.com/yuh-G/rikkahub-desktop"
24
license=('AGPL-3.0-only')
25
# The Bun-compiled sidecar embeds its JS payload as an ELF trailer/section that
26
# `strip` corrupts — the binary then falls back to the bare `bun` CLI and the
27
# shell reports "后端进程意外退出". Never strip this package's binaries.
28
options=(!strip)
29
# Binary is compiled with Bun; the Tauri shell needs the webkit2gtk/gtk toolchain
30
# (headers + pkg-config files) to build.
31
makedepends=('bun' 'cargo' 'webkit2gtk-4.1' 'gtk3' 'glib2')
32
depends=('webkit2gtk-4.1' 'gtk3' 'glib2' 'libayatana-appindicator' 'gcc-libs' 'icu')
33
optdepends=(
34
'unzip: restore backups from ZIP archives'
35
'zip: export backups as ZIP archives'
36
'wl-clipboard: read/write the system clipboard on Wayland'
37
'xclip: read/write the system clipboard on X11'
38
'espeak-ng: system text-to-speech'
39
)
40
install=rikkahub-pc.install
41
source=(
42
"rikkahub-desktop-${pkgver}.tar.gz::https://github.com/yuh-G/rikkahub-desktop/archive/refs/tags/v${pkgver}.tar.gz"
43
'resolve-data-dir.patch'
44
'tray-icon.patch'
45
'rikkahub-pc.sh'
46
'rikkahub-pc.desktop'
47
)
48
sha256sums=(
49
'd1b483dc879262eb6e895666e31e7988cfc3b72568e5426bb7a6ad4576f1ab75'
50
'f6dc009ddda015bcb4d4b76246125bd1f8b2e7881b1b7af8a3774d8a465877c2'
51
'89d89c29f0001ee7c30b6fe90b52a747d7f4f759d4249129183ff14b3d3b9e61'
52
'0c54e97a8c8b21a50009004f684227ab80a9148e17fb11b9ca5e17f55e40bbf3'
53
'04fa0ed93dde4ac68c21cd2fc48017e73cb5f025dff2811298e32b97a50ab696'
54
)
55
56
prepare() {
57
cd "rikkahub-desktop-${pkgver}"
58
# System installs keep user data under XDG_DATA_HOME instead of /opt/<...>/pc-data.
59
patch -Np1 -i "$srcdir/resolve-data-dir.patch"
60
# Feed the tray a supersampled icon on Linux so AppIndicator panels downscale
61
# instead of upscaling the Windows-sized 16px icon (which rendered blurry).
62
patch -Np1 -i "$srcdir/tray-icon.patch"
63
}
64
65
build() {
66
cd "rikkahub-desktop-${pkgver}"
67
68
# Locked JS dependency install (frontend + backend). Point bun's package
69
# cache at $srcdir so the build's downloaded registry tarballs are cleaned
70
# up with $srcdir by makepkg instead of polluting the builder's
71
# ~/.bun/install/cache.
72
(cd web-ui && bun install --frozen-lockfile --cache-dir "$srcdir/bun-cache")
73
(cd pc-server && bun install --frozen-lockfile --cache-dir "$srcdir/bun-cache")
74
75
# Bun's bundled react-dom/server.bun.js lacks renderToPipeableStream, which the
76
# react-router SPA build needs. Swap in the Node server bundle (same as upstream
77
# CI does before `bun run build`).
78
(
79
cd web-ui
80
rm -f node_modules/react-dom/server.bun.js
81
ln -sf server.node.js node_modules/react-dom/server.bun.js
82
rm -f node_modules/react-dom/cjs/react-dom-server.bun.development.js
83
ln -sf react-dom-server.node.development.js node_modules/react-dom/cjs/react-dom-server.bun.development.js
84
rm -f node_modules/react-dom/cjs/react-dom-server.bun.production.js
85
ln -sf react-dom-server.node.production.js node_modules/react-dom/cjs/react-dom-server.bun.production.js
86
)
87
88
# Compile the Bun backend into the sidecar Tauri expects, named for the Linux
89
# x64 target triple (<name>-<target-triple> under src-tauri/binaries).
90
mkdir -p web-ui/src-tauri/binaries
91
(cd pc-server && bun build --compile --target=bun-linux-x64 server.ts \
92
--outfile ../web-ui/src-tauri/binaries/rikkahub-server-x86_64-unknown-linux-gnu)
93
94
# Compile the Tauri shell. --no-bundle: the configured NSIS target is
95
# Windows-only; we assemble the Linux layout ourselves in package().
96
# beforeBuildCommand (bun run build) produces web-ui/build/client.
97
(cd web-ui && bunx tauri build --no-bundle)
98
}
99
100
package() {
101
cd "rikkahub-desktop-${pkgver}"
102
103
# Everything shares one app dir: the shell spawns the sidecar from exe_dir, and
104
# the sidecar serves web-ui/build/client + reads fonts/ + icons/ from exe_dir.
105
install -d "$pkgdir/opt/rikkahub-pc"
106
107
install -Dm755 web-ui/src-tauri/target/release/rikkahub \
108
"$pkgdir/opt/rikkahub-pc/rikkahub"
109
install -Dm755 web-ui/src-tauri/binaries/rikkahub-server-x86_64-unknown-linux-gnu \
110
"$pkgdir/opt/rikkahub-pc/rikkahub-server"
111
112
install -d "$pkgdir/opt/rikkahub-pc/web-ui/build"
113
cp -r web-ui/build/client "$pkgdir/opt/rikkahub-pc/web-ui/build/"
114
cp -r fonts "$pkgdir/opt/rikkahub-pc/fonts"
115
cp -r icons "$pkgdir/opt/rikkahub-pc/icons"
116
117
# PATH launcher, desktop entry, icon, license.
118
install -Dm755 "$srcdir/rikkahub-pc.sh" "$pkgdir/usr/bin/rikkahub-pc"
119
install -Dm644 "$srcdir/rikkahub-pc.desktop" \
120
"$pkgdir/usr/share/applications/rikkahub-pc.desktop"
121
install -Dm644 web-ui/public/app-icon.png \
122
"$pkgdir/usr/share/icons/hicolor/192x192/apps/rikkahub-pc.png"
123
install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
124
}
125
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-20 07:12:46 | Low | 3 |
| 2026-08-20 07:10:50 | Medium | 2 |