thorium-reader-git

MEDIUM
maintainer zxp19821005 0 votes scanned 2026-10-29 11:52:15.123535
View on AUR
Why flagged

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

Triggered rules

Medium npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

  • PKGBUILD:99 npm install -g npm@12

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2pkgname=thorium-reader-git
3_pkgname='Thorium Reader'
4_appname="EDRLab.${_pkgname// /}"
5pkgver=latest.linux.arm.r0.gf9c357d
6_electronversion=44
7_nodeversion=24
8pkgrel=1
9pkgdesc="Cross-platform desktop reading app based on the Readium Desktop toolkit."
10arch=('any')
11url="https://www.edrlab.org/software/thorium-reader/"
12_ghurl="https://github.com/edrlab/thorium-reader"
13license=('BSD-3-Clause')
14conflicts=("${pkgname%-git}")
15provides=("${pkgname%-git}=${pkgver%.r*}")
16depends=(
17 "electron${_electronversion}"
18)
19makedepends=(
20 'gendesk'
21 'git'
22 'nvm'
23 'npm'
24 'python-setuptools'
25 'jq'
26)
27source=(
28 "${pkgname%-git}.git::git+${_ghurl}.git"
29 "${pkgname%-git}.js"
30 "${pkgname%-git}.sh"
31)
32sha256sums=('SKIP'
33 '562897be8a17076176f8d985c0d7bc1c685f2e7c9b3a932339ce015963243627'
34 '0f4675ddc96a032accf82723c7b6b66007bafd18aa8d919b61e983a68fd25328')
35_get_project_dir() {
36 local d
37 while IFS= read -r d; do
38 find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
39 done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
40}
41pkgver() {
42 cd "$(_get_project_dir)"
43 set -o pipefail
44 git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
45 printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
46}
47_ensure_local_nvm() {
48 local NVM_DIR="${srcdir}/.nvm"
49 source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
50 nvm install "${_nodeversion}"
51 nvm use "${_nodeversion}"
52}
53_get_app_dir() {
54 find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -printf '%h\n' 2>/dev/null \
55 | while read -r d; do [[ -d "${d}/resources" ]] && { echo "$d"; return 0; }; done
56}
57_get_electron_version() {
58 _elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
59 | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
60 | grep -oE '[0-9]+' | head -1)
61 [[ -z "${_elec_ver}" ]] && return 1
62 (( _elec_ver == _electronversion )) && c=32 || c=31
63 echo -e "Electron version: \033[1;${c}m${_elec_ver}$([[ $c -eq 31 ]] && echo " (expected ${_electronversion})")\033[0m"
64}
65_set_npm_build_env() {
66 export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
67 export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
68 export ELECTRON_SKIP_BINARY_DOWNLOAD=1
69 export ELECTRON_BUILDER_OFFLINE=true
70 export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
71 export HOME="${srcdir}/.home"
72 export XDG_CACHE_HOME="${HOME}/.cache"
73 export XDG_CONFIG_HOME="${HOME}/.config"
74 export XDG_DATA_HOME="${HOME}/.local/share"
75 export npm_config_cache="${HOME}/.npm_cache"
76 export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
77 export COREPACK_HOME="${HOME}/.corepack"
78 export npm_config_audit=false
79 export npm_config_registry="${NPM_CONFIG_REGISTRY:-${npm_config_registry:-https://registry.npmjs.org}}"
80 mkdir -p "${HOME}" "${npm_config_cache}" "${COREPACK_HOME}"
81}
82prepare() {
83 cd "$(_get_project_dir)"
84 _get_electron_version
85 sed -i -e "
86 s/@electronversion@/${_electronversion}/g
87 s/@appname@/${pkgname%-git}/g
88 " "${srcdir}/${pkgname%-git}.sh" "${srcdir}/${pkgname%-git}.js"
89 gendesk -q -f -n \
90 --pkgname="${pkgname%-git}" \
91 --pkgdesc="${pkgdesc}" \
92 --categories="Office" \
93 --name="${_pkgname}" \
94 --exec="${pkgname%-git} %U"
95 _ensure_local_nvm
96 _set_npm_build_env
97 jq --arg ver "${SYSTEM_ELECTRON_VERSION}" '.devDependencies.electron = $ver' package.json > package.json.tmp && mv package.json.tmp package.json
98 export NODE_ENV=development
99 npm install -g npm@12
100 npm install --legacy-peer-deps --ignore-scripts --foreground-scripts --min-release-age=0
101 npm run clean
102}
103build() {
104 cd "$(_get_project_dir)"
105 _ensure_local_nvm
106 _set_npm_build_env
107 export NODE_ENV=development
108 npm run pre-package:linux
109 npm exec -c "cross-env DEBUG=* CSC_IDENTITY_AUTO_DISCOVERY=false electron-builder --linux dir -c.electronDist=${ELECTRON_DIST}"
110 rm -rf "$(_get_app_dir)/resources/default_app.asar"
111}
112package() {
113 install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
114 install -Dm644 "${srcdir}/${pkgname%-git}.js" -t "${pkgdir}/usr/lib/${pkgname%-git}"
115 cp -a "$(_get_app_dir)/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"
116 _icon_sizes=(256x256 512x512 1024x1024)
117 for _icons in "${_icon_sizes[@]}";do
118 install -Dm644 "$(_get_project_dir)/resources/icons/${_icons}.png" \
119 "${pkgdir}/usr/share/icons/hicolor/${_icons}/apps/${pkgname%-git}.png"
120 done
121 install -Dm644 "$(_get_project_dir)/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications/"
122 install -Dm644 "$(_get_project_dir)/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
123}
124

Changes since previous scan

--- PKGBUILD @ 2026-09-11 01:21
+++ PKGBUILD @ 2026-10-29 11:52
@@ -2,8 +2,8 @@
pkgname=thorium-reader-git
_pkgname='Thorium Reader'
_appname="EDRLab.${_pkgname// /}"
-pkgver=3.5.1.r13.g7004ea3
-_electronversion=41
+pkgver=latest.linux.arm.r0.gf9c357d
+_electronversion=44
_nodeversion=24
pkgrel=1
pkgdesc="Cross-platform desktop reading app based on the Readium Desktop toolkit."
@@ -22,101 +22,103 @@
'nvm'
'npm'
'python-setuptools'
- 'curl'
'jq'
)
source=(
"${pkgname%-git}.git::git+${_ghurl}.git"
+ "${pkgname%-git}.js"
"${pkgname%-git}.sh"
)
sha256sums=('SKIP'
- 'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
+ '562897be8a17076176f8d985c0d7bc1c685f2e7c9b3a932339ce015963243627'
+ '0f4675ddc96a032accf82723c7b6b66007bafd18aa8d919b61e983a68fd25328')
+_get_project_dir() {
+ local d
+ while IFS= read -r d; do
+ find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
+ done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
+}
pkgver() {
- cd "${pkgname%-git}.git"
- set -o pipefail
- git describe --long --tags --abbrev=7 --exclude='*[a-z][a-z]*' | sed -E 's/^v//g;s/([^-]*-g)/r\1/g;s/-/./g' ||
- printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
+ cd "$(_get_project_dir)"
+ set -o pipefail
+ git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
+ printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
}
_ensure_local_nvm() {
- local NVM_DIR="${srcdir}/.nvm"
- source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
- nvm install "${_nodeversion}"
- nvm use "${_nodeversion}"
+ local NVM_DIR="${srcdir}/.nvm"
+ source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
+ nvm install "${_nodeversion}"
+ nvm use "${_nodeversion}"
}
_get_app_dir() {
- find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1
+ find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -printf '%h\n' 2>/dev/null \
+ | while read -r d; do [[ -d "${d}/resources" ]] && { echo "$d"; return 0; }; done
}
-_set_build_env() {
+_get_electron_version() {
+ _elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
+ | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
+ | grep -oE '[0-9]+' | head -1)
+ [[ -z "${_elec_ver}" ]] && return 1
+ (( _elec_ver == _electronversion )) && c=32 || c=31
+ echo -e "Electron version: \033[1;${c}m${_elec_ver}$([[ $c -eq 31 ]] && echo " (expected ${_electronversion})")\033[0m"
+}
+_set_npm_build_env() {
export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
export ELECTRON_SKIP_BINARY_DOWNLOAD=1
- _ev="$(electron${_electronversion} -v)"
- export SYSTEM_ELECTRON_VERSION="${_ev#v}"
- export HOME="${srcdir}/.electron-gyp"
- export XDG_CACHE_HOME="${srcdir}/.cache"
- export XDG_CONFIG_HOME="${srcdir}/.config"
- export XDG_DATA_HOME="${srcdir}/.local/share"
- export npm_config_cache="${srcdir}/.npm_cache"
- export npm_config_maxsockets=32
+ export ELECTRON_BUILDER_OFFLINE=true
+ export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
+ export HOME="${srcdir}/.home"
+ export XDG_CACHE_HOME="${HOME}/.cache"
+ export XDG_CONFIG_HOME="${HOME}/.config"
+ export XDG_DATA_HOME="${HOME}/.local/share"
+ export npm_config_cache="${HOME}/.npm_cache"
+ export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
+ export COREPACK_HOME="${HOME}/.corepack"
export npm_config_audit=false
- export npm_config_fund=false
- export npm_config_progress=false
- export NODE_OPTIONS="--max-old-space-size=4096"
- export npm_config_node_options="--max-old-space-size=4096"
-}
-_get_electron_version() {
- _elec_ver=$(find "${srcdir}" -maxdepth 5 -name "package.json" ! -path "*/node_modules/*" \
- -exec grep -l '"electron"' {} + | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null | head -1)
- [[ -z "${_elec_ver}" ]] && return 1
- echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
+ export npm_config_registry="${NPM_CONFIG_REGISTRY:-${npm_config_registry:-https://registry.npmjs.org}}"
+ mkdir -p "${HOME}" "${npm_config_cache}" "${COREPACK_HOME}"
}
prepare() {
- cd "${srcdir}/${pkgname%-git}.git"
+ cd "$(_get_project_dir)"
_get_electron_version
sed -i -e "
s/@electronversion@/${_electronversion}/g
s/@appname@/${pkgname%-git}/g
- s/@runname@/app.asar/g
- s/@cfgdirname@/${_appname}/g
- " "${srcdir}/${pkgname%-git}.sh"
+ " "${srcdir}/${pkgname%-git}.sh" "${srcdir}/${pkgname%-git}.js"
gendesk -q -f -n \
--pkgname="${pkgname%-git}" \
--pkgdesc="${pkgdesc}" \
--categories="Office" \
--name="${_pkgname}" \
--exec="${pkgname%-git} %U"
- _set_build_env
_ensure_local_nvm
- sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g" package.json
- sed -i 's/"version": ">=12.0.2"/"version": ">=11.0.0"/g' package.json
- sed -i 's/"overrides": {/"overrides": {\n "@jest\/core": "30.4.2",\n "jest-cli": "30.4.2",/g' package.json
- sed -i \
- -e 's/onClick={() => zoomIn()}/onClick={() => void zoomIn()}/g' \
- -e 's/onClick={() => zoomOut()}/onClick={() => void zoomOut()}/g' \
- -e 's/onClick={() => resetTransform()}/onClick={() => void resetTransform()}/g' \
- src/renderer/reader/components/ImageClickManagerViewerOnly.tsx
- NODE_ENV=development npm install --legacy-peer-deps --ignore-scripts --foreground-scripts --min-release-age=0
- NODE_ENV=development npm run clean
+ _set_npm_build_env
+ jq --arg ver "${SYSTEM_ELECTRON_VERSION}" '.devDependencies.electron = $ver' package.json > package.json.tmp && mv package.json.tmp package.json
+ export NODE_ENV=development
+ npm install -g npm@12
+ npm install --legacy-peer-deps --ignore-scripts --foreground-scripts --min-release-age=0
+ npm run clean
}
build() {
- cd "${srcdir}/${pkgname%-git}.git"
- _set_build_env
+ cd "$(_get_project_dir)"
_ensure_local_nvm
- NODE_ENV=development npm run pre-package:linux
- NODE_ENV=production npm exec -c "cross-env DEBUG=* CSC_IDENTITY_AUTO_DISCOVERY=false electron-builder --linux dir -c.electronDist=${ELECTRON_DIST}"
+ _set_npm_build_env
+ export NODE_ENV=development
+ npm run pre-package:linux
+ npm exec -c "cross-env DEBUG=* CSC_IDENTITY_AUTO_DISCOVERY=false electron-builder --linux dir -c.electronDist=${ELECTRON_DIST}"
+ rm -rf "$(_get_app_dir)/resources/default_app.asar"
}
package() {
install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
- install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-git}"
- local _app_dir=$(_get_app_dir)
- cp -a "${_app_dir}/resources/"* "${pkgdir}/usr/lib/${pkgname%-git}/"
- rm -f "${pkgdir}/usr/lib/${pkgname%-git}/default_app.asar"
+ install -Dm644 "${srcdir}/${pkgname%-git}.js" -t "${pkgdir}/usr/lib/${pkgname%-git}"
+ cp -a "$(_get_app_dir)/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"
_icon_sizes=(256x256 512x512 1024x1024)
for _icons in "${_icon_sizes[@]}";do
- install -Dm644 "${srcdir}/${pkgname%-git}.git/resources/icons//${_icons}.png" \
+ install -Dm644 "$(_get_project_dir)/resources/icons/${_icons}.png" \
"${pkgdir}/usr/share/icons/hicolor/${_icons}/apps/${pkgname%-git}.png"
done
- install -Dm644 "${srcdir}/${pkgname%-git}.git/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications/"
- install -Dm644 "${srcdir}/${pkgname%-git}.git/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
+ install -Dm644 "$(_get_project_dir)/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications/"
+ install -Dm644 "$(_get_project_dir)/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
}

Scan history

Scanned at (UTC)SeverityRules
2026-10-29 11:52:15 Medium 1
2026-09-11 01:21:31 Clean 0
2026-09-02 21:51:32 Clean 0
2026-08-28 11:35:03 Clean 0
2026-06-25 16:23:07 Clean 0
2026-06-18 16:11:54 Clean 0

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion