stoat-desktop-git

LOW
maintainer zxp19821005 11 votes scanned 2026-11-04 00:25:23.536954
View on AUR
Why flagged

The package builds from a public Git repository and uses standard Node.js tooling; the variable-named package installation occurs in a controlled environment using pnpm with resolved versions, posing no remote code execution or supply-chain risk.

Triggered rules

Low AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it LOW (confidence 95%): The package builds from a public Git repository and uses standard Node.js tooling; the variable-named package installation occurs in a controlled environment using pnpm with resolved versions, posing no remote code execution or supply-chain risk.

  • PKGBUILD:94 npm install -g "pnpm@${_pnpmver}" --prefix "${PNPM_GLOBAL_DIR}"

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2pkgname=stoat-desktop-git
3_pkgname=Stoat
4_debname="chat.stoat.${_pkgname}Desktop"
5pkgver=1.5.4.r0.g03b757c
6_electronversion=44
7_nodeversion=26
8pkgrel=1
9pkgdesc="Stoat for Desktop."
10arch=(
11 'aarch64'
12 'x86_64'
13)
14url="https://stoat.chat/"
15_ghurl="https://github.com/stoatchat/for-desktop"
16license=('AGPL-3.0-only')
17provides=("${pkgname%-git}=${pkgver%.r*}")
18conflicts=("${pkgname%-git}")
19depends=(
20 "electron${_electronversion}"
21 'libpipewire'
22)
23makedepends=(
24 'git'
25 'curl'
26 'jq'
27 'zip'
28 'pnpm'
29 'nvm'
30)
31source=(
32 "${pkgname%-git}.git::git+${_ghurl}.git"
33 "${pkgname%-git}.sh"
34)
35sha256sums=('SKIP'
36 'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
37pkgver() {
38 cd "${srcdir}/${pkgname%-git}.git"
39 set -o pipefail
40 git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
41 printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
42}
43_ensure_local_nvm() {
44 local NVM_DIR="${srcdir}/.nvm"
45 source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
46 nvm install "${_nodeversion}"
47 nvm use "${_nodeversion}"
48}
49_get_app_dir() {
50 find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1
51}
52_set_build_env() {
53 export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
54 export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
55 export ELECTRON_SKIP_BINARY_DOWNLOAD=1
56 _ev="$(electron${_electronversion} -v)"
57 export SYSTEM_ELECTRON_VERSION="${_ev#v}"
58 export HOME="${srcdir}/.electron-gyp"
59 mkdir -p "${HOME}"
60 export XDG_CACHE_HOME="${srcdir}/.cache"
61 export XDG_CONFIG_HOME="${srcdir}/.config"
62 export XDG_DATA_HOME="${srcdir}/.local/share"
63 export XDG_STATE_HOME="${srcdir}/.local/state"
64 export PNPM_HOME="${srcdir}/.pnpm/bin"
65 export PNPM_CACHE_DIR="${srcdir}/.pnpm_cache"
66 export PNPM_STORE_DIR="${srcdir}/.pnpm_store"
67 export PNPM_GLOBAL_DIR="${srcdir}/.pnpm/global"
68 export PNPM_STATE_DIR="${srcdir}/.pnpm/state"
69 export PNPM_MINIMUM_RELEASE_AGE=0
70 export PNPM_NODE_LINKER=hoisted
71 export PNPM_FETCH_RETRIES=3
72 export PNPM_FETCH_RETRY_MAXTIMEOUT=10000
73 export PNPM_UPDATE_NOTIFIER=false
74 export PNPM_NO_COLOR=true
75 export PNPM_NO_PROGRESS=true
76 export pnpm_config_platform=linux
77 export pnpm_config_arch="${CARCH}"
78 export NODE_OPTIONS="--max-old-space-size=4096"
79 export npm_config_node_options="--max-old-space-size=4096"
80 mkdir -p "${PNPM_CACHE_DIR}" "${PNPM_STORE_DIR}" "${PNPM_GLOBAL_DIR}" "${PNPM_HOME}" "${PNPM_STATE_DIR}"
81 export PATH="${PNPM_HOME}:${PATH}"
82 local _pnpmver="${_pnpmversion}"
83 if [[ -z "${_pnpmver}" ]]; then
84 _pnpmver="$(node -p "const pm=require('./package.json').packageManager; pm && pm.startsWith('pnpm@') ? pm.split('@')[1] : ''" 2>/dev/null)"
85 fi
86 if [[ -n "${_pnpmver}" ]]; then
87 export COREPACK_HOME="${srcdir}/.corepack"
88 install -dm755 "${srcdir}/.bin"
89 if command -v corepack &>/dev/null; then
90 corepack enable --install-directory "${srcdir}/.bin"
91 export PATH="${srcdir}/.bin:${PATH}"
92 corepack prepare "pnpm@${_pnpmver}" --activate
93 else
94 npm install -g "pnpm@${_pnpmver}" --prefix "${PNPM_GLOBAL_DIR}"
95 export PATH="${PNPM_GLOBAL_DIR}/bin:${PATH}"
96 fi
97 fi
98}
99_use_local_electron_for_forge() {
100 local _v="${SYSTEM_ELECTRON_VERSION}"
101 local _zd="${srcdir}/electron-zips"
102 case "${CARCH}" in
103 aarch64) _arch=arm64 ;;
104 x86_64) _arch=x64 ;;
105 esac
106 local _zf="${_zd}/electron-v${_v}-linux-${_arch}.zip"
107 install -Dm755 -d "${_zd}"
108 ( cd "${ELECTRON_DIST}" && zip -r -q -0 "${_zf}" . )
109 find . -name "forge.config.*" ! -path "*/node_modules/*" -print0 | while IFS= read -r -d '' _cfg; do
110 sed -i "/packagerConfig:[[:space:]]*{/a\\ electronZipDir: '${_zd}'," "${_cfg}"
111 done
112}
113_get_electron_version() {
114 _elec_ver=$(find "${srcdir}" -maxdepth 5 -name "package.json" ! -path "*/node_modules/*" \
115 -exec grep -l '"electron"' {} + | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null | head -1)
116 [[ -z "${_elec_ver}" ]] && return 1
117 echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
118}
119prepare() {
120 cd "${srcdir}/${pkgname%-git}.git"
121 _get_electron_version
122 sed -i -e "
123 s/@electronversion@/${_electronversion}/g
124 s/@appname@/${pkgname%-git}/g
125 s/@runname@/app.asar/g
126 s/@cfgdirname@/${pkgname%-git}/g
127 " "${srcdir}/${pkgname%-git}.sh"
128 _ensure_local_nvm
129 _set_build_env
130 sed -i "s/Icon=${_debname}/Icon=${pkgname%-git}/g" "${_debname}.desktop"
131 sed -i "s/${_debname}/${pkgname%-git}/g" "${_debname}.metainfo.xml"
132 sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\",\n \"@electron\/packager\": \"*\"/g" package.json
133 git -c submodule."assets".update=checkout submodule update --init assets
134 NODE_ENV=development pnpm install
135 _use_local_electron_for_forge
136}
137build() {
138 cd "${srcdir}/${pkgname%-git}.git"
139 _ensure_local_nvm
140 _set_build_env
141 NODE_ENV=production pnpm run package
142 #local _app_dir=$(_get_app_dir)
143 #rm -rf \
144 # "${_app_dir}/resources/app.asar.unpacked/node_modules/@electron-internal/extract-zip/"{*darwin*,*win32*} \
145 # "${_app_dir}/resources/app.asar.unpacked/node_modules/bufferutil/prebuilds/"{darwin-*,win32-*} \
146 # "${_app_dir}/resources/app.asar.unpacked/node_modules/utf-8-validate/prebuilds/"{darwin-*,win32-*}
147 #case "${CARCH}" in
148 # aarch64)
149 # rm -rf "${_app_dir}/resources/app.asar.unpacked/node_modules/@electron-internal/extract-zip/"*x64*
150 # ;;
151 # x86_64)
152 # rm -rf "${_app_dir}/resources/app.asar.unpacked/node_modules/@electron-internal/extract-zip/"*arm*
153 # ;;
154 #esac
155}
156package() {
157 install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
158 install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-git}"
159 local _app_dir=$(_get_app_dir)
160 cp -a "${_app_dir}/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"
161 install -Dm644 "${srcdir}/${pkgname%-git}.git/assets/desktop/icon.png" "${pkgdir}/usr/share/pixmaps/${pkgname%-git}.png"
162 install -Dm644 "${srcdir}/${pkgname%-git}.git/${_debname}.desktop" "${pkgdir}/usr/share/applications/${pkgname%-git}.desktop"
163 install -Dm644 "${srcdir}/${pkgname%-git}.git/${_debname}.metainfo.xml" "${pkgdir}/usr/share/metainfo/${pkgname%-git}.metainfo.xml"
164 install -Dm644 "${srcdir}/${pkgname%-git}.git/README.md" -t "${pkgdir}/usr/share/doc/${pkgname%-git}"
165}
166

Scan history

Scanned at (UTC)SeverityRules
2026-11-04 00:25:23 Low 1
2026-11-03 00:01:00 Low 1
2026-11-02 00:26:00 Low 1
2026-11-01 00:21:48 Low 1
2026-10-31 00:07:41 Low 1
2026-10-30 00:29:30 Low 1
2026-10-29 00:13:55 Low 1
2026-10-28 00:06:54 Low 1
2026-10-27 00:23:28 Low 1
2026-10-26 00:12:40 Low 1
2026-10-25 00:20:48 Low 1
2026-10-24 00:14:55 Low 1
2026-10-23 00:02:19 Low 1
2026-10-22 00:13:10 Low 1
2026-10-21 00:12:50 Low 1
2026-10-20 00:10:31 Low 1
2026-10-19 00:03:55 Low 1
2026-10-18 00:06:55 Low 1
2026-10-17 00:21:55 Low 1
2026-10-16 00:12:47 Low 1

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion