siyuan-git

LOW
maintainer zxp19821005 1 votes scanned 2026-09-29 05:22:53.434583
View on AUR
Why flagged

The package installs a specific version of pnpm from npm based on the project's package.json, which is a normal part of building the project from source and does not involve untrusted or obfuscated remote code execution.

Triggered rules

Low AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it LOW (confidence 95%): The package installs a specific version of pnpm from npm based on the project's package.json, which is a normal part of building the project from source and does not involve untrusted or obfuscated remote code execution.

  • PKGBUILD:103 npm install -g "pnpm@${_pnpmver}" --prefix "${HOME}/.pnpm" \

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2pkgname=siyuan-git
3pkgver=3.8.6.r0.g1588124
4_electronversion=44
5_nodeversion=24
6pkgrel=1
7pkgdesc="An open-source, privacy-first, self-hosted knowledge workspace where humans and AI agents work together.开源、隐私优先、自托管的知识工作空间，让人与智能体在此协作"
8arch=('x86_64')
9url="https://b3log.org/siyuan"
10_ghurl="https://github.com/siyuan-note/siyuan"
11license=('AGPL-3.0-only')
12conflicts=(
13 "${pkgname%-git}"
14 "${pkgname%-git}-note"
15)
16provides=(
17 "${pkgname%-git}"
18)
19depends=(
20 "electron${_electronversion}"
21)
22makedepends=(
23 'gendesk'
24 'git'
25 'nvm'
26 'npm'
27 'go'
28 'pnpm'
29)
30source=(
31 "${pkgname//-/.}::git+${_ghurl}.git"
32 "${pkgname%-git}.sh"
33)
34sha256sums=('SKIP'
35 'bd5358d8f323d3c2c2f0733364ee4ea55f551dd86ba0be2a76846210b60897fc')
36pkgver() {
37 cd "$(_get_project_dir)"
38 set -o pipefail
39 git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
40 printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
41}
42_get_app_dir() {
43 find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1
44}
45_ensure_local_nvm() {
46 local NVM_DIR="${srcdir}/.nvm"
47 source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
48 nvm install "${_nodeversion}"
49 nvm use "${_nodeversion}"
50}
51_get_project_dir() {
52 local d
53 while IFS= read -r d; do
54 find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
55 done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
56}
57_set_build_env() {
58 export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
59 export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
60 export ELECTRON_SKIP_BINARY_DOWNLOAD=1
61 export ELECTRON_BUILDER_OFFLINE=true
62 export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
63 export HOME="${srcdir}/.home"
64 export XDG_CACHE_HOME="${HOME}/.cache"
65 export XDG_CONFIG_HOME="${HOME}/.config"
66 export XDG_DATA_HOME="${HOME}/.local/share"
67 export XDG_STATE_HOME="${HOME}/.local/state"
68 export PNPM_HOME="${HOME}/.pnpm/bin"
69 export pnpm_config_cache_dir="${HOME}/.pnpm_cache"
70 export pnpm_config_store_dir="${HOME}/.pnpm_store"
71 export pnpm_config_global_dir="${HOME}/.pnpm/global"
72 export pnpm_config_state_dir="${HOME}/.pnpm/state"
73 export pnpm_config_node_linker=hoisted
74 export pnpm_config_minimum_release_age=0
75 export pnpm_config_update_notifier=false
76 export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
77 export COREPACK_HOME="${HOME}/.corepack"
78 export GOPATH="${HOME}/go"
79 export GOCACHE="${HOME}/go-build"
80 export GOENV="${HOME}/go/env"
81 export XDG_CONFIG_HOME="${HOME}/.config"
82 export XDG_CACHE_HOME="${HOME}/.cache"
83 export CGO_CPPFLAGS="${CPPFLAGS}"
84 export CGO_CFLAGS="${CFLAGS}"
85 export CGO_CXXFLAGS="${CXXFLAGS}"
86 export CGO_LDFLAGS="${LDFLAGS}"
87 export GOFLAGS="-buildmode=pie -trimpath -ldflags=-linkmode=external -mod=readonly -modcacherw"
88 export GOTOOLCHAIN=local
89 export GOWORK=off
90 mkdir -p "${HOME}" "${PNPM_HOME}" "${pnpm_config_cache_dir}" "${pnpm_config_store_dir}" "${pnpm_config_global_dir}" "${pnpm_config_state_dir}" \
91 "${COREPACK_HOME}" "${GOCACHE}" "${XDG_CONFIG_HOME}" "${XDG_CACHE_HOME}" "$(dirname "${GOENV}")"
92 : > "${GOENV}"
93 export PATH="${PNPM_HOME}:${PATH}"
94 local _pnpmver=""
95 local _pkgjson="$(_get_project_dir)/package.json"
96 if [ -f "${_pkgjson}" ]; then
97 _pnpmver="$(grep -o '"packageManager"[^,]*' "${_pkgjson}" 2>/dev/null | grep -oE 'pnpm@[^"+]+' | head -n1 | sed 's/^pnpm@//')"
98 if [ -z "${_pnpmver}" ]; then
99 _pnpmver="$(grep -oE '"pnpm"[[:space:]]*:[[:space:]]*"[^"]+"' "${_pkgjson}" 2>/dev/null | grep -oE '[0-9][0-9.]*' | head -n1)"
100 fi
101 fi
102 if [ -n "${_pnpmver}" ]; then
103 npm install -g "pnpm@${_pnpmver}" --prefix "${HOME}/.pnpm" \
104 --registry "${COREPACK_NPM_REGISTRY}"
105 fi
106}
107_get_electron_version() {
108 _elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
109 | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
110 | grep -v '^$' | sed 's/^[^0-9]*//' | head -1)
111 [[ -z "${_elec_ver}" ]] && return 1
112 echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
113}
114prepare() {
115 cd "$(_get_project_dir)/app"
116 _get_electron_version
117 sed -i -e "
118 s/@electronversion@/${_electronversion}/g
119 s/@appname@/${pkgname%-git}/g
120 s/@runname@/app.asar/g
121 s/@cfgdirname@/SiYuan-Electron/g
122 " "${srcdir}/${pkgname%-git}.sh"
123 _ensure_local_nvm
124 _set_build_env
125 gendesk -q -f -n \
126 --pkgname="${pkgname%-git}" \
127 --pkgdesc="${pkgdesc}" \
128 --categories="Office" \
129 --name="${pkgname%-git}" \
130 --exec="${pkgname%-git} %U" \
131 --custom="Name[zh_CN]=思源笔记"
132 sed -i "/build:mobile/d;s/\"electron\": \"\([^\"]*\)\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g" package.json
133 export NODE_ENV=development
134 pnpm install --no-frozen-lockfile
135}
136build() {
137 cd "$(_get_project_dir)/app"
138 _ensure_local_nvm
139 _set_build_env
140 export NODE_ENV=production
141 pnpm run build
142 cd "$(_get_project_dir)/kernel"
143 case "${CARCH}" in
144 aarch64)
145 _CFG_FILE=electron-builder-linux-arm64.yml
146 _KERNEL_DIR=kernel-linux-arm64
147 ;;
148 x86_64)
149 _CFG_FILE=electron-builder-linux.yml
150 _KERNEL_DIR=kernel-linux
151 ;;
152 esac
153 go build --tags fts5 -o "../app/${_KERNEL_DIR}/SiYuan-Kernel" -v -ldflags "-s -w -X github.com/siyuan-note/siyuan/kernel/util.Mode=prod"
154 cd "$(_get_project_dir)/app"
155 pnpm -c exec "electron-builder --linux dir -c.electronDist=${ELECTRON_DIST} --config ${_CFG_FILE} "
156}
157package() {
158 install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
159 install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-git}"
160 local _app_dir=$(_get_app_dir)
161 cp -a "${_app_dir}/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"
162 rm -rf "${pkgdir}/usr/lib/${pkgname%-git}/default_app.asar"
163 local _src="$(_get_project_dir)"
164 icon_sizes=(16x16 32x32 48x48 64x64 128x128 256x256 512x512)
165 for _icons in "${icon_sizes[@]}";do
166 install -Dm644 "${_src}/app/src/assets/icon/${_icons}.png" \
167 "${pkgdir}/usr/share/icons/hicolor/${_icons}/apps/${pkgname%-git}.png"
168 done
169 install -Dm644 "${_src}/app/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
170}
171

Changes since previous scan

--- PKGBUILD @ 2026-09-18 11:28
+++ PKGBUILD @ 2026-09-29 05:22
@@ -1,6 +1,6 @@
# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
pkgname=siyuan-git
-pkgver=3.8.4.r0.g9f775e8
+pkgver=3.8.6.r0.g1588124
_electronversion=44
_nodeversion=24
pkgrel=1
@@ -25,7 +25,6 @@
'nvm'
'npm'
'go'
- 'curl'
'pnpm'
)
source=(
@@ -33,12 +32,15 @@
"${pkgname%-git}.sh"
)
sha256sums=('SKIP'
- 'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
+ 'bd5358d8f323d3c2c2f0733364ee4ea55f551dd86ba0be2a76846210b60897fc')
pkgver() {
- cd "${srcdir}/${pkgname//-/.}"
+ cd "$(_get_project_dir)"
set -o pipefail
git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
+}
+_get_app_dir() {
+ find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1
}
_ensure_local_nvm() {
local NVM_DIR="${srcdir}/.nvm"
@@ -46,75 +48,71 @@
nvm install "${_nodeversion}"
nvm use "${_nodeversion}"
}
-_get_app_dir() {
- find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1
+_get_project_dir() {
+ local d
+ while IFS= read -r d; do
+ find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
+ done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
}
_set_build_env() {
- export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
- export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
- export ELECTRON_SKIP_BINARY_DOWNLOAD=1
- _ev="$(electron${_electronversion} -v)"
- export SYSTEM_ELECTRON_VERSION="${_ev#v}"
- export HOME="${srcdir}/.electron-gyp"
- mkdir -p "${HOME}"
- export XDG_CACHE_HOME="${srcdir}/.cache"
- export XDG_CONFIG_HOME="${srcdir}/.config"
- export XDG_DATA_HOME="${srcdir}/.local/share"
- export XDG_STATE_HOME="${srcdir}/.local/state"
- export PNPM_CACHE_DIR="${srcdir}/.pnpm_cache"
- export PNPM_STORE_DIR="${srcdir}/.pnpm_store"
- export PNPM_GLOBAL_DIR="${srcdir}/.pnpm/global"
- export PNPM_GLOBAL_BIN_DIR="${srcdir}/.pnpm/bin"
- export PNPM_STATE_DIR="${srcdir}/.pnpm/state"
- export PNPM_MINIMUM_RELEASE_AGE=0
- export PNPM_NODE_LINKER=hoisted
- export PNPM_FETCH_RETRIES=3
- export PNPM_FETCH_RETRY_MAXTIMEOUT=10000
- export PNPM_UPDATE_NOTIFIER=false
- export PNPM_NO_COLOR=true
- export PNPM_NO_PROGRESS=true
- export pnpm_config_platform=linux
- export pnpm_config_arch="${CARCH}"
- export NODE_OPTIONS="--max-old-space-size=4096"
- export npm_config_node_options="--max-old-space-size=4096"
- mkdir -p "${PNPM_CACHE_DIR}" "${PNPM_STORE_DIR}" "${PNPM_GLOBAL_DIR}" "${PNPM_GLOBAL_BIN_DIR}" "${PNPM_STATE_DIR}"
- local _pnpmver="${_pnpmversion}"
- if [[ -z "${_pnpmver}" ]]; then
- _pnpmver="$(node -p "const pm=require('./package.json').packageManager; pm && pm.startsWith('pnpm@') ? pm.split('@')[1] : ''" 2>/dev/null)"
- fi
- if [[ -n "${_pnpmver}" ]]; then
- export COREPACK_HOME="${srcdir}/.corepack"
- install -dm755 "${srcdir}/.bin"
- corepack enable --install-directory "${srcdir}/.bin"
- export PATH="${srcdir}/.bin:${PATH}"
- corepack prepare "pnpm@${_pnpmver}" --activate
- fi
- export GOPATH="${srcdir}/go"
- export GOMODCACHE="${GOPATH}/pkg/mod"
- export GOBIN="${GOPATH}/bin"
- export GOCACHE="${srcdir}/go-build"
- export GOENV="${srcdir}/go/env"
- export XDG_CONFIG_HOME="${srcdir}/.config"
- export XDG_CACHE_HOME="${srcdir}/.cache"
- export CGO_ENABLED=1
- export CGO_CPPFLAGS="${CPPFLAGS}"
- export CGO_CFLAGS="${CFLAGS}"
- export CGO_CXXFLAGS="${CXXFLAGS}"
- export CGO_LDFLAGS="${LDFLAGS}"
- export GOFLAGS="-buildmode=pie -trimpath -ldflags=-linkmode=external -mod=readonly -modcacherw"
- export GOTOOLCHAIN=local
- export GOWORK=off
- mkdir -p "${GOMODCACHE}" "${GOBIN}" "${GOCACHE}" "${XDG_CONFIG_HOME}" "${XDG_CACHE_HOME}" "$(dirname "${GOENV}")"
- : > "${GOENV}"
+ export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
+ export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
+ export ELECTRON_SKIP_BINARY_DOWNLOAD=1
+ export ELECTRON_BUILDER_OFFLINE=true
+ export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
+ export HOME="${srcdir}/.home"
+ export XDG_CACHE_HOME="${HOME}/.cache"
+ export XDG_CONFIG_HOME="${HOME}/.config"
+ export XDG_DATA_HOME="${HOME}/.local/share"
+ export XDG_STATE_HOME="${HOME}/.local/state"
+ export PNPM_HOME="${HOME}/.pnpm/bin"
+ export pnpm_config_cache_dir="${HOME}/.pnpm_cache"
+ export pnpm_config_store_dir="${HOME}/.pnpm_store"
+ export pnpm_config_global_dir="${HOME}/.pnpm/global"
+ export pnpm_config_state_dir="${HOME}/.pnpm/state"
+ export pnpm_config_node_linker=hoisted
+ export pnpm_config_minimum_release_age=0
+ export pnpm_config_update_notifier=false
+ export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
+ export COREPACK_HOME="${HOME}/.corepack"
+ export GOPATH="${HOME}/go"
+ export GOCACHE="${HOME}/go-build"
+ export GOENV="${HOME}/go/env"
+ export XDG_CONFIG_HOME="${HOME}/.config"
+ export XDG_CACHE_HOME="${HOME}/.cache"
+ export CGO_CPPFLAGS="${CPPFLAGS}"
+ export CGO_CFLAGS="${CFLAGS}"
+ export CGO_CXXFLAGS="${CXXFLAGS}"
+ export CGO_LDFLAGS="${LDFLAGS}"
+ export GOFLAGS="-buildmode=pie -trimpath -ldflags=-linkmode=external -mod=readonly -modcacherw"
+ export GOTOOLCHAIN=local
+ export GOWORK=off
+ mkdir -p "${HOME}" "${PNPM_HOME}" "${pnpm_config_cache_dir}" "${pnpm_config_store_dir}" "${pnpm_config_global_dir}" "${pnpm_config_state_dir}" \
+ "${COREPACK_HOME}" "${GOCACHE}" "${XDG_CONFIG_HOME}" "${XDG_CACHE_HOME}" "$(dirname "${GOENV}")"
+ : > "${GOENV}"
+ export PATH="${PNPM_HOME}:${PATH}"
+ local _pnpmver=""
+ local _pkgjson="$(_get_project_dir)/package.json"
+ if [ -f "${_pkgjson}" ]; then
+ _pnpmver="$(grep -o '"packageManager"[^,]*' "${_pkgjson}" 2>/dev/null | grep -oE 'pnpm@[^"+]+' | head -n1 | sed 's/^pnpm@//')"
+ if [ -z "${_pnpmver}" ]; then
+ _pnpmver="$(grep -oE '"pnpm"[[:space:]]*:[[:space:]]*"[^"]+"' "${_pkgjson}" 2>/dev/null | grep -oE '[0-9][0-9.]*' | head -n1)"
+ fi
+ fi
+ if [ -n "${_pnpmver}" ]; then
+ npm install -g "pnpm@${_pnpmver}" --prefix "${HOME}/.pnpm" \
+ --registry "${COREPACK_NPM_REGISTRY}"
+ fi
}
_get_electron_version() {
- _elec_ver=$(find "${srcdir}" -maxdepth 5 -name "package.json" ! -path "*/node_modules/*" \
- -exec grep -l '"electron"' {} + | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null | head -1)
+ _elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
+ | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
+ | grep -v '^$' | sed 's/^[^0-9]*//' | head -1)
[[ -z "${_elec_ver}" ]] && return 1
echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
}
prepare() {
- cd "${srcdir}/${pkgname//-/.}/app"
+ cd "$(_get_project_dir)/app"
_get_electron_version
sed -i -e "
s/@electronversion@/${_electronversion}/g
@@ -132,14 +130,16 @@
--exec="${pkgname%-git} %U" \
--custom="Name[zh_CN]=思源笔记"
sed -i "/build:mobile/d;s/\"electron\": \"\([^\"]*\)\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g" package.json
- NODE_ENV=development pnpm install --no-frozen-lockfile
+ export NODE_ENV=development
+ pnpm install --no-frozen-lockfile
}
build() {
+ cd "$(_get_project_dir)/app"
_ensure_local_nvm
_set_build_env
- cd "${srcdir}/${pkgname//-/.}/app"
- NODE_ENV=production pnpm run build
- cd "${srcdir}/${pkgname//-/.}/kernel"
+ export NODE_ENV=production
+ pnpm run build
+ cd "$(_get_project_dir)/kernel"
case "${CARCH}" in
aarch64)
_CFG_FILE=electron-builder-linux-arm64.yml
@@ -151,20 +151,21 @@
;;
esac
go build --tags fts5 -o "../app/${_KERNEL_DIR}/SiYuan-Kernel" -v -ldflags "-s -w -X github.com/siyuan-note/siyuan/kernel/util.Mode=prod"
- cd "${srcdir}/${pkgname//-/.}/app"
- NODE_ENV=production pnpm -c exec "electron-builder --linux dir -c.electronDist=${ELECTRON_DIST} --config ${_CFG_FILE} "
+ cd "$(_get_project_dir)/app"
+ pnpm -c exec "electron-builder --linux dir -c.electronDist=${ELECTRON_DIST} --config ${_CFG_FILE} "
}
package() {
install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-git}"
- local _app_dir=$(find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1)
+ local _app_dir=$(_get_app_dir)
cp -a "${_app_dir}/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"
rm -rf "${pkgdir}/usr/lib/${pkgname%-git}/default_app.asar"
+ local _src="$(_get_project_dir)"
icon_sizes=(16x16 32x32 48x48 64x64 128x128 256x256 512x512)
for _icons in "${icon_sizes[@]}";do
- install -Dm644 "${srcdir}/${pkgname//-/.}/app/src/assets/icon/${_icons}.png" \
+ install -Dm644 "${_src}/app/src/assets/icon/${_icons}.png" \
"${pkgdir}/usr/share/icons/hicolor/${_icons}/apps/${pkgname%-git}.png"
done
- install -Dm644 "${srcdir}/${pkgname//-/.}/app/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
+ install -Dm644 "${_src}/app/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
}

Scan history

Scanned at (UTC)SeverityRules
2026-09-29 05:22:53 Low 1
2026-09-18 11:28:26 Clean 0
2026-09-11 01:21:31 Clean 0
2026-09-07 09:14:05 Clean 0
2026-07-01 08:40:56 Clean 0
2026-06-18 16:11:54 Clean 0

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion