round-drop-git

MEDIUM
maintainer zxp19821005 0 votes scanned 2026-09-21 11:34:50.247705
View on AUR
Why flagged

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

Triggered rules

Medium npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

  • PKGBUILD:97 pnpm add -D typescript@5

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2pkgname=round-drop-git
3_pkgname=RoundDrop
4pkgver=1.6.2.r11.g2b3d23a
5_electronversion=44
6_nodeversion=24
7pkgrel=1
8pkgdesc="Circle UI Desktop Application Launcher."
9arch=('any')
10url="https://github.com/nekobato/RoundDrop"
11license=('MIT')
12conflicts=("${pkgname%-git}")
13provides=("${pkgname%-git}")
14depends=(
15 "electron${_electronversion}"
16 'java-runtime'
17)
18makedepends=(
19 'gendesk'
20 'git'
21 'nvm'
22 'npm'
23 'pnpm'
24 'curl'
25 'jq'
26)
27source=(
28 "${pkgname%-git}.git::git+${url}.git"
29 "${pkgname%-git}.sh"
30)
31sha256sums=('SKIP'
32 'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
33pkgver() {
34 cd "${srcdir}/${pkgname%-git}.git"
35 set -o pipefail
36 git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
37 printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
38}
39_ensure_local_nvm() {
40 local NVM_DIR="${srcdir}/.nvm"
41 source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
42 nvm install "${_nodeversion}"
43 nvm use "${_nodeversion}"
44}
45_get_app_dir() {
46 find "${srcdir}" -type d -name "node_modules" -prune -o -type f -name "resources.pak" -print0 | xargs -0 dirname | head -n 1
47}
48_get_electron_version() {
49 _elec_ver=$(find "${srcdir}" -maxdepth 5 -name "package.json" ! -path "*/node_modules/*" \
50 -exec grep -l '"electron"' {} + | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null | head -1)
51 [[ -z "${_elec_ver}" ]] && return 1
52 echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
53}
54_set_build_env() {
55 export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
56 export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
57 export ELECTRON_SKIP_BINARY_DOWNLOAD=1
58 export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
59 export HOME="${srcdir}/.home"
60 export XDG_CACHE_HOME="${HOME}/.cache"
61 export XDG_CONFIG_HOME="${HOME}/.config"
62 export XDG_DATA_HOME="${HOME}/.local/share"
63 export XDG_STATE_HOME="${HOME}/.local/state"
64 export PNPM_HOME="${HOME}/.pnpm/bin"
65 export pnpm_config_cache_dir="${HOME}/.pnpm_cache"
66 export pnpm_config_store_dir="${HOME}/.pnpm_store"
67 export pnpm_config_global_dir="${HOME}/.pnpm/global"
68 export pnpm_config_state_dir="${HOME}/.pnpm/state"
69 export pnpm_config_minimum_release_age=0
70 export pnpm_config_update_notifier=false
71 export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
72 export COREPACK_HOME="${HOME}/.corepack"
73 mkdir -p "${HOME}" "${PNPM_HOME}" "${pnpm_config_cache_dir}" "${pnpm_config_store_dir}" "${pnpm_config_global_dir}" "${pnpm_config_state_dir}" "${COREPACK_HOME}"
74 export PATH="${PNPM_HOME}:${PATH}"
75}
76prepare() {
77 cd "${srcdir}/${pkgname%-git}.git"
78 _get_electron_version
79 sed -i -e "
80 s/@electronversion@/${_electronversion}/g
81 s/@appname@/${pkgname%-git}/g
82 s/@runname@/app.asar/g
83 s/@cfgdirname@/${pkgname%-git}/g
84 " "${srcdir}/${pkgname%-git}.sh"
85 gendesk -q -f -n \
86 --pkgname="${pkgname%-git}" \
87 --pkgdesc="${pkgdesc}" \
88 --categories="Utility" \
89 --name="${_pkgname}" \
90 --exec="${pkgname%-git} %U"
91 _ensure_local_nvm
92 _set_build_env
93 sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g" package.json
94 grep -q "strictDepBuilds" pnpm-workspace.yaml || echo "strictDepBuilds: false" >> pnpm-workspace.yaml
95 pnpm approve-builds --all
96 export NODE_ENV=development
97 pnpm add -D typescript@5
98 pnpm install
99}
100build() {
101 cd "${srcdir}/${pkgname%-git}.git"
102 _ensure_local_nvm
103 _set_build_env
104 export NODE_ENV=production
105 sed -i 's/"ignoreDeprecations": "6.0"/"ignoreDeprecations": "5.0"/g' tsconfig.json
106 pnpm -c exec vue-tsc
107 pnpm -c exec vite build
108 pnpm -c exec "electron-builder --linux dir -c.electronDist=${ELECTRON_DIST} --config electron-builder.config.cjs"
109}
110package() {
111 install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
112 install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-git}"
113 local _app_dir=$(_get_app_dir)
114 cp -a "${_app_dir}/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"
115 _icon_sizes=(16x16 24x24 32x32 48x48 64x64 128x128 256x256 512x512 1024x1024)
116 for _icons in "${_icon_sizes[@]}";do
117 install -Dm644 "${srcdir}/${pkgname%-git}.git/public/icons/png/${_icons}.png" \
118 "${pkgdir}/usr/share/icons/hicolor/${_icons}/apps/${pkgname%-git}.png"
119 done
120 install -Dm644 "${srcdir}/${pkgname%-git}.git/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
121 install -Dm644 "${srcdir}/${pkgname%-git}.git/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
122}
123

Changes since previous scan

--- PKGBUILD @ 2026-06-19 22:34
+++ PKGBUILD @ 2026-09-21 11:34
@@ -1,11 +1,11 @@
# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
pkgname=round-drop-git
_pkgname=RoundDrop
-pkgver=1.6.2.r0.g8bf5d5e
-_electronversion=42
-_nodeversion=25
+pkgver=1.6.2.r11.g2b3d23a
+_electronversion=44
+_nodeversion=24
pkgrel=1
-pkgdesc="Circle UI Desktop Application Launcher.(Use system-wide electron)"
+pkgdesc="Circle UI Desktop Application Launcher."
arch=('any')
url="https://github.com/nekobato/RoundDrop"
license=('MIT')
@@ -42,11 +42,36 @@
nvm install "${_nodeversion}"
nvm use "${_nodeversion}"
}
+_get_app_dir() {
+ find "${srcdir}" -type d -name "node_modules" -prune -o -type f -name "resources.pak" -print0 | xargs -0 dirname | head -n 1
+}
_get_electron_version() {
_elec_ver=$(find "${srcdir}" -maxdepth 5 -name "package.json" ! -path "*/node_modules/*" \
-exec grep -l '"electron"' {} + | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null | head -1)
[[ -z "${_elec_ver}" ]] && return 1
echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
+}
+_set_build_env() {
+ export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
+ export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
+ export ELECTRON_SKIP_BINARY_DOWNLOAD=1
+ export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
+ export HOME="${srcdir}/.home"
+ export XDG_CACHE_HOME="${HOME}/.cache"
+ export XDG_CONFIG_HOME="${HOME}/.config"
+ export XDG_DATA_HOME="${HOME}/.local/share"
+ export XDG_STATE_HOME="${HOME}/.local/state"
+ export PNPM_HOME="${HOME}/.pnpm/bin"
+ export pnpm_config_cache_dir="${HOME}/.pnpm_cache"
+ export pnpm_config_store_dir="${HOME}/.pnpm_store"
+ export pnpm_config_global_dir="${HOME}/.pnpm/global"
+ export pnpm_config_state_dir="${HOME}/.pnpm/state"
+ export pnpm_config_minimum_release_age=0
+ export pnpm_config_update_notifier=false
+ export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
+ export COREPACK_HOME="${HOME}/.corepack"
+ mkdir -p "${HOME}" "${PNPM_HOME}" "${pnpm_config_cache_dir}" "${pnpm_config_store_dir}" "${pnpm_config_global_dir}" "${pnpm_config_state_dir}" "${COREPACK_HOME}"
+ export PATH="${PNPM_HOME}:${PATH}"
}
prepare() {
cd "${srcdir}/${pkgname%-git}.git"
@@ -63,50 +88,30 @@
--categories="Utility" \
--name="${_pkgname}" \
--exec="${pkgname%-git} %U"
- export ELECTRON_SKIP_BINARY_DOWNLOAD=1
- export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/v//g')"
- HOME="${srcdir}/.electron-gyp"
- {
- export PNPM_LINK_WORKSPACE_PACKAGES=true
- export PNPM_FETCH_RETRY_MAXTIMEOUT=10000
- export PNPM_CACHE_DIR="${srcdir}/.pnpm_cache"
- export PNPM_STORE_DIR="${srcdir}/.pnpm_store"
- export PNPM_VIRTUAL_STORE_DIR="${srcdir}/.pnpm_store"
- export PNPM_SHAMEFULLY_HOIST=true
- export PNPM_VIRTUAL_STORE_DIR_MAX_LENGTH=80
- export PNPM_NODE_LINKER=hoisted
- export PNPM_NETWORK_CONCURRENCY=32
- }
- if [[ "$(curl -s ipinfo.io/country)" == *"CN"* ]]; then
- {
- export NPM_CONFIG_REGISTRY="https://registry.npmmirror.com"
- export NPM_CONFIG_ELECTRON_MIRROR="https://registry.npmmirror.com/-/binary/electron/"
- export NPM_CONFIG_ELECTRON_BUILDER_BINARIES_MIRROR="https://registry.npmmirror.com/-/binary/electron-builder-binaries/"
- export NODEJS_ORG_MIRROR="https://npmmirror.com/mirrors/node"
- }
- fi
_ensure_local_nvm
- sed -i "s/\/\${pkg.version}//g;/teamId/d" electron-builder.config.cjs
+ _set_build_env
sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g" package.json
- sed -i 's/electron-winstaller: set this to true or false/electron-winstaller: true/;s/phantomjs-prebuilt: set this to true or false/phantomjs-prebuilt: true/' pnpm-workspace.yaml
- sed -i '/- phantomjs-prebuilt/d' pnpm-workspace.yaml
- sed -i '/- vue-demi/a\ - electron-winstaller\n - phantomjs-prebuilt' pnpm-workspace.yaml
- NODE_ENV=development pnpm install
+ grep -q "strictDepBuilds" pnpm-workspace.yaml || echo "strictDepBuilds: false" >> pnpm-workspace.yaml
+ pnpm approve-builds --all
+ export NODE_ENV=development
+ pnpm add -D typescript@5
+ pnpm install
}
build() {
cd "${srcdir}/${pkgname%-git}.git"
_ensure_local_nvm
- export ELECTRON_SKIP_BINARY_DOWNLOAD=1
- local electronDist="/usr/lib/electron${_electronversion}"
- NODE_ENV=production pnpm vue-tsc
- NODE_ENV=production pnpm vite build
- NODE_ENV=production pnpm -c exec "electron-builder --linux dir -c.electronDist=${electronDist} --config electron-builder.config.cjs"
+ _set_build_env
+ export NODE_ENV=production
+ sed -i 's/"ignoreDeprecations": "6.0"/"ignoreDeprecations": "5.0"/g' tsconfig.json
+ pnpm -c exec vue-tsc
+ pnpm -c exec vite build
+ pnpm -c exec "electron-builder --linux dir -c.electronDist=${ELECTRON_DIST} --config electron-builder.config.cjs"
}
package() {
install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-git}"
- local _app_dir=$(find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -exec dirname {} + | head -n 1)
- cp -a "${_app_dir}/resources/". "${pkgdir}/usr/lib/${pkgname%-git}/"
+ local _app_dir=$(_get_app_dir)
+ cp -a "${_app_dir}/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"
_icon_sizes=(16x16 24x24 32x32 48x48 64x64 128x128 256x256 512x512 1024x1024)
for _icons in "${_icon_sizes[@]}";do
install -Dm644 "${srcdir}/${pkgname%-git}.git/public/icons/png/${_icons}.png" \
@@ -115,3 +120,4 @@
install -Dm644 "${srcdir}/${pkgname%-git}.git/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
install -Dm644 "${srcdir}/${pkgname%-git}.git/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
}
+

Scan history

Scanned at (UTC)SeverityRules
2026-09-21 11:34:50 Medium 1
2026-06-19 22:34:54 Clean 0

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion