tad-desktop

LOW

maintainer myuan 0 votes scanned 2026-09-22 15:40:29.890685

View on AUR

Why flagged

Sources are from the project's official GitHub repo and electronjs.org headers (both legitimate), with proper checksums; the non-standard host flag is a false positive since artifacts.electronjs.org is Electron's official header distribution infrastructure.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 80%): Sources are from the project's official GitHub repo and electronjs.org headers (both legitimate), with proper checksums; the non-standard host flag is a false positive since artifacts.electronjs.org is Electron's official header distribution infrastructure.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 "node-v${_electronver}-headers.tar.gz::https://artifacts.electronjs.org/headers/dist/v${_electronver}/node-v${_electronver}-headers.tar.gz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: myuan <provefars@gmail.com>
    
      2pkgname=tad-desktop
    
      3pkgver=0.14.0
    
      4pkgrel=1
    
      5pkgdesc='Tabular data viewer using the system Electron runtime'
    
      6arch=('x86_64')
    
      7url='https://www.tadviewer.com/'
    
      8license=('MIT')
    
      9depends=('electron44')
    
      10makedepends=('nodejs-lts-iron' 'npm' 'python')
    
      11conflicts=('tad-bin')
    
      12options=('!debug' '!lto')
    
      13
    
      14_electronver=44.4.3
    
      15source=(
    
      16  "tad-${pkgver}.tar.gz::https://github.com/antonycourtney/tad/archive/refs/tags/v${pkgver}.tar.gz"
    
      17  "node-v${_electronver}-headers.tar.gz::https://artifacts.electronjs.org/headers/dist/v${_electronver}/node-v${_electronver}-headers.tar.gz"
    
      18  'tad-system-electron.patch'
    
      19  'duckdb-gcc16.patch'
    
      20  'tad.sh'
    
      21  'tad.desktop'
    
      22)
    
      23sha256sums=(
    
      24  'd2618dda492421aacabdbe3915a158161054291b83f4809079b8945a6b9cb993'
    
      25  '168d0427ce4c5673e021dfa40ddd36458f87ea10189ef1e10b0b5acb047425ed'
    
      26  '58a1ed58a26a55c86ee3c90f869756a4830f7cbe79e1d9a6ddf54176cc7c9235'
    
      27  '78da86fd62430cd87585f3dabc17821cce535263b92a479478613732dc7c400e'
    
      28  '8cd8292af74b7a0dc8903f2f4181cfd49e166e5a041fc088d0370b009eb7ff0e'
    
      29  'e7a942e5f74c7710f7923a30c05842c2b607533485c446dd4f07dd9e2e1d95af'
    
      30)
    
      31
    
      32prepare() {
    
      33  cd "tad-${pkgver}"
    
      34  patch -Np1 -i ../tad-system-electron.patch
    
      35}
    
      36
    
      37build() {
    
      38  cd "tad-${pkgver}"
    
      39
    
      40  export npm_config_cache="$srcdir/npm-cache"
    
      41  export ELECTRON_SKIP_BINARY_DOWNLOAD=1
    
      42
    
      43  npm_config_ignore_scripts=true npm ci
    
      44  npm_config_ignore_scripts=true \
    
      45    ./node_modules/.bin/lerna bootstrap --ci --hoist --force-local --ignore-prepublish
    
      46
    
      47  patch -Np1 -i ../duckdb-gcc16.patch
    
      48
    
      49  npm_config_build_from_source=true \
    
      50    npm_config_nodedir=/usr \
    
      51    npm rebuild node-sass
    
      52
    
      53  npm_config_build_from_source=true \
    
      54    npm_config_runtime=electron \
    
      55    npm_config_target="${_electronver}" \
    
      56    npm_config_nodedir="$srcdir/node_headers" \
    
      57    npm_config_arch=x64 \
    
      58  npm_config_target_arch=x64 \
    
      59    npm rebuild duckdb
    
      60
    
      61  rm -r node_modules/duckdb/build
    
      62
    
      63  ./tools/build-embedded.sh
    
      64
    
      65  cd packages/tad-app
    
      66  npm run build-prod
    
      67  ../../node_modules/.bin/electron-builder --linux --x64 --dir \
    
      68    -c.directories.output="$srcdir/electron-out" \
    
      69    -c.electronDist=/usr/lib/electron44 \
    
      70    -c.electronVersion="${_electronver}" \
    
      71    -c.npmRebuild=false
    
      72}
    
      73
    
      74package() {
    
      75  cd "tad-${pkgver}"
    
      76  local resources="$srcdir/electron-out/linux-unpacked/resources"
    
      77
    
      78  install -d "$pkgdir/usr/lib/tad"
    
      79  install -m644 "$resources/app.asar" "$pkgdir/usr/lib/tad/app.asar"
    
      80  cp -a "$resources/app.asar.unpacked" "$pkgdir/usr/lib/tad/"
    
      81  cp -a "$resources/examples" "$pkgdir/usr/lib/tad/"
    
      82
    
      83  install -Dm755 "$srcdir/tad.sh" "$pkgdir/usr/bin/tad"
    
      84  install -Dm644 "$srcdir/tad.desktop" \
    
      85    "$pkgdir/usr/share/applications/tad.desktop"
    
      86  install -Dm644 packages/tad-app/res/AppIcon1024.png \
    
      87    "$pkgdir/usr/share/icons/hicolor/1024x1024/apps/tad.png"
    
      88  install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      89}
    
      90

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-22 15:40:29	Low	3
2026-09-22 15:38:25	Medium	2