surrealist-cef

maintainer That1Calculator · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds from source and installs dependencies via cargo from the official tauri-apps GitHub repository, which is a normal and expected part of building a Rust-based desktop application; the flagged 'external install' via cargo is legitimate and not malicious.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The package builds from source and installs dependencies via cargo from the official tauri-apps GitHub repository, which is a normal and expected part of building a Rust-based desktop application; the flagged 'external install' via cargo is legitimate and not malicious.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM External install via pipx/uv/poetry/cargo/go/gem alt_pkg_manager_install

A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.

PKGBUILD:77 cargo install tauri-cli \

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Kainoa Kanter <kainoa@t1c.dev>
    
      2
    
      3_pkgname=surrealist
    
      4pkgname="$_pkgname-cef"
    
      5pkgver=3.7.2
    
      6pkgrel=2
    
      7pkgdesc="Surrealist is the ultimate way to visually manage your SurrealDB database (Experimental CEF runtime)"
    
      8arch=("x86_64" "aarch64")
    
      9url="https://github.com/surrealdb/surrealist"
    
      10license=("MIT")
    
      11groups=()
    
      12depends=(
    
      13    'alsa-lib'
    
      14    'at-spi2-core'
    
      15    'cairo'
    
      16    'dbus'
    
      17    'expat'
    
      18    'gcc-libs'
    
      19    'glib2'
    
      20    'glibc'
    
      21    'libcups'
    
      22    'libdrm'
    
      23    'libx11'
    
      24    'libxcb'
    
      25    'libxcomposite'
    
      26    'libxdamage'
    
      27    'libxext'
    
      28    'libxfixes'
    
      29    'libxkbcommon'
    
      30    'libxrandr'
    
      31    'mesa'
    
      32    'nspr'
    
      33    'nss'
    
      34    'openssl'
    
      35    'pango'
    
      36    'wayland'
    
      37)
    
      38makedepends=(
    
      39    'rust'
    
      40    'cargo'
    
      41    'git'
    
      42    'jq'
    
      43)
    
      44optdepends=('surrealdb: non-sandboxed SurrealDB instance')
    
      45provides=("$_pkgname")
    
      46conflicts=("$_pkgname" "$_pkgname-bin")
    
      47source=(
    
      48    "$url/archive/refs/tags/surrealist-v$pkgver.tar.gz"
    
      49    'cef-runtime.patch'
    
      50    'surrealist'
    
      51    'Surrealist.desktop'
    
      52)
    
      53sha256sums=('51d6ae88a746a4a5cbce6b19aaf6778acffd990f7b26e5e9ca8e20348c88f729'
    
      54            '1790c8fdaec8750844c69d6d1798b41236504461313764c6f740dad0a56376a7'
    
      55            '9f2c7374511c39bb98cb8a41f85908b76f90052904edb88b17a1523e40942fb1'
    
      56            '94f0619847e1136a07c7386c9bf20fec15ff29c69c4dede523958beeaed28427')
    
      57
    
      58_srcdir="$srcdir/$_pkgname-$_pkgname-v$pkgver"
    
      59_cef_ver="144.0.7"
    
      60
    
      61prepare() {
    
      62    cd "./$_srcdir"
    
      63    
    
      64    patch -Np0 < "$srcdir/cef-runtime.patch" || true
    
      65
    
      66    if ! command -v bun &> /dev/null; then
    
      67        echo "Bun was not found. Please install bun from https://bun.com/, or install the bun AUR package."
    
      68        exit 1
    
      69    fi
    
      70    bunversion=$(bun --version | sed 's/[^0-9]*//g')
    
      71    if (( bunversion < 120 )); then
    
      72        echo "Upgrading bun"
    
      73        bun upgrade
    
      74    fi
    
      75
    
      76    export CARGO_HOME="$srcdir/.cargo-tauri-cef"
    
      77    cargo install tauri-cli \
    
      78        --git https://github.com/tauri-apps/tauri \
    
      79        --branch feat/cef \
    
      80        --root "$srcdir/.cargo-tauri-cef" \
    
      81        --locked # --force
    
      82
    
      83    msg "Installing JS dependencies"
    
      84    bun i
    
      85    bun run license-report
    
      86}
    
      87
    
      88build() {
    
      89    cd "./$_srcdir"
    
      90
    
      91    export CARGO_HOME="$srcdir/.cargo-tauri-cef"
    
      92    export PATH="$srcdir/.cargo-tauri-cef/bin:$PATH"
    
      93    export CEF_PATH="$srcdir/cef"
    
      94    export CFLAGS+=" -ffat-lto-objects"
    
      95    mkdir -p "$CEF_PATH"
    
      96
    
      97    # Remove the lockfile so Cargo re-resolves against the patched git crates
    
      98    # instead of the locked crates.io versions which don't have the cef feature
    
      99    rm -f src-tauri/Cargo.lock
    
      100
    
      101    cargo tauri build --no-bundle
    
      102}
    
      103
    
      104package() {
    
      105    cd "./$_srcdir"
    
      106
    
      107    install -Dm755 "$srcdir/$_pkgname" "$pkgdir/usr/bin/$_pkgname"
    
      108    install -Dm755 "src-tauri/target/release/$_pkgname" "$pkgdir/usr/share/$_pkgname"
    
      109
    
      110    mkdir -p "$pkgdir/usr/lib/cef-$_pkgname/"
    
      111    cp -r "$srcdir/cef/$_cef_ver"/* "$pkgdir/usr/lib/cef-$_pkgname/"
    
      112
    
      113    install -Dm644 "$srcdir/Surrealist.desktop" "$pkgdir/usr/share/applications/Surrealist.desktop"
    
      114    install -Dm644 "src-tauri/icons/icon.png" "$pkgdir/usr/share/icons/hicolor/512x512/apps/Surrealist.png"
    
      115    install -Dm644 "src-tauri/icons/32x32.png" "$pkgdir/usr/share/icons/hicolor/32x32/apps/Surrealist.png"
    
      116    install -Dm644 "src-tauri/icons/64x64.png" "$pkgdir/usr/share/icons/hicolor/64x64/apps/Surrealist.png"
    
      117    install -Dm644 "src-tauri/icons/128x128.png" "$pkgdir/usr/share/icons/hicolor/128x128/apps/Surrealist.png"
    
      118
    
      119    install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$_pkgname/LICENSE"
    
      120}
    
      121

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2