tradingview
LOW
maintainer xiota
37 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The package downloads a Snap file from the official Snapcraft API and extracts it; this is a standard source for Snap packages, and the download is used to build the package locally without executing untrusted remote code.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a Snap file from the official Snapcraft API and extracts it; this is a standard source for Snap packages, and the download is used to build the package locally without executing untrusted remote code.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:33
"$_pkgsrc.snap"::"https://api.snapcraft.io/api/v1/snaps/download/${_snap_id}_${_snap_rev}.snap" -
PKGBUILD:34
"$_terms_of_use.html"::"https://www.tradingview.com/policies/"
PKGBUILD
2 offending line(s) highlighted
1
# Maintainer:
2
# Contributor: Ivan Gabaldon <aur[at]inetol.net>
3
# Contributor: archlinuxbits <archlinuxbits at proton.me>
4
5
: ${_snap_id:=nJdITJ6ZJxdvfu8Ch7n5kH5P99ClzBYV}
6
: ${_snap_rev:=72}
7
8
: ${_use_system_electron:=false}
9
10
_pkgname="tradingview"
11
pkgname="$_pkgname"
12
pkgver=3.3.0
13
pkgrel=2
14
pkgdesc='Charting platform for traders and investors'
15
arch=('x86_64')
16
url="https://www.tradingview.com/desktop/"
17
license=('LicenseRef-TradingView')
18
19
depends=(
20
'libsecret'
21
)
22
makedepends=(
23
'html-xml-utils'
24
'squashfs-tools'
25
'w3m'
26
)
27
28
options=('!debug' '!strip')
29
30
_terms_of_use="$_pkgname-$pkgver-$_snap_rev-eula"
31
_pkgsrc="$_pkgname-$pkgver-$_snap_rev"
32
source=(
33
"$_pkgsrc.snap"::"https://api.snapcraft.io/api/v1/snaps/download/${_snap_id}_${_snap_rev}.snap"
34
"$_terms_of_use.html"::"https://www.tradingview.com/policies/"
35
)
36
sha256sums=(
37
'e4343ff1a62a67a75f05720d4762392f44fa0c70ecf4858049366632043bf118'
38
'SKIP'
39
)
40
41
prepare() {
42
hxextract .tv-policies "$_terms_of_use.html" \
43
1> "$_terms_of_use-2.html" \
44
2> /dev/null
45
46
w3m -O UTF-8 -cols 80 -dump "$_terms_of_use-2.html" > "$_terms_of_use.txt"
47
48
# unpack
49
mkdir -p "$_pkgsrc"
50
unsquashfs -q -n -f -d "$_pkgsrc/" "$_pkgsrc.snap"
51
}
52
53
_package_system() {
54
local _electron_version=$(strings "$_pkgsrc/tradingview" | grep -Pom1 'Electron/\K[0-9]+')
55
depends+=("electron${_electron_version}")
56
57
# asar
58
mkdir -pm755 "$pkgdir/usr/lib/$_pkgname"
59
cp -r "$_pkgsrc/resources/"* "$pkgdir/usr/lib/$_pkgname/"
60
61
# script
62
install -Dm755 /dev/stdin "$pkgdir/usr/bin/$_pkgname" << END
63
#!/usr/bin/env bash
64
65
name=$_pkgname
66
flags_file="\${XDG_CONFIG_HOME:-\$HOME/.config}/\${name}-flags.conf"
67
68
lines=()
69
if [[ -f "\${flags_file}" ]]; then
70
mapfile -t lines < "\${flags_file}"
71
fi
72
73
flags=()
74
for line in "\${lines[@]}"; do
75
if [[ ! "\${line}" =~ ^[[:space:]]*#.* ]] && [[ -n "\${line}" ]]; then
76
flags+=("\${line}")
77
fi
78
done
79
80
: \${ELECTRON_IS_DEV:=0}
81
export ELECTRON_IS_DEV
82
: \${ELECTRON_FORCE_IS_PACKAGED:=true}
83
export ELECTRON_FORCE_IS_PACKAGED
84
85
exec electron${_electron_version} "\${flags[@]}" "/usr/lib/$_pkgname/app.asar" "\$@"
86
END
87
}
88
89
_package_vendored() {
90
mkdir -pm755 "$pkgdir/usr/lib/$_pkgname"
91
cp -r "$_pkgsrc/"* "$pkgdir/usr/lib/$_pkgname/"
92
93
mkdir -pm755 "$pkgdir/usr/bin"
94
ln -s "/usr/lib/$_pkgname/tradingview" "$pkgdir/usr/bin/"
95
}
96
97
_package_common() {
98
# launcher
99
sed -E -e '/^Comment=/d' \
100
-e 's&^(Icon)=.*$&\1='"$_pkgname&" \
101
-e 's&^(Categories)=(Finance;)$&\1=Office;\2&' \
102
-i "$_pkgsrc/meta/gui/$_pkgname.desktop"
103
104
install -Dm644 "$_pkgsrc/meta/gui/$_pkgname.desktop" -t "$pkgdir/usr/share/applications/"
105
106
# icon
107
install -Dm644 "$_pkgsrc/meta/gui/icon.png" "$pkgdir/usr/share/icons/hicolor/512x512/apps/$_pkgname.png"
108
109
# license
110
install -Dm644 "$_terms_of_use.txt" -t "$pkgdir/usr/share/licenses/$pkgname/"
111
}
112
113
if [[ "${_use_system_electron::1}" == "t" ]]; then
114
eval "package() {
115
$(declare -f _package_system | tail +2)
116
$(declare -f _package_common | tail +2)
117
}"
118
else
119
eval "package() {
120
$(declare -f _package_vendored | tail +2)
121
$(declare -f _package_common | tail +2)
122
}"
123
fi
124
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 00:13:55 | Low | 2 |
| 2026-10-28 00:06:54 | Low | 2 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |
| 2026-10-14 00:06:47 | Low | 2 |
| 2026-10-13 00:23:45 | Low | 2 |