tine-outliner-git

LOW

maintainer damien.flament 1 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

The package builds from the project's own GitHub source; 'npx tauri build' runs the project's own locally-installed npm dependency (tauri-cli from npm ci), not a remote package, and 'rustup toolchain install' is a normal toolchain setup step with no self-update or privileged install—no real malicious behaviour is present, though the SKIP'd checksum and few votes are minor quality concerns.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): The package builds from the project's own GitHub source; 'npx tauri build' runs the project's own locally-installed npm dependency (tauri-cli from npm ci), not a remote package, and 'rustup toolchain install' is a normal toolchain setup step with no self-update or privileged install—no real malicious behaviour is present, though the SKIP'd checksum and few votes are minor quality concerns.

2 higher static findings superseded - not the current verdict (shown for transparency)

Medium npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:46 npx tauri build --no-bundle -- --features custom-protocol

Medium Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

PKGBUILD:31 rustup toolchain install --no-self-update

PKGBUILD

2 offending line(s) highlighted

      1# shellcheck shell=bash disable=SC2034,SC2154
    
      2
    
      3# Maintainer: Damien Flament <damien dot flament at zoho dot com>
    
      4
    
      5pkgname='tine-outliner-git'
    
      6pkgver=0.7.3.r2.g9c1f92d
    
      7pkgrel=1
    
      8pkgdesc="A fast, local, Logseq-compatible outliner (latest git version)"
    
      9url='https://tine.page/'
    
      10license=('AGPL-3.0-only')
    
      11
    
      12arch=('x86_64')
    
      13makedepends=('git' 'rustup' 'npm')
    
      14depends=('gtk3' 'gdk-pixbuf2' 'libgcc' 'libsoup3' 'webkit2gtk-4.1' 'dbus' 'libx11' 'glib2' 'cairo' 'hicolor-icon-theme')
    
      15
    
      16conficts=('tine-outliner' 'tine-outliner-bin')
    
      17provides=("tine-outliner=${pkgver}")
    
      18
    
      19source=("${pkgname}::git+https://github.com/martinkoutecky/tine.git")
    
      20sha256sums=('SKIP')
    
      21
    
      22function pkgver {
    
      23  cd "$pkgname" || return
    
      24
    
      25  git describe --long --abbrev=7 | sed 's/^v//;s/\([^-]*-g\)/r\1/;s/-/./g'
    
      26}
    
      27
    
      28function prepare {
    
      29  cd "$pkgname" || return
    
      30
    
      31  rustup toolchain install --no-self-update
    
      32
    
      33  npm ci
    
      34}
    
      35
    
      36function build {
    
      37  cd "$pkgname" || return
    
      38
    
      39  export CFLAGS
    
      40
    
      41  # Le drapeau `-flto=auto` dans les options de GCC semble générer une erreur
    
      42  # lors de la création des liens dynamiques avec la bilbiothèque SQLite3. Il
    
      43  # est donc supprimé.
    
      44  CFLAGS=$(echo "$CFLAGS" | sed -E 's/-flto=auto//g')
    
      45
    
      46  npx tauri build --no-bundle -- --features custom-protocol
    
      47}
    
      48
    
      49function package {
    
      50  cd "$pkgname" || return
    
      51
    
      52  # L'exécutable principal est installé.
    
      53  install -Dt "$pkgdir/usr/bin" "target/release/tine"
    
      54
    
      55  # Le fichier Desktop du Flatpak est utilisé.
    
      56  install -Dt "$pkgdir/usr/share/applications" "flatpak/page.tine.Tine.desktop"
    
      57
    
      58  # Les icônes sont installées.
    
      59  install -D  "src-tauri/icons/32x32.png" "$pkgdir/usr/share/icons/hicolor/32x32/apps/page.tine.Tine.png"
    
      60  install -D  "src-tauri/icons/64x64.png" "$pkgdir/usr/share/icons/hicolor/64x64/apps/page.tine.Tine.png"
    
      61  install -D  "src-tauri/icons/128x128.png" "$pkgdir/usr/share/icons/hicolor/128x128/apps/page.tine.Tine.png"
    
      62  install -D  "src-tauri/icons/128x128@2x.png" "$pkgdir/usr/share/icons/hicolor/128x128@2/apps/page.tine.Tine.png"
    
      63  install -D  "src-tauri/icons/icon.png" "$pkgdir/usr/share/icons/hicolor/512x512/apps/page.tine.Tine.png"
    
      64  install -D  "docs/app-icon.svg" "$pkgdir/usr/share/icons/hicolor/scalable/apps/page.tine.Tine.svg"
    
      65
    
      66  # Les fichiers de manuel sont compressés et installés.
    
      67  install -d "$pkgdir/usr/share/man/man1"
    
      68
    
      69  for page in tine-capture tine-doctor tine-export-live tine-export-static tine-export tine-open tine-version tine
    
      70  do
    
      71    gzip -c "docs/${page}.1" > "$pkgdir/usr/share/man/man1/${page}.1.gz"
    
      72  done
    
      73}
    
      74

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Low	4
2026-10-16 00:12:47	Low	4
2026-10-15 23:16:14	Low	4
2026-10-15 23:13:54	Medium	3