signal-desktop-system-electron
LOW
maintainer CodingThunder
0 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The pnpm install in prepare() is for project-maintained subdirectories (sticker-creator) using the project's own lockfile, representing normal build preparation, not an external code injection.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The pnpm install in prepare() is for project-maintained subdirectories (sticker-creator) using the project's own lockfile, representing normal build preparation, not an external code injection.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
npm/yarn/pnpm install of an undeclared external package
npm_install_external
Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.
-
PKGBUILD:66
pnpm install --dir sticker-creator
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Yaksh Bariya <yakshbari4@gmail.com>
2
3
pkgname=signal-desktop-system-electron
4
conflicts=('signal-desktop')
5
provides=('signal-desktop')
6
_parent_pkgname=signal-desktop
7
_pkgname=Signal-Desktop
8
pkgver=8.31.0
9
pkgrel=1
10
pkgdesc="Signal Private Messenger for Linux (uses system Electron)"
11
license=('AGPL-3.0-only')
12
arch=('x86_64')
13
url="https://signal.org"
14
depends=(
15
'electron'
16
'glibc'
17
'gtk3'
18
'hicolor-icon-theme'
19
'libcups'
20
'libdrm'
21
'libgcc'
22
'libnotify'
23
'libpulse'
24
'libx11'
25
'libxcb'
26
'libxcomposite'
27
'libxdamage'
28
'libxext'
29
'libxfixes'
30
'libxrandr'
31
'mesa'
32
'nspr'
33
'nss'
34
)
35
makedepends=(
36
'git'
37
'git-lfs'
38
'libxcrypt-compat'
39
'node-gyp'
40
'nodejs'
41
'npm'
42
'pnpm'
43
'python'
44
)
45
optdepends=('xdg-desktop-portal: Screensharing with Wayland')
46
source=(
47
"${pkgname}-${pkgver}.tar.gz::https://github.com/signalapp/${_pkgname}/archive/v${pkgver}.tar.gz"
48
"${_parent_pkgname}.desktop"
49
)
50
sha256sums=('04099ba7f61afc95e33503da076fcfac54eec8bf48fa29284e20ab18c66f0eff'
51
'bf388df4b5bbcab5559ebbf220ed4748ed21b057f24b5ff46684e3fe6e88ccce')
52
b2sums=('4311059d1dc2d926e8f5ec453e679766dfeee844299c18e7358654952403a4f7fa2e75cd57d6561e9a5ba845fe22bf3c65a1d71ee18ad13833c4019584d9d6ee'
53
'ffb8f7bab4fd84aacf13e7b6d2835daf449b6650b4b3fa723456792ba7fb6cae352928fea11cb030510d558ce30036ff5a1513444f067b94c7fff0158b4f2265')
54
55
prepare() {
56
cd "${_pkgname}-${pkgver}"
57
58
# git-lfs hook needs to be installed for one of the dependencies
59
export GIT_CONFIG_GLOBAL="$HOME/.gitconfig"
60
git lfs install
61
62
# Allow higher Node versions
63
sed 's#"node": "#&>=#' -i package.json
64
65
# Install dependencies for sticker-creator
66
pnpm install --dir sticker-creator
67
68
# Configure electron-builder's Linux target for the current Arch architecture.
69
case "${CARCH}" in
70
"aarch64") electron_arch="arm64" ;;
71
*) electron_arch="x64" ;;
72
esac
73
node scripts/prepare_linux_build.mjs deb "${electron_arch}"
74
75
# Install dependencies for signal-desktop
76
pnpm install --frozen-lockfile
77
}
78
79
build() {
80
cd "${_pkgname}-${pkgver}"
81
82
# Build the sticker creator
83
pnpm --prefix ./sticker-creator/ run build
84
85
# Build signal-desktop
86
pnpm run build
87
}
88
89
package() {
90
cd "${_pkgname}-${pkgver}"
91
92
install -d "${pkgdir}/usr/"{lib,bin}
93
cp -a release/linux-unpacked/resources/ "${pkgdir}/usr/lib/${_parent_pkgname}"
94
cat << EOF > "${pkgdir}/usr/bin/${_parent_pkgname}"
95
#!/bin/sh
96
NODE_ENV=production electron /usr/lib/${_parent_pkgname}/app.asar "\$@"
97
EOF
98
99
chmod +x "${pkgdir}/usr/bin/${_parent_pkgname}"
100
101
install -Dm 644 "../${_parent_pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
102
for i in 16 24 32 48 64 128 256 512 1024; do
103
install -Dm 644 "build/icons/png/${i}x${i}.png" \
104
"${pkgdir}/usr/share/icons/hicolor/${i}x${i}/apps/${_parent_pkgname}.png"
105
done
106
}
107
108
# vim: ts=2 sw=2 et:
109
Changes since previous scan
--- PKGBUILD @ 2026-10-22 00:13+++ PKGBUILD @ 2026-11-01 00:21@@ -5,7 +5,7 @@ provides=('signal-desktop') _parent_pkgname=signal-desktop _pkgname=Signal-Desktop-pkgver=8.30.0+pkgver=8.31.0 pkgrel=1 pkgdesc="Signal Private Messenger for Linux (uses system Electron)" license=('AGPL-3.0-only')@@ -47,9 +47,9 @@ "${pkgname}-${pkgver}.tar.gz::https://github.com/signalapp/${_pkgname}/archive/v${pkgver}.tar.gz" "${_parent_pkgname}.desktop" )-sha256sums=('6015f33fabe44fcc4c7a8dbb50081349afbeccd3975bf9fcacd6f79704e1fa79'+sha256sums=('04099ba7f61afc95e33503da076fcfac54eec8bf48fa29284e20ab18c66f0eff' 'bf388df4b5bbcab5559ebbf220ed4748ed21b057f24b5ff46684e3fe6e88ccce')-b2sums=('60ca4051d1e9a1530385fe95e9e9f0b6b087a719d170118ed9d9b2d0e9a1c42082ca9ca2acd41fe1c9e013e178eefaf26e440a95ca41571489c0df00d4d9b558'+b2sums=('4311059d1dc2d926e8f5ec453e679766dfeee844299c18e7358654952403a4f7fa2e75cd57d6561e9a5ba845fe22bf3c65a1d71ee18ad13833c4019584d9d6ee' 'ffb8f7bab4fd84aacf13e7b6d2835daf449b6650b4b3fa723456792ba7fb6cae352928fea11cb030510d558ce30036ff5a1513444f067b94c7fff0158b4f2265') prepare() {Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 00:13:55 | Low | 2 |
| 2026-10-28 00:06:54 | Low | 2 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 01:33:44 | Medium | 1 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |
| 2026-10-14 00:06:47 | Low | 2 |