stoat-desktop-git

LOW
maintainer zxp19821005 11 votes scanned 2026-09-20 05:32:24.928598
View on AUR
Why flagged

The package builds from a public Git repository and uses standard Node.js tooling; the variable-named package installation occurs in a controlled environment using pnpm with resolved versions, posing no remote code execution or supply-chain risk.

Triggered rules

Low AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it LOW (confidence 95%): The package builds from a public Git repository and uses standard Node.js tooling; the variable-named package installation occurs in a controlled environment using pnpm with resolved versions, posing no remote code execution or supply-chain risk.

  • PKGBUILD:94 npm install -g "pnpm@${_pnpmver}" --prefix "${PNPM_GLOBAL_DIR}"

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2pkgname=stoat-desktop-git
3_pkgname=Stoat
4_debname="chat.stoat.${_pkgname}Desktop"
5pkgver=1.5.4.r0.g03b757c
6_electronversion=44
7_nodeversion=26
8pkgrel=1
9pkgdesc="Stoat for Desktop."
10arch=(
11 'aarch64'
12 'x86_64'
13)
14url="https://stoat.chat/"
15_ghurl="https://github.com/stoatchat/for-desktop"
16license=('AGPL-3.0-only')
17provides=("${pkgname%-git}=${pkgver%.r*}")
18conflicts=("${pkgname%-git}")
19depends=(
20 "electron${_electronversion}"
21 'libpipewire'
22)
23makedepends=(
24 'git'
25 'curl'
26 'jq'
27 'zip'
28 'pnpm'
29 'nvm'
30)
31source=(
32 "${pkgname%-git}.git::git+${_ghurl}.git"
33 "${pkgname%-git}.sh"
34)
35sha256sums=('SKIP'
36 'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
37pkgver() {
38 cd "${srcdir}/${pkgname%-git}.git"
39 set -o pipefail
40 git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
41 printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
42}
43_ensure_local_nvm() {
44 local NVM_DIR="${srcdir}/.nvm"
45 source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
46 nvm install "${_nodeversion}"
47 nvm use "${_nodeversion}"
48}
49_get_app_dir() {
50 find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1
51}
52_set_build_env() {
53 export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
54 export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
55 export ELECTRON_SKIP_BINARY_DOWNLOAD=1
56 _ev="$(electron${_electronversion} -v)"
57 export SYSTEM_ELECTRON_VERSION="${_ev#v}"
58 export HOME="${srcdir}/.electron-gyp"
59 mkdir -p "${HOME}"
60 export XDG_CACHE_HOME="${srcdir}/.cache"
61 export XDG_CONFIG_HOME="${srcdir}/.config"
62 export XDG_DATA_HOME="${srcdir}/.local/share"
63 export XDG_STATE_HOME="${srcdir}/.local/state"
64 export PNPM_HOME="${srcdir}/.pnpm/bin"
65 export PNPM_CACHE_DIR="${srcdir}/.pnpm_cache"
66 export PNPM_STORE_DIR="${srcdir}/.pnpm_store"
67 export PNPM_GLOBAL_DIR="${srcdir}/.pnpm/global"
68 export PNPM_STATE_DIR="${srcdir}/.pnpm/state"
69 export PNPM_MINIMUM_RELEASE_AGE=0
70 export PNPM_NODE_LINKER=hoisted
71 export PNPM_FETCH_RETRIES=3
72 export PNPM_FETCH_RETRY_MAXTIMEOUT=10000
73 export PNPM_UPDATE_NOTIFIER=false
74 export PNPM_NO_COLOR=true
75 export PNPM_NO_PROGRESS=true
76 export pnpm_config_platform=linux
77 export pnpm_config_arch="${CARCH}"
78 export NODE_OPTIONS="--max-old-space-size=4096"
79 export npm_config_node_options="--max-old-space-size=4096"
80 mkdir -p "${PNPM_CACHE_DIR}" "${PNPM_STORE_DIR}" "${PNPM_GLOBAL_DIR}" "${PNPM_HOME}" "${PNPM_STATE_DIR}"
81 export PATH="${PNPM_HOME}:${PATH}"
82 local _pnpmver="${_pnpmversion}"
83 if [[ -z "${_pnpmver}" ]]; then
84 _pnpmver="$(node -p "const pm=require('./package.json').packageManager; pm && pm.startsWith('pnpm@') ? pm.split('@')[1] : ''" 2>/dev/null)"
85 fi
86 if [[ -n "${_pnpmver}" ]]; then
87 export COREPACK_HOME="${srcdir}/.corepack"
88 install -dm755 "${srcdir}/.bin"
89 if command -v corepack &>/dev/null; then
90 corepack enable --install-directory "${srcdir}/.bin"
91 export PATH="${srcdir}/.bin:${PATH}"
92 corepack prepare "pnpm@${_pnpmver}" --activate
93 else
94 npm install -g "pnpm@${_pnpmver}" --prefix "${PNPM_GLOBAL_DIR}"
95 export PATH="${PNPM_GLOBAL_DIR}/bin:${PATH}"
96 fi
97 fi
98}
99_use_local_electron_for_forge() {
100 local _v="${SYSTEM_ELECTRON_VERSION}"
101 local _zd="${srcdir}/electron-zips"
102 case "${CARCH}" in
103 aarch64) _arch=arm64 ;;
104 x86_64) _arch=x64 ;;
105 esac
106 local _zf="${_zd}/electron-v${_v}-linux-${_arch}.zip"
107 install -Dm755 -d "${_zd}"
108 ( cd "${ELECTRON_DIST}" && zip -r -q -0 "${_zf}" . )
109 find . -name "forge.config.*" ! -path "*/node_modules/*" -print0 | while IFS= read -r -d '' _cfg; do
110 sed -i "/packagerConfig:[[:space:]]*{/a\\ electronZipDir: '${_zd}'," "${_cfg}"
111 done
112}
113_get_electron_version() {
114 _elec_ver=$(find "${srcdir}" -maxdepth 5 -name "package.json" ! -path "*/node_modules/*" \
115 -exec grep -l '"electron"' {} + | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null | head -1)
116 [[ -z "${_elec_ver}" ]] && return 1
117 echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
118}
119prepare() {
120 cd "${srcdir}/${pkgname%-git}.git"
121 _get_electron_version
122 sed -i -e "
123 s/@electronversion@/${_electronversion}/g
124 s/@appname@/${pkgname%-git}/g
125 s/@runname@/app.asar/g
126 s/@cfgdirname@/${pkgname%-git}/g
127 " "${srcdir}/${pkgname%-git}.sh"
128 _ensure_local_nvm
129 _set_build_env
130 sed -i "s/Icon=${_debname}/Icon=${pkgname%-git}/g" "${_debname}.desktop"
131 sed -i "s/${_debname}/${pkgname%-git}/g" "${_debname}.metainfo.xml"
132 sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\",\n \"@electron\/packager\": \"*\"/g" package.json
133 git -c submodule."assets".update=checkout submodule update --init assets
134 NODE_ENV=development pnpm install
135 _use_local_electron_for_forge
136}
137build() {
138 cd "${srcdir}/${pkgname%-git}.git"
139 _ensure_local_nvm
140 _set_build_env
141 NODE_ENV=production pnpm run package
142 #local _app_dir=$(_get_app_dir)
143 #rm -rf \
144 # "${_app_dir}/resources/app.asar.unpacked/node_modules/@electron-internal/extract-zip/"{*darwin*,*win32*} \
145 # "${_app_dir}/resources/app.asar.unpacked/node_modules/bufferutil/prebuilds/"{darwin-*,win32-*} \
146 # "${_app_dir}/resources/app.asar.unpacked/node_modules/utf-8-validate/prebuilds/"{darwin-*,win32-*}
147 #case "${CARCH}" in
148 # aarch64)
149 # rm -rf "${_app_dir}/resources/app.asar.unpacked/node_modules/@electron-internal/extract-zip/"*x64*
150 # ;;
151 # x86_64)
152 # rm -rf "${_app_dir}/resources/app.asar.unpacked/node_modules/@electron-internal/extract-zip/"*arm*
153 # ;;
154 #esac
155}
156package() {
157 install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
158 install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-git}"
159 local _app_dir=$(_get_app_dir)
160 cp -a "${_app_dir}/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"
161 install -Dm644 "${srcdir}/${pkgname%-git}.git/assets/desktop/icon.png" "${pkgdir}/usr/share/pixmaps/${pkgname%-git}.png"
162 install -Dm644 "${srcdir}/${pkgname%-git}.git/${_debname}.desktop" "${pkgdir}/usr/share/applications/${pkgname%-git}.desktop"
163 install -Dm644 "${srcdir}/${pkgname%-git}.git/${_debname}.metainfo.xml" "${pkgdir}/usr/share/metainfo/${pkgname%-git}.metainfo.xml"
164 install -Dm644 "${srcdir}/${pkgname%-git}.git/README.md" -t "${pkgdir}/usr/share/doc/${pkgname%-git}"
165}
166

Changes since previous scan

--- PKGBUILD @ 2026-09-09 09:19
+++ PKGBUILD @ 2026-09-20 05:32
@@ -2,9 +2,9 @@
pkgname=stoat-desktop-git
_pkgname=Stoat
_debname="chat.stoat.${_pkgname}Desktop"
-pkgver=1.5.3.r3.g68cfeb5
-_electronversion=43
-_nodeversion=24
+pkgver=1.5.4.r0.g03b757c
+_electronversion=44
+_nodeversion=26
pkgrel=1
pkgdesc="Stoat for Desktop."
arch=(
@@ -21,12 +21,12 @@
'libpipewire'
)
makedepends=(
- 'npm'
- 'pnpm'
- 'nvm'
'git'
'curl'
'jq'
+ 'zip'
+ 'pnpm'
+ 'nvm'
)
source=(
"${pkgname%-git}.git::git+${_ghurl}.git"
@@ -51,31 +51,64 @@
}
_set_build_env() {
export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
- export ELECTRON_OVERRIDE_DIST_PATH="/usr/lib/electron${_electronversion}"
+ export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
export ELECTRON_SKIP_BINARY_DOWNLOAD=1
- export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/v//g')"
+ _ev="$(electron${_electronversion} -v)"
+ export SYSTEM_ELECTRON_VERSION="${_ev#v}"
export HOME="${srcdir}/.electron-gyp"
- export ELECTRON_ZIP_DIR="/usr/lib/electron${_electronversion}"
- {
- export PNPM_LINK_WORKSPACE_PACKAGES=true
- export PNPM_FETCH_RETRY_MAXTIMEOUT=10000
- export PNPM_CACHE_DIR="${srcdir}/.pnpm_cache"
- export PNPM_STORE_DIR="${srcdir}/.pnpm_store"
- export PNPM_VIRTUAL_STORE_DIR="${srcdir}/.pnpm_store"
- export PNPM_SHAMEFULLY_HOIST=true
- export PNPM_VIRTUAL_STORE_DIR_MAX_LENGTH=80
- export PNPM_NODE_LINKER=hoisted
- export PNPM_NETWORK_CONCURRENCY=32
- }
- if [[ "$(curl -s ipinfo.io/country)" == *"CN"* ]]; then
- {
- export pnpm_config_registry="https://registry.npmmirror.com"
- export npm_config_registry="https://registry.npmmirror.com"
- export NPM_CONFIG_ELECTRON_MIRROR="https://registry.npmmirror.com/-/binary/electron/"
- export NPM_CONFIG_ELECTRON_BUILDER_BINARIES_MIRROR="https://registry.npmmirror.com/-/binary/electron-builder-binaries/"
- export NODEJS_ORG_MIRROR="https://npmmirror.com/mirrors/node"
- }
+ mkdir -p "${HOME}"
+ export XDG_CACHE_HOME="${srcdir}/.cache"
+ export XDG_CONFIG_HOME="${srcdir}/.config"
+ export XDG_DATA_HOME="${srcdir}/.local/share"
+ export XDG_STATE_HOME="${srcdir}/.local/state"
+ export PNPM_HOME="${srcdir}/.pnpm/bin"
+ export PNPM_CACHE_DIR="${srcdir}/.pnpm_cache"
+ export PNPM_STORE_DIR="${srcdir}/.pnpm_store"
+ export PNPM_GLOBAL_DIR="${srcdir}/.pnpm/global"
+ export PNPM_STATE_DIR="${srcdir}/.pnpm/state"
+ export PNPM_MINIMUM_RELEASE_AGE=0
+ export PNPM_NODE_LINKER=hoisted
+ export PNPM_FETCH_RETRIES=3
+ export PNPM_FETCH_RETRY_MAXTIMEOUT=10000
+ export PNPM_UPDATE_NOTIFIER=false
+ export PNPM_NO_COLOR=true
+ export PNPM_NO_PROGRESS=true
+ export pnpm_config_platform=linux
+ export pnpm_config_arch="${CARCH}"
+ export NODE_OPTIONS="--max-old-space-size=4096"
+ export npm_config_node_options="--max-old-space-size=4096"
+ mkdir -p "${PNPM_CACHE_DIR}" "${PNPM_STORE_DIR}" "${PNPM_GLOBAL_DIR}" "${PNPM_HOME}" "${PNPM_STATE_DIR}"
+ export PATH="${PNPM_HOME}:${PATH}"
+ local _pnpmver="${_pnpmversion}"
+ if [[ -z "${_pnpmver}" ]]; then
+ _pnpmver="$(node -p "const pm=require('./package.json').packageManager; pm && pm.startsWith('pnpm@') ? pm.split('@')[1] : ''" 2>/dev/null)"
fi
+ if [[ -n "${_pnpmver}" ]]; then
+ export COREPACK_HOME="${srcdir}/.corepack"
+ install -dm755 "${srcdir}/.bin"
+ if command -v corepack &>/dev/null; then
+ corepack enable --install-directory "${srcdir}/.bin"
+ export PATH="${srcdir}/.bin:${PATH}"
+ corepack prepare "pnpm@${_pnpmver}" --activate
+ else
+ npm install -g "pnpm@${_pnpmver}" --prefix "${PNPM_GLOBAL_DIR}"
+ export PATH="${PNPM_GLOBAL_DIR}/bin:${PATH}"
+ fi
+ fi
+}
+_use_local_electron_for_forge() {
+ local _v="${SYSTEM_ELECTRON_VERSION}"
+ local _zd="${srcdir}/electron-zips"
+ case "${CARCH}" in
+ aarch64) _arch=arm64 ;;
+ x86_64) _arch=x64 ;;
+ esac
+ local _zf="${_zd}/electron-v${_v}-linux-${_arch}.zip"
+ install -Dm755 -d "${_zd}"
+ ( cd "${ELECTRON_DIST}" && zip -r -q -0 "${_zf}" . )
+ find . -name "forge.config.*" ! -path "*/node_modules/*" -print0 | while IFS= read -r -d '' _cfg; do
+ sed -i "/packagerConfig:[[:space:]]*{/a\\ electronZipDir: '${_zd}'," "${_cfg}"
+ done
}
_get_electron_version() {
_elec_ver=$(find "${srcdir}" -maxdepth 5 -name "package.json" ! -path "*/node_modules/*" \
@@ -92,41 +125,42 @@
s/@runname@/app.asar/g
s/@cfgdirname@/${pkgname%-git}/g
" "${srcdir}/${pkgname%-git}.sh"
+ _ensure_local_nvm
_set_build_env
- _ensure_local_nvm
sed -i "s/Icon=${_debname}/Icon=${pkgname%-git}/g" "${_debname}.desktop"
- sed -i "s/Icon=${_debname}/Icon=${pkgname%-git}/g" "${_debname}.metainfo.xml"
+ sed -i "s/${_debname}/${pkgname%-git}/g" "${_debname}.metainfo.xml"
+ sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\",\n \"@electron\/packager\": \"*\"/g" package.json
git -c submodule."assets".update=checkout submodule update --init assets
- sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\",\n \"@electron\/packager\": \"*\"/g" package.json
- NODE_ENV=development pnpm install --package-import-method=hardlink
+ NODE_ENV=development pnpm install
+ _use_local_electron_for_forge
}
build() {
cd "${srcdir}/${pkgname%-git}.git"
+ _ensure_local_nvm
_set_build_env
- _ensure_local_nvm
- NODE_ENV=production pnpm exec electron-packager . --platform=linux --electron-dist-source=${ELECTRON_DIST} --no-prune --deref-symlinks=false --out=out
- local _app_dir=$(_get_app_dir)
- rm -rf \
- "${_app_dir}/resources/app.asar.unpacked/node_modules/@electron-internal/extract-zip/"{*darwin*,*win32*} \
- "${_app_dir}/resources/app.asar.unpacked/node_modules/bufferutil/prebuilds/"{darwin-*,win32-*} \
- "${_app_dir}/resources/app.asar.unpacked/node_modules/utf-8-validate/prebuilds/"{darwin-*,win32-*}
- case "${CARCH}" in
- aarch64)
- rm -rf "${_app_dir}/resources/app.asar.unpacked/node_modules/@electron-internal/extract-zip/"*x64*
- ;;
- x86_64)
- rm -rf "${_app_dir}/resources/app.asar.unpacked/node_modules/@electron-internal/extract-zip/"*arm*
- ;;
- esac
+ NODE_ENV=production pnpm run package
+ #local _app_dir=$(_get_app_dir)
+ #rm -rf \
+ # "${_app_dir}/resources/app.asar.unpacked/node_modules/@electron-internal/extract-zip/"{*darwin*,*win32*} \
+ # "${_app_dir}/resources/app.asar.unpacked/node_modules/bufferutil/prebuilds/"{darwin-*,win32-*} \
+ # "${_app_dir}/resources/app.asar.unpacked/node_modules/utf-8-validate/prebuilds/"{darwin-*,win32-*}
+ #case "${CARCH}" in
+ # aarch64)
+ # rm -rf "${_app_dir}/resources/app.asar.unpacked/node_modules/@electron-internal/extract-zip/"*x64*
+ # ;;
+ # x86_64)
+ # rm -rf "${_app_dir}/resources/app.asar.unpacked/node_modules/@electron-internal/extract-zip/"*arm*
+ # ;;
+ #esac
}
package() {
install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-git}"
local _app_dir=$(_get_app_dir)
- cp -a "${_app_dir}/resources/"* "${pkgdir}/usr/lib/${pkgname%-git}/"
+ cp -a "${_app_dir}/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"
install -Dm644 "${srcdir}/${pkgname%-git}.git/assets/desktop/icon.png" "${pkgdir}/usr/share/pixmaps/${pkgname%-git}.png"
install -Dm644 "${srcdir}/${pkgname%-git}.git/${_debname}.desktop" "${pkgdir}/usr/share/applications/${pkgname%-git}.desktop"
install -Dm644 "${srcdir}/${pkgname%-git}.git/${_debname}.metainfo.xml" "${pkgdir}/usr/share/metainfo/${pkgname%-git}.metainfo.xml"
- install -Dm644 "${srcdir}/${pkgname%-git}.git/README.md" -t "${pkgdir}/usr/share/licenses/${pkgname}"
+ install -Dm644 "${srcdir}/${pkgname%-git}.git/README.md" -t "${pkgdir}/usr/share/doc/${pkgname%-git}"
}

Scan history

Scanned at (UTC)SeverityRules
2026-09-20 05:32:24 Low 1
2026-09-09 09:19:26 Clean 0
2026-09-07 11:14:32 Clean 0
2026-08-18 03:38:23 Clean 0
2026-08-18 00:03:42 Low 2
2026-08-17 00:18:29 Low 2
2026-08-16 00:03:42 Low 2
2026-08-15 00:26:13 Low 2
2026-08-14 00:03:41 Low 2
2026-08-13 00:17:07 Low 2
2026-08-12 00:27:08 Low 2
2026-08-11 00:07:57 Low 2
2026-08-10 00:09:14 Low 2
2026-08-09 00:07:45 Low 2
2026-08-08 00:18:14 Low 2
2026-08-07 00:19:04 Low 2
2026-08-06 00:26:13 Low 2
2026-08-05 00:12:14 Low 2
2026-08-04 00:01:00 Low 2
2026-08-03 00:08:14 Low 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion