searxng-rama

LOW

maintainer RAMA 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The npx commands execute 'vite build' locally on the project's own source code during packaging, which is a standard build step for frontend assets and does not involve executing untrusted remote code.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The npx commands execute 'vite build' locally on the project's own source code during packaging, which is a standard build step for frontend assets and does not involve executing untrusted remote code.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:100 npx vite build
PKGBUILD:117 npx vite build

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Nomadcxx <noovie@gmail.com>
    
      2pkgname=searxng-rama
    
      3_pkgname=searxng
    
      4pkgver=r9625.ef8f647
    
      5pkgrel=1
    
      6pkgdesc="SearXNG with a modern theme, secure defaults and systemd service"
    
      7arch=('any')
    
      8url="https://github.com/Nomadcxx/searxng-RAMA"
    
      9license=('AGPL3')
    
      10depends=('python' 'systemd')
    
      11makedepends=('openssl' 'git' 'python-virtualenv' 'npm' 'gcc' 'make' 'libvips' 'python' 'pkgconf')
    
      12optdepends=(
    
      13    'redis: Caching support for improved performance'
    
      14    'valkey: Alternative caching support'
    
      15    'libmagic: File type detection for uploads'
    
      16    'p7zip: Archive support for file upload'
    
      17)
    
      18provides=('searxng')
    
      19conflicts=('searx' 'searx-git' 'searxng')
    
      20backup=('opt/searxng-rama/searx/settings.yml')
    
      21install=${pkgname}.install
    
      22
    
      23_giturl="https://github.com/searxng/searxng"
    
      24_gitbranch="master"
    
      25source=(git+$_giturl#branch=$_gitbranch
    
      26        git+https://github.com/Nomadcxx/searxng-RAMA.git)
    
      27b2sums=('SKIP' 'SKIP')
    
      28
    
      29pkgver() {
    
      30  cd $_pkgname
    
      31  printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
    
      32}
    
      33
    
      34build() {
    
      35  cd "$srcdir/$_pkgname"
    
      36
    
      37  # Copy all available themes to source (installer will select which to apply)
    
      38  msg2 "Copying theme files to source..."
    
      39  mkdir -p "${srcdir}/theme"
    
      40
    
      41  for theme_dir in "${srcdir}/searxng-RAMA/theme"/*; do
    
      42    if [ -d "$theme_dir" ]; then
    
      43      theme_name=$(basename "$theme_dir")
    
      44      cp -r "$theme_dir" "${srcdir}/theme/$theme_name"
    
      45    fi
    
      46  done
    
      47  # gen-variant.py is a top-level file (the loop above copies only theme dirs) —
    
      48  # copy it explicitly; the variant pre-build below invokes it.
    
      49  cp "${srcdir}/searxng-RAMA/theme/gen-variant.py" "${srcdir}/theme/gen-variant.py"
    
      50
    
      51  # Apply RAMA theme customizations to source (default for backward compatibility)
    
      52  msg2 "Applying RAMA theme customizations..."
    
      53
    
      54  # Copy RAMA definitions.less to client source (this is where theme is built from)
    
      55  cp "${srcdir}/theme/rama/definitions.less" "client/simple/src/less/definitions.less"
    
      56
    
      57  # Copy RAMA LESS override layer (rama.less + fonts.less) into the theme directory
    
      58  mkdir -p "client/simple/src/less/themes/rama"
    
      59  cp "${srcdir}/theme/rama/rama.less" "client/simple/src/less/themes/rama/rama.less"
    
      60  cp "${srcdir}/theme/rama/fonts.less" "client/simple/src/less/themes/rama/fonts.less"
    
      61
    
      62  # Append the rama.less import as the LAST entry in style.less so it wins the cascade
    
      63  grep -q 'themes/rama/rama.less' "client/simple/src/less/style.less" || \
    
      64    echo '@import "themes/rama/rama.less";' >> "client/simple/src/less/style.less"
    
      65
    
      66  # Copy RAMA branding assets to client source BEFORE building (vite generates assets from these)
    
      67  msg2 "Installing RAMA branding assets to client source..."
    
      68
    
      69  # Ensure brand directory exists
    
      70  mkdir -p "client/simple/src/brand"
    
      71
    
      72  # Create a minimal placeholder searxng.svg (vite plugin needs this, but we'll overwrite PNG after build)
    
      73  # This prevents vite build from failing if searxng.svg is missing
    
      74  cat > "client/simple/src/brand/searxng.svg" << 'EOF'
    
      75<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 20">
    
      76  <text x="5" y="15" font-family="monospace" font-size="12" fill="#ef233c">SEARXNG</text>
    
      77</svg>
    
      78EOF
    
      79
    
      80  # Copy RAMA red favicon SVG - vite will generate favicon.png and favicon.svg from this
    
      81  if [ -f "${srcdir}/searxng-RAMA/assets/favicon.svg" ]; then
    
      82    cp "${srcdir}/searxng-RAMA/assets/favicon.svg" "client/simple/src/brand/searxng-wordmark.svg"
    
      83  fi
    
      84
    
      85  # Copy empty favicon SVG to source (vite plugin processes this)
    
      86  if [ -f "${srcdir}/searxng-RAMA/assets/empty_favicon.svg" ]; then
    
      87    mkdir -p "client/simple/src/svg"
    
      88    cp "${srcdir}/searxng-RAMA/assets/empty_favicon.svg" "client/simple/src/svg/empty_favicon.svg"
    
      89  fi
    
      90
    
      91  # Build the theme with RAMA styling
    
      92  msg2 "Building RAMA theme..."
    
      93  cd client/simple
    
      94
    
      95  # Install npm dependencies - skip postinstall scripts to avoid sharp native build issues
    
      96  npm install --no-audit --no-fund --ignore-scripts
    
      97
    
      98  # Build only the vite part (CSS compilation) - skip icons which needs sharp
    
      99  # This first build is the RAMA (default) variant.
    
      100  npx vite build
    
      101
    
      102  # --- Pre-build theme variants for runtime theme-switching ---
    
      103  # Each switchable variant is a self-contained CSS bundle; the theme switcher
    
      104  # swaps which bundle is served (see cmd/rama-installer applyTheme). vite's
    
      105  # emptyOutDir wipes the output dir on every build, so stash each variant's CSS
    
      106  # OUTSIDE that dir and copy them all back after the final build.
    
      107  msg2 "Pre-building theme variants (rama, google-light, google-dark)..."
    
      108  _cssdir="$srcdir/$_pkgname/searx/static/themes/simple"
    
      109  _variantcss="$srcdir/variant-css"
    
      110  mkdir -p "$_variantcss"
    
      111  cp "$_cssdir/sxng-ltr.min.css" "$_variantcss/sxng-ltr.rama.min.css"
    
      112  cp "$_cssdir/sxng-rtl.min.css" "$_variantcss/sxng-rtl.rama.min.css"
    
      113
    
      114  for _variant in google-light google-dark; do
    
      115    _which="${_variant#google-}"
    
      116    python "${srcdir}/theme/gen-variant.py" "${srcdir}/theme/google/definitions.less" "$_which" > "src/less/definitions.less"
    
      117    npx vite build
    
      118    cp "$_cssdir/sxng-ltr.min.css" "$_variantcss/sxng-ltr.${_variant}.min.css"
    
      119    cp "$_cssdir/sxng-rtl.min.css" "$_variantcss/sxng-rtl.${_variant}.min.css"
    
      120  done
    
      121
    
      122  # Publish every variant bundle, then restore RAMA as the default served files.
    
      123  cp "$_variantcss/"*.min.css "$_cssdir/"
    
      124  cp "$_variantcss/sxng-ltr.rama.min.css" "$_cssdir/sxng-ltr.min.css"
    
      125  cp "$_variantcss/sxng-rtl.rama.min.css" "$_cssdir/sxng-rtl.min.css"
    
      126
    
      127  cd "$srcdir/$_pkgname"
    
      128
    
      129  # Copy self-hosted woff2 fonts into the static tree AFTER vite build (vite's emptyOutDir wipes it if done before)
    
      130  mkdir -p "searx/static/themes/simple/fonts"
    
      131  cp "${srcdir}/theme/rama/fonts/"*.woff2 "searx/static/themes/simple/fonts/"
    
      132
    
      133  # Copy RAMA template forks (index.html hero + results.html sticky header) over the simple theme
    
      134  cp "${srcdir}/theme/rama/templates/"*.html "searx/templates/simple/"
    
      135
    
      136  # Copy custom RAMA assets AFTER vite build (overwrite generated files)
    
      137  msg2 "Installing custom RAMA logo and favicon..."
    
      138
    
      139  # Copy custom ASCII-style "SEARXNG" logo PNG (overwrites vite-generated searxng.png)
    
      140  if [ -f "${srcdir}/searxng-RAMA/brand/searxng.png" ]; then
    
      141    cp "${srcdir}/searxng-RAMA/brand/searxng.png" "searx/static/themes/simple/img/searxng.png"
    
      142  fi
    
      143
    
      144  # Copy red favicon files directly (ensure they're present)
    
      145  if [ -f "${srcdir}/searxng-RAMA/assets/favicon.svg" ]; then
    
      146    cp "${srcdir}/searxng-RAMA/assets/favicon.svg" "searx/static/themes/simple/img/favicon.svg"
    
      147  fi
    
      148
    
      149  if [ -f "${srcdir}/searxng-RAMA/assets/favicon.png" ]; then
    
      150    cp "${srcdir}/searxng-RAMA/assets/favicon.png" "searx/static/themes/simple/img/favicon.png"
    
      151  fi
    
      152
    
      153  if [ -f "${srcdir}/searxng-RAMA/assets/empty_favicon.svg" ]; then
    
      154    cp "${srcdir}/searxng-RAMA/assets/empty_favicon.svg" "searx/static/themes/simple/img/empty_favicon.svg"
    
      155  fi
    
      156
    
      157  # NOTE: the theme-build steps above mirror scripts/build-themes.sh (used by the
    
      158  # cross-distro install.sh). Keep the two in sync. Theme switching now swaps the
    
      159  # pre-built sxng-<side>.<variant>.min.css bundles produced above — the old
    
      160  # themes/<name>/definitions.less copy is obsolete and intentionally removed.
    
      161
    
      162  # Create version file
    
      163  cat > searx/version_frozen.py << EOF
    
      164# THIS FILE IS GENERATED BY THE BUILD PROCESS
    
      165# DO NOT EDIT IT MANUALLY
    
      166
    
      167VERSION_STRING = "1.1.0-RAMA"
    
      168VERSION_TAG = "1.1.0-RAMA"
    
      169DOCKER_TAG = "1.1.0-RAMA"
    
      170GIT_URL = "${_giturl}"
    
      171GIT_BRANCH = "${_gitbranch}"
    
      172EOF
    
      173}
    
      174
    
      175package() {
    
      176  cd "$srcdir/$_pkgname"
    
      177
    
      178  # Create installation directory
    
      179  install -dm755 "$pkgdir/opt/searxng-rama"
    
      180
    
      181  # Copy SearXNG source files (includes built theme in searx/static/themes/simple/)
    
      182  msg2 "Copying SearXNG files..."
    
      183  cp -r searx "$pkgdir/opt/searxng-rama/"
    
      184
    
      185  # Copy additional directories if they exist
    
      186  for dir in dockerfiles docs utils; do
    
      187    if [ -d "$dir" ]; then
    
      188      cp -r "$dir" "$pkgdir/opt/searxng-rama/"
    
      189    fi
    
      190  done
    
      191
    
      192  # Copy essential files
    
      193  for file in Makefile manage requirements.txt requirements-dev.txt setup.py babel.cfg; do
    
      194    if [ -f "$file" ]; then
    
      195      install -Dm644 "$file" "$pkgdir/opt/searxng-rama/$file"
    
      196    fi
    
      197  done
    
      198
    
      199  # Copy .git directory for version info
    
      200  if [ -d ".git" ]; then
    
      201    cp -r .git "$pkgdir/opt/searxng-rama/"
    
      202  fi
    
      203
    
      204  # RAMA assets already copied to source in build() and compiled by vite
    
      205
    
      206  # Modify STATIC settings only (verify each placeholder exists before replacing).
    
      207  # The secret_key is intentionally NOT set here — generating it at package time
    
      208  # would bake one shared key into the package (in a backup= file). It is generated
    
      209  # per-machine in post_install() (see searxng-rama.install); the "ultrasecretkey"
    
      210  # placeholder is shipped as-is and replaced on the user's system.
    
      211  msg2 "Configuring settings..."
    
      212  local settings_file="${pkgdir}/opt/searxng-rama/searx/settings.yml"
    
      213
    
      214  grep -q 'secret_key: "ultrasecretkey"' "$settings_file" || { echo "ERROR: secret_key placeholder not found"; exit 1; }
    
      215  grep -q 'port: 8888' "$settings_file" || { echo "ERROR: port placeholder not found"; exit 1; }
    
      216  sed -i "s/port: 8888/port: 8855/" "$settings_file"
    
      217  grep -q 'bind_address: "127.0.0.1"' "$settings_file" || { echo "ERROR: bind_address placeholder not found"; exit 1; }
    
      218  sed -i 's/bind_address: "127.0.0.1"/bind_address: "0.0.0.0"/' "$settings_file"
    
      219  grep -q 'instance_name: "SearXNG"' "$settings_file" || { echo "ERROR: instance_name placeholder not found"; exit 1; }
    
      220  sed -i 's/instance_name: "SearXNG"/instance_name: "SearXNG RAMA Edition"/' "$settings_file"
    
      221
    
      222  # Create Python virtual environment
    
      223  msg2 "Creating Python virtual environment..."
    
