slopsmith-desktop-git
maintainer rehash
· 1 votes
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The package builds from source using git repositories and runs npm/pip for project dependencies, which is normal for Electron/Python apps; the flagged npx and pip commands are part of the build process for the application's own code, not remote code execution.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from source using git repositories and runs npm/pip for project dependencies, which is normal for Electron/Python apps; the flagged npx and pip commands are part of the build process for the application's own code, not remote code execution.
2 higher static findings superseded - not the current verdict (shown for transparency)
MEDIUM
npx/bunx/deno executes a remote package
remote_code_tool
`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.
-
PKGBUILD:79
npx electron-builder --linux dir
MEDIUM
pip install of an external package
pip_install_external
`pip install <package>` fetches an unpinned package from PyPI at build time, outside source=() and makepkg's checksums.
-
PKGBUILD:61
python -m pip install --target="build-python-libs" -r "$srcdir/slopsmith/requirements.txt"
PKGBUILD
2 offending line(s) highlighted
1
# Maintainer: Augusto Poletti <augusto.poletti@gmail.com>
2
_pkgname=slopsmith-desktop
3
pkgname=slopsmith-desktop-git
4
pkgver=r96.c1ea45e
5
pkgrel=11
6
pkgdesc="Standalone desktop app for Slopsmith with VST/NAM support and Audio I/O"
7
arch=('x86_64')
8
options=(!debug)
9
url="https://github.com/byrongamatos/slopsmith-desktop"
10
license=('AGPL3')
11
depends=('nodejs' 'alsa-lib' 'jack' 'nss' 'libxss' 'gtk3' 'python' 'ffmpeg' 'vgmstream-cli-bin')
12
makedepends=('git' 'npm' 'cmake' 'dotnet-sdk' 'python-pip')
13
provides=("$_pkgname")
14
conflicts=("$_pkgname" "slopsmith-git" "slopsmith")
15
source=("$_pkgname::git+$url.git"
16
"slopsmith::git+https://github.com/byrongamatos/slopsmith.git"
17
"Rocksmith2014.NET::git+https://github.com/iminashi/Rocksmith2014.NET.git")
18
sha256sums=('SKIP' 'SKIP' 'SKIP')
19
20
pkgver() {
21
cd "$_pkgname"
22
printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
23
}
24
25
prepare() {
26
cd "$srcdir/slopsmith"
27
msg2 "A corrigir caminhos das referências F#..."
28
sed -i 's|\.\./\.\./src|\.\./\.\./Rocksmith2014.NET/src|g' rscli/*.fsproj 2>/dev/null || true
29
30
# Garante a cópia das dependências para a pasta final
31
sed -i '/<\/PropertyGroup>/i <CopyLocalLockFileAssemblies>true</CopyLocalLockFileAssemblies>' rscli/*.fsproj
32
33
# ── O ANTÍDOTO DO FSHARP.CORE ──
34
# Desativa o pacote antigo padrão do SDK do Arch e injeta a versão exigida pela conversão
35
sed -i '/<\/PropertyGroup>/i <DisableImplicitFSharpCoreReference>true</DisableImplicitFSharpCoreReference>' rscli/*.fsproj
36
sed -i '/<\/Project>/i <ItemGroup><PackageReference Include="FSharp.Core" Version="10.1.300" /></ItemGroup>' rscli/*.fsproj
37
38
cd "$srcdir/$_pkgname"
39
git submodule update --init --recursive
40
npm install
41
}
42
43
build() {
44
cd "$srcdir/slopsmith/rscli"
45
msg2 "A restaurar e compilar motor F# (RsCli) como multi-file..."
46
dotnet publish -c Release \
47
-r linux-x64 \
48
--self-contained true \
49
-o ../dist/rscli \
50
-p:PublishReadyToRun=false \
51
-p:PublishSingleFile=false \
52
-p:CopyLocalLockFileAssemblies=true
53
54
cd "$srcdir/$_pkgname"
55
msg2 "A organizar recursos para o Electron..."
56
mkdir -p resources/python/bin resources/python/site-packages resources/bin/rscli
57
58
cp -r "$srcdir/slopsmith/dist/rscli/"* resources/bin/rscli/
59
cp -r "$srcdir/slopsmith" resources/slopsmith
60
61
python -m pip install --target="build-python-libs" -r "$srcdir/slopsmith/requirements.txt"
62
cp -r build-python-libs/* resources/python/site-packages/
63
64
cat <<'EOF' > resources/python/bin/python3
65
#!/bin/sh
66
export PYTHONHOME=/usr
67
export PYTHONPATH="/opt/slopsmith-desktop/resources/python/site-packages:/opt/slopsmith-desktop/resources/slopsmith:/opt/slopsmith-desktop/resources/slopsmith/lib:/opt/slopsmith-desktop/resources/slopsmith/src"
68
exec /usr/bin/python3 "$@"
69
EOF
70
chmod +x resources/python/bin/python3
71
72
ln -sf /usr/bin/ffmpeg resources/bin/ffmpeg
73
ln -sf /usr/bin/ffprobe resources/bin/ffprobe
74
ln -sf /usr/bin/vgmstream-cli resources/bin/vgmstream-cli
75
76
msg2 "A compilar Audio Engine e Interface..."
77
npm run build:audio
78
npm run build:ts
79
npx electron-builder --linux dir
80
}
81
82
package() {
83
cd "$srcdir/$_pkgname"
84
_installdir="$pkgdir/opt/$_pkgname"
85
_rsclidir="$_installdir/resources/bin/rscli"
86
install -d "$_installdir"
87
cp -r release/linux-unpacked/* "$_installdir/"
88
89
install -d "$pkgdir/usr/bin"
90
ln -sf "/opt/$_pkgname/slopsmith-desktop" "$pkgdir/usr/bin/$_pkgname"
91
92
msg2 "A instalar RsCli com shell wrapper (multi-file fix)..."
93
install -d "$_rsclidir"
94
cp -r "$srcdir/slopsmith/dist/rscli/"* "$_rsclidir/"
95
96
_target_bin=""
97
if [ -f "$_rsclidir/rscli" ]; then _target_bin="rscli";
98
elif [ -f "$_rsclidir/RsCli" ]; then _target_bin="RsCli"; fi
99
100
if [ -n "$_target_bin" ]; then
101
mv "$_rsclidir/$_target_bin" "$_rsclidir/RsCli.bin"
102
103
cat <<'EOF' > "$_rsclidir/RsCli"
104
#!/bin/sh
105
_dir=$(dirname "$(readlink -f "$0")")
106
cd "$_dir"
107
export DOTNET_MULTILEVEL_LOOKUP=0
108
exec ./RsCli.bin "$@"
109
EOF
110
chmod +x "$_rsclidir/RsCli" "$_rsclidir/RsCli.bin"
111
fi
112
113
install -d "$pkgdir/usr/share/applications"
114
cat <<EOF > "$pkgdir/usr/share/applications/$_pkgname.desktop"
115
[Desktop Entry]
116
Name=Slopsmith Desktop
117
Exec=$_pkgname %U
118
Terminal=false
119
Type=Application
120
Icon=$_pkgname
121
StartupWMClass=slopsmith-desktop
122
Comment=Practice Rocksmith CDLC with VST/NAM support
123
Categories=AudioVideo;Audio;Music;
124
EOF
125
126
_icon=$(find . -type f \( -name "icon.png" -o -path "*/icons/512x512.png" \) | head -n 1)
127
[ -n "$_icon" ] && install -Dm644 "$_icon" "$pkgdir/usr/share/icons/hicolor/512x512/apps/$_pkgname.png"
128
129
chmod +x "$_installdir/slopsmith-desktop"
130
}
131
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 3 |
| 2026-08-02 00:16:08 | LOW | 3 |
| 2026-08-01 00:11:18 | LOW | 3 |
| 2026-07-31 00:14:10 | LOW | 3 |
| 2026-07-30 00:17:23 | LOW | 3 |
| 2026-07-29 00:25:53 | LOW | 3 |
| 2026-07-28 00:07:28 | LOW | 3 |
| 2026-07-27 00:24:32 | LOW | 3 |
| 2026-07-26 00:07:32 | LOW | 3 |
| 2026-07-25 00:13:44 | LOW | 3 |
| 2026-07-24 00:02:28 | LOW | 3 |
| 2026-07-23 00:14:47 | LOW | 3 |
| 2026-07-22 00:29:32 | LOW | 3 |
| 2026-07-21 00:24:15 | LOW | 3 |
| 2026-07-20 00:19:49 | LOW | 3 |
| 2026-07-19 00:17:08 | LOW | 3 |
| 2026-07-18 00:14:48 | LOW | 3 |
| 2026-07-17 00:06:16 | LOW | 3 |
| 2026-07-16 00:05:41 | LOW | 3 |
| 2026-07-15 00:09:25 | LOW | 3 |