tine-outliner

LOW

maintainer damien.flament 1 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

The package builds from a legitimate source tarball and uses npx tauri build, which is part of the project's own build process; the flagged 'npx' execution is for a standard build tool, not arbitrary remote code, and the self-install into /usr/bin is normal for AUR packages.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The package builds from a legitimate source tarball and uses npx tauri build, which is part of the project's own build process; the flagged 'npx' execution is for a standard build tool, not arbitrary remote code, and the self-install into /usr/bin is normal for AUR packages.

2 higher static findings superseded - not the current verdict (shown for transparency)

Medium npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:39 npx tauri build --no-bundle -- --features custom-protocol

Medium Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

PKGBUILD:24 rustup toolchain install --no-self-update

PKGBUILD

2 offending line(s) highlighted

      1# shellcheck shell=bash disable=SC2034,SC2154
    
      2
    
      3# Maintainer: Damien Flament <damien dot flament at zoho dot com>
    
      4
    
      5pkgname='tine-outliner'
    
      6pkgver=0.7.3
    
      7pkgrel=1
    
      8pkgdesc="A fast, local, Logseq-compatible outliner"
    
      9url='https://tine.page/'
    
      10license=('AGPL-3.0-only')
    
      11
    
      12arch=('x86_64')
    
      13makedepends=('rustup' 'npm')
    
      14depends=('gtk3' 'gdk-pixbuf2' 'libgcc' 'libsoup3' 'webkit2gtk-4.1' 'dbus' 'libx11' 'glib2' 'cairo' 'hicolor-icon-theme')
    
      15
    
      16conflicts=('tine-outliner-bin')
    
      17
    
      18source=("${pkgname}-${pkgver}.tar.gz::https://github.com/martinkoutecky/tine/archive/refs/tags/v${pkgver}.tar.gz")
    
      19sha256sums=('ea9117a5a01cc17230ec95f6794193be1e366b537cf56e232dbbf3bff2876fd5')
    
      20
    
      21function prepare {
    
      22  cd "tine-${pkgver}" || return
    
      23
    
      24  rustup toolchain install --no-self-update
    
      25
    
      26  npm ci
    
      27}
    
      28
    
      29function build {
    
      30  cd "tine-${pkgver}" || return
    
      31
    
      32  export CFLAGS
    
      33
    
      34  # Le drapeau `-flto=auto` dans les options de GCC semble générer une erreur
    
      35  # lors de la création des liens dynamiques avec la bilbiothèque SQLite3. Il
    
      36  # est donc supprimé.
    
      37  CFLAGS=$(echo "$CFLAGS" | sed -E 's/-flto=auto//g')
    
      38
    
      39  npx tauri build --no-bundle -- --features custom-protocol
    
      40}
    
      41
    
      42function package {
    
      43  cd "tine-${pkgver}" || return
    
      44
    
      45  # L'exécutable principal est installé.
    
      46  install -Dt "$pkgdir/usr/bin" "target/release/tine"
    
      47
    
      48  # Le fichier Desktop du Flatpak est utilisé.
    
      49  install -Dt "$pkgdir/usr/share/applications" "flatpak/page.tine.Tine.desktop"
    
      50
    
      51  # Les icônes sont installées.
    
      52  install -D  "src-tauri/icons/32x32.png" "$pkgdir/usr/share/icons/hicolor/32x32/apps/page.tine.Tine.png"
    
      53  install -D  "src-tauri/icons/64x64.png" "$pkgdir/usr/share/icons/hicolor/64x64/apps/page.tine.Tine.png"
    
      54  install -D  "src-tauri/icons/128x128.png" "$pkgdir/usr/share/icons/hicolor/128x128/apps/page.tine.Tine.png"
    
      55  install -D  "src-tauri/icons/128x128@2x.png" "$pkgdir/usr/share/icons/hicolor/128x128@2/apps/page.tine.Tine.png"
    
      56  install -D  "src-tauri/icons/icon.png" "$pkgdir/usr/share/icons/hicolor/512x512/apps/page.tine.Tine.png"
    
      57  install -D  "docs/app-icon.svg" "$pkgdir/usr/share/icons/hicolor/scalable/apps/page.tine.Tine.svg"
    
      58
    
      59  # Les fichiers de manuel sont compressés et installés.
    
      60  install -d "$pkgdir/usr/share/man/man1"
    
      61
    
      62  for page in tine-capture tine-doctor tine-export-live tine-export-static tine-export tine-open tine-version tine
    
      63  do
    
      64    gzip -c "docs/${page}.1" > "$pkgdir/usr/share/man/man1/${page}.1.gz"
    
      65  done
    
      66}
    
      67

Changes since previous scan

--- PKGBUILD @ 2026-10-15 00:28
+++ PKGBUILD @ 2026-10-17 00:21
@@ -3,7 +3,7 @@
 # Maintainer: Damien Flament <damien dot flament at zoho dot com>
 
 pkgname='tine-outliner'
-pkgver=0.7.2
+pkgver=0.7.3
 pkgrel=1
 pkgdesc="A fast, local, Logseq-compatible outliner"
 url='https://tine.page/'
@@ -16,7 +16,7 @@
 conflicts=('tine-outliner-bin')
 
 source=("${pkgname}-${pkgver}.tar.gz::https://github.com/martinkoutecky/tine/archive/refs/tags/v${pkgver}.tar.gz")
-sha256sums=('abc2a4cfda7591496fcdb70da30b7b186204d9dcf900bb446b335539956985f4')
+sha256sums=('ea9117a5a01cc17230ec95f6794193be1e366b537cf56e232dbbf3bff2876fd5')
 
 function prepare {
   cd "tine-${pkgver}" || return

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Low	4
2026-10-16 00:12:47	Low	4
2026-10-15 23:13:54	Medium	3
2026-10-15 00:28:05	Low	4
2026-10-14 21:20:28	Medium	3
2026-10-14 00:06:47	Low	4
2026-10-13 00:23:45	Low	4
2026-10-12 00:18:51	Low	4
2026-10-11 23:11:19	Medium	3
2026-10-11 21:14:37	Low	4
2026-10-11 21:11:00	Medium	3