      224  export PIP_DISABLE_PIP_VERSION_CHECK=1
    
      225  export PYTHONDONTWRITEBYTECODE=1
    
      226  python -m venv "$pkgdir/opt/searxng-rama/venv"
    
      227
    
      228  # Install dependencies in venv
    
      229  msg2 "Installing Python dependencies..."
    
      230  "$pkgdir/opt/searxng-rama/venv/bin/pip" install --upgrade pip wheel
    
      231  "$pkgdir/opt/searxng-rama/venv/bin/pip" install -r "${srcdir}/${_pkgname}/requirements.txt"
    
      232
    
      233  # Fix venv shebangs to use final install path (remove pkgdir prefix)
    
      234  msg2 "Fixing virtual environment paths..."
    
      235  find "$pkgdir/opt/searxng-rama/venv/bin" -type f -exec sed -i "s|${pkgdir}||g" {} +
    
      236  if [ -f "$pkgdir/opt/searxng-rama/venv/pyvenv.cfg" ]; then
    
      237    sed -i "s|${pkgdir}||g" "$pkgdir/opt/searxng-rama/venv/pyvenv.cfg"
    
      238  fi
    
      239
    
      240  # Clean up bytecode
    
      241  find "$pkgdir/opt/searxng-rama/venv" -type f -name "*.py[co]" -delete
    
      242  find "$pkgdir/opt/searxng-rama/venv" -type d -name "__pycache__" -delete
    
      243
    
      244  # Create executable wrapper
    
      245  msg2 "Creating wrapper script..."
    
      246  install -dm755 "$pkgdir/usr/bin"
    
      247  cat > "$pkgdir/usr/bin/searxng-rama-run" << 'EOF'
    
      248#!/bin/bash
    
      249export SEARXNG_SETTINGS_PATH=/opt/searxng-rama/searx/settings.yml
    
      250cd /opt/searxng-rama
    
      251exec /opt/searxng-rama/venv/bin/python -m searx.webapp "$@"
    
      252EOF
    
      253  chmod +x "$pkgdir/usr/bin/searxng-rama-run"
    
      254
    
      255  # Theme switcher: swaps the pre-built variant bundles built above. This is the
    
      256  # supported way to change themes on the AUR install (no TUI is shipped).
    
      257  install -Dm755 "${srcdir}/searxng-RAMA/scripts/searxng-rama-theme" \
    
      258    "$pkgdir/usr/bin/searxng-rama-theme"
    
      259
    
      260  # Install systemd service
    
      261  msg2 "Installing systemd service..."
    
      262  install -dm755 "${pkgdir}/etc/systemd/system"
    
      263  cat > "${pkgdir}/etc/systemd/system/searxng-rama.service" << 'EOF'
    
      264[Unit]
    
      265Description=RAMA SearXNG
    
      266After=network.target
    
      267
    
      268[Service]
    
      269Type=simple
    
      270User=searxng
    
      271WorkingDirectory=/opt/searxng-rama
    
      272Environment="SEARXNG_SETTINGS_PATH=/opt/searxng-rama/searx/settings.yml"
    
      273ExecStart=/usr/bin/searxng-rama-run
    
      274Restart=on-failure
    
      275RestartSec=5
    
      276
    
      277# SearXNG caches its engine/data SQLite DBs in the system temp dir
    
      278# (/tmp/sxng_cache_*.db). PrivateTmp gives the service its own isolated /tmp so
    
      279# those DBs can't collide with (or be owned by) another user — without it the
    
      280# service crash-loops on "attempt to write a readonly database".
    
      281PrivateTmp=true
    
      282NoNewPrivileges=true
    
      283
    
      284# Permissions for database writes
    
      285ReadWritePaths=/opt/searxng-rama
    
      286
    
      287[Install]
    
      288WantedBy=multi-user.target
    
      289EOF
    
      290
    
      291  # Install licenses
    
      292  install -Dm644 "${srcdir}/${_pkgname}/LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      293  if [ -f "${srcdir}/searxng-RAMA/LICENSE" ]; then
    
      294    install -Dm644 "${srcdir}/searxng-RAMA/LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/RAMA_LICENSE"
    
      295  fi
    
      296
    
      297  # Install documentation
    
      298  if [ -f "${srcdir}/searxng-RAMA/README.md" ]; then
    
      299    install -Dm644 "${srcdir}/searxng-RAMA/README.md" "${pkgdir}/usr/share/doc/${pkgname}/README.md"
    
      300  fi
    
      301}
    
      302

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2