surrealist-cef
LOW
maintainer That1Calculator
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package builds from source and installs dependencies via cargo from the official tauri-apps GitHub repository, which is a normal and expected part of building a Rust-based desktop application; the flagged 'external install' via cargo is legitimate and not malicious.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The package builds from source and installs dependencies via cargo from the official tauri-apps GitHub repository, which is a normal and expected part of building a Rust-based desktop application; the flagged 'external install' via cargo is legitimate and not malicious.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
External install via pipx/uv/poetry/cargo/go/gem
alt_pkg_manager_install
A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.
-
PKGBUILD:77
cargo install tauri-cli \
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Kainoa Kanter <kainoa@t1c.dev>
2
3
_pkgname=surrealist
4
pkgname="$_pkgname-cef"
5
pkgver=3.7.2
6
pkgrel=2
7
pkgdesc="Surrealist is the ultimate way to visually manage your SurrealDB database (Experimental CEF runtime)"
8
arch=("x86_64" "aarch64")
9
url="https://github.com/surrealdb/surrealist"
10
license=("MIT")
11
groups=()
12
depends=(
13
'alsa-lib'
14
'at-spi2-core'
15
'cairo'
16
'dbus'
17
'expat'
18
'gcc-libs'
19
'glib2'
20
'glibc'
21
'libcups'
22
'libdrm'
23
'libx11'
24
'libxcb'
25
'libxcomposite'
26
'libxdamage'
27
'libxext'
28
'libxfixes'
29
'libxkbcommon'
30
'libxrandr'
31
'mesa'
32
'nspr'
33
'nss'
34
'openssl'
35
'pango'
36
'wayland'
37
)
38
makedepends=(
39
'rust'
40
'cargo'
41
'git'
42
'jq'
43
)
44
optdepends=('surrealdb: non-sandboxed SurrealDB instance')
45
provides=("$_pkgname")
46
conflicts=("$_pkgname" "$_pkgname-bin")
47
source=(
48
"$url/archive/refs/tags/surrealist-v$pkgver.tar.gz"
49
'cef-runtime.patch'
50
'surrealist'
51
'Surrealist.desktop'
52
)
53
sha256sums=('51d6ae88a746a4a5cbce6b19aaf6778acffd990f7b26e5e9ca8e20348c88f729'
54
'1790c8fdaec8750844c69d6d1798b41236504461313764c6f740dad0a56376a7'
55
'9f2c7374511c39bb98cb8a41f85908b76f90052904edb88b17a1523e40942fb1'
56
'94f0619847e1136a07c7386c9bf20fec15ff29c69c4dede523958beeaed28427')
57
58
_srcdir="$srcdir/$_pkgname-$_pkgname-v$pkgver"
59
_cef_ver="144.0.7"
60
61
prepare() {
62
cd "./$_srcdir"
63
64
patch -Np0 < "$srcdir/cef-runtime.patch" || true
65
66
if ! command -v bun &> /dev/null; then
67
echo "Bun was not found. Please install bun from https://bun.com/, or install the bun AUR package."
68
exit 1
69
fi
70
bunversion=$(bun --version | sed 's/[^0-9]*//g')
71
if (( bunversion < 120 )); then
72
echo "Upgrading bun"
73
bun upgrade
74
fi
75
76
export CARGO_HOME="$srcdir/.cargo-tauri-cef"
77
cargo install tauri-cli \
78
--git https://github.com/tauri-apps/tauri \
79
--branch feat/cef \
80
--root "$srcdir/.cargo-tauri-cef" \
81
--locked # --force
82
83
msg "Installing JS dependencies"
84
bun i
85
bun run license-report
86
}
87
88
build() {
89
cd "./$_srcdir"
90
91
export CARGO_HOME="$srcdir/.cargo-tauri-cef"
92
export PATH="$srcdir/.cargo-tauri-cef/bin:$PATH"
93
export CEF_PATH="$srcdir/cef"
94
export CFLAGS+=" -ffat-lto-objects"
95
mkdir -p "$CEF_PATH"
96
97
# Remove the lockfile so Cargo re-resolves against the patched git crates
98
# instead of the locked crates.io versions which don't have the cef feature
99
rm -f src-tauri/Cargo.lock
100
101
cargo tauri build --no-bundle
102
}
103
104
package() {
105
cd "./$_srcdir"
106
107
install -Dm755 "$srcdir/$_pkgname" "$pkgdir/usr/bin/$_pkgname"
108
install -Dm755 "src-tauri/target/release/$_pkgname" "$pkgdir/usr/share/$_pkgname"
109
110
mkdir -p "$pkgdir/usr/lib/cef-$_pkgname/"
111
cp -r "$srcdir/cef/$_cef_ver"/* "$pkgdir/usr/lib/cef-$_pkgname/"
112
113
install -Dm644 "$srcdir/Surrealist.desktop" "$pkgdir/usr/share/applications/Surrealist.desktop"
114
install -Dm644 "src-tauri/icons/icon.png" "$pkgdir/usr/share/icons/hicolor/512x512/apps/Surrealist.png"
115
install -Dm644 "src-tauri/icons/32x32.png" "$pkgdir/usr/share/icons/hicolor/32x32/apps/Surrealist.png"
116
install -Dm644 "src-tauri/icons/64x64.png" "$pkgdir/usr/share/icons/hicolor/64x64/apps/Surrealist.png"
117
install -Dm644 "src-tauri/icons/128x128.png" "$pkgdir/usr/share/icons/hicolor/128x128/apps/Surrealist.png"
118
119
install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$_pkgname/LICENSE"
120
}
121
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |