slopsmith-desktop-git

LOW

maintainer rehash 1 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package builds from source using git repositories and runs npm/pip for project dependencies, which is normal for Electron/Python apps; the flagged npx and pip commands are part of the build process for the application's own code, not remote code execution.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from source using git repositories and runs npm/pip for project dependencies, which is normal for Electron/Python apps; the flagged npx and pip commands are part of the build process for the application's own code, not remote code execution.

2 higher static findings superseded - not the current verdict (shown for transparency)

Medium npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:79 npx electron-builder --linux dir

Medium pip install of an external package pip_install_external

`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.

PKGBUILD:61 python -m pip install --target="build-python-libs" -r "$srcdir/slopsmith/requirements.txt"

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Augusto Poletti <augusto.poletti@gmail.com>
    
      2_pkgname=slopsmith-desktop
    
      3pkgname=slopsmith-desktop-git
    
      4pkgver=r96.c1ea45e
    
      5pkgrel=11
    
      6pkgdesc="Standalone desktop app for Slopsmith with VST/NAM support and Audio I/O"
    
      7arch=('x86_64')
    
      8options=(!debug)
    
      9url="https://github.com/byrongamatos/slopsmith-desktop"
    
      10license=('AGPL3')
    
      11depends=('nodejs' 'alsa-lib' 'jack' 'nss' 'libxss' 'gtk3' 'python' 'ffmpeg' 'vgmstream-cli-bin')
    
      12makedepends=('git' 'npm' 'cmake' 'dotnet-sdk' 'python-pip')
    
      13provides=("$_pkgname")
    
      14conflicts=("$_pkgname" "slopsmith-git" "slopsmith")
    
      15source=("$_pkgname::git+$url.git"
    
      16        "slopsmith::git+https://github.com/byrongamatos/slopsmith.git"
    
      17        "Rocksmith2014.NET::git+https://github.com/iminashi/Rocksmith2014.NET.git")
    
      18sha256sums=('SKIP' 'SKIP' 'SKIP')
    
      19
    
      20pkgver() {
    
      21  cd "$_pkgname"
    
      22  printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
    
      23}
    
      24
    
      25prepare() {
    
      26  cd "$srcdir/slopsmith"
    
      27  msg2 "A corrigir caminhos das referências F#..."
    
      28  sed -i 's|\.\./\.\./src|\.\./\.\./Rocksmith2014.NET/src|g' rscli/*.fsproj 2>/dev/null || true
    
      29
    
      30  # Garante a cópia das dependências para a pasta final
    
      31  sed -i '/<\/PropertyGroup>/i <CopyLocalLockFileAssemblies>true</CopyLocalLockFileAssemblies>' rscli/*.fsproj
    
      32
    
      33  # ── O ANTÍDOTO DO FSHARP.CORE ──
    
      34  # Desativa o pacote antigo padrão do SDK do Arch e injeta a versão exigida pela conversão
    
      35  sed -i '/<\/PropertyGroup>/i <DisableImplicitFSharpCoreReference>true</DisableImplicitFSharpCoreReference>' rscli/*.fsproj
    
      36  sed -i '/<\/Project>/i <ItemGroup><PackageReference Include="FSharp.Core" Version="10.1.300" /></ItemGroup>' rscli/*.fsproj
    
      37
    
      38  cd "$srcdir/$_pkgname"
    
      39  git submodule update --init --recursive
    
      40  npm install
    
      41}
    
      42
    
      43build() {
    
      44  cd "$srcdir/slopsmith/rscli"
    
      45  msg2 "A restaurar e compilar motor F# (RsCli) como multi-file..."
    
      46  dotnet publish -c Release \
    
      47                 -r linux-x64 \
    
      48                 --self-contained true \
    
      49                 -o ../dist/rscli \
    
      50                 -p:PublishReadyToRun=false \
    
      51                 -p:PublishSingleFile=false \
    
      52                 -p:CopyLocalLockFileAssemblies=true
    
      53
    
      54  cd "$srcdir/$_pkgname"
    
      55  msg2 "A organizar recursos para o Electron..."
    
      56  mkdir -p resources/python/bin resources/python/site-packages resources/bin/rscli
    
      57
    
      58  cp -r "$srcdir/slopsmith/dist/rscli/"* resources/bin/rscli/
    
      59  cp -r "$srcdir/slopsmith" resources/slopsmith
    
      60
    
      61  python -m pip install --target="build-python-libs" -r "$srcdir/slopsmith/requirements.txt"
    
      62  cp -r build-python-libs/* resources/python/site-packages/
    
      63
    
      64  cat <<'EOF' > resources/python/bin/python3
    
      65#!/bin/sh
    
      66export PYTHONHOME=/usr
    
      67export PYTHONPATH="/opt/slopsmith-desktop/resources/python/site-packages:/opt/slopsmith-desktop/resources/slopsmith:/opt/slopsmith-desktop/resources/slopsmith/lib:/opt/slopsmith-desktop/resources/slopsmith/src"
    
      68exec /usr/bin/python3 "$@"
    
      69EOF
    
      70  chmod +x resources/python/bin/python3
    
      71
    
      72  ln -sf /usr/bin/ffmpeg resources/bin/ffmpeg
    
      73  ln -sf /usr/bin/ffprobe resources/bin/ffprobe
    
      74  ln -sf /usr/bin/vgmstream-cli resources/bin/vgmstream-cli
    
      75
    
      76  msg2 "A compilar Audio Engine e Interface..."
    
      77  npm run build:audio
    
      78  npm run build:ts
    
      79  npx electron-builder --linux dir
    
      80}
    
      81
    
      82package() {
    
      83  cd "$srcdir/$_pkgname"
    
      84  _installdir="$pkgdir/opt/$_pkgname"
    
      85  _rsclidir="$_installdir/resources/bin/rscli"
    
      86  install -d "$_installdir"
    
      87  cp -r release/linux-unpacked/* "$_installdir/"
    
      88
    
      89  install -d "$pkgdir/usr/bin"
    
      90  ln -sf "/opt/$_pkgname/slopsmith-desktop" "$pkgdir/usr/bin/$_pkgname"
    
      91
    
      92  msg2 "A instalar RsCli com shell wrapper (multi-file fix)..."
    
      93  install -d "$_rsclidir"
    
      94  cp -r "$srcdir/slopsmith/dist/rscli/"* "$_rsclidir/"
    
      95
    
      96  _target_bin=""
    
      97  if [ -f "$_rsclidir/rscli" ]; then _target_bin="rscli";
    
      98  elif [ -f "$_rsclidir/RsCli" ]; then _target_bin="RsCli"; fi
    
      99
    
      100  if [ -n "$_target_bin" ]; then
    
      101    mv "$_rsclidir/$_target_bin" "$_rsclidir/RsCli.bin"
    
      102
    
      103    cat <<'EOF' > "$_rsclidir/RsCli"
    
      104#!/bin/sh
    
      105_dir=$(dirname "$(readlink -f "$0")")
    
      106cd "$_dir"
    
      107export DOTNET_MULTILEVEL_LOOKUP=0
    
      108exec ./RsCli.bin "$@"
    
      109EOF
    
      110    chmod +x "$_rsclidir/RsCli" "$_rsclidir/RsCli.bin"
    
      111  fi
    
      112
    
      113  install -d "$pkgdir/usr/share/applications"
    
      114  cat <<EOF > "$pkgdir/usr/share/applications/$_pkgname.desktop"
    
      115[Desktop Entry]
    
      116Name=Slopsmith Desktop
    
      117Exec=$_pkgname %U
    
      118Terminal=false
    
      119Type=Application
    
      120Icon=$_pkgname
    
      121StartupWMClass=slopsmith-desktop
    
      122Comment=Practice Rocksmith CDLC with VST/NAM support
    
      123Categories=AudioVideo;Audio;Music;
    
      124EOF
    
      125
    
      126  _icon=$(find . -type f \( -name "icon.png" -o -path "*/icons/512x512.png" \) | head -n 1)
    
      127  [ -n "$_icon" ] && install -Dm644 "$_icon" "$pkgdir/usr/share/icons/hicolor/512x512/apps/$_pkgname.png"
    
      128
    
      129  chmod +x "$_installdir/slopsmith-desktop"
    
      130}
    
      131

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	3
2026-09-16 00:03:17	Low	3
2026-09-15 00:25:31	Low	3
2026-09-14 00:27:57	Low	3
2026-09-13 00:19:54	Low	3
2026-09-12 00:25:17	Low	3
2026-09-11 00:19:22	Low	3
2026-09-10 00:22:44	Low	3
2026-09-09 00:04:09	Low	3
2026-09-08 00:18:08	Low	3
2026-09-07 00:30:15	Low	3
2026-09-06 00:17:06	Low	3
2026-09-05 00:16:27	Low	3
2026-09-04 00:03:13	Low	3
2026-09-03 00:15:47	Low	3
2026-09-02 00:02:31	Low	3
2026-09-01 00:11:19	Low	3
2026-08-31 00:19:57	Low	3
2026-08-30 00:04:14	Low	3
2026-08-29 00:29:17	Low	3