tropy-git

LOW
maintainer zxp19821005 0 votes scanned 2026-09-24 01:43:24.893483
View on AUR
Why flagged

The npx call runs @electron/packager, a well-known official Electron tooling package from the npm registry, to package the project's own source checked out from the official GitHub repo; this is standard Electron app packaging practice and not a remote-code-execution risk beyond normal npm supply-chain trust.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): The npx call runs @electron/packager, a well-known official Electron tooling package from the npm registry, to package the project's own source checked out from the official GitHub repo; this is standard Electron app packaging practice and not a remote-code-execution risk beyond normal npm supply-chain trust.

1 higher static finding superseded - not the current verdict (shown for transparency)
Medium npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

  • PKGBUILD:120 npx @electron/packager . "${pkgname%-git}" \

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2pkgname=tropy-git
3_pkgname=Tropy
4_appname="org.${pkgname%-git}.${_pkgname}"
5pkgver=1.18.0.beta.6.r8.gfd9c828
6_electronversion=44
7_nodeversion=24
8pkgrel=1
9pkgdesc="Explore your research photos."
10arch=('any')
11url="https://tropy.org/"
12_ghurl="https://github.com/tropy/tropy"
13license=('AGPL-3.0-or-later')
14conflicts=("${pkgname%-git}")
15provides=("${pkgname%-git}=${pkgver%.r*}")
16depends=(
17 "electron${_electronversion}"
18 'libvips'
19)
20makedepends=(
21 'npm'
22 'git'
23 'nvm'
24 'gendesk'
25 'jq'
26 'zip'
27)
28optdepends=(
29 'libheif: for heif support'
30 'poppler-glib: for pdf support')
31source=(
32 "${pkgname//-/.}::git+${_ghurl}.git"
33 "${pkgname%-git}.sh"
34)
35sha256sums=('SKIP'
36 'bd5358d8f323d3c2c2f0733364ee4ea55f551dd86ba0be2a76846210b60897fc')
37pkgver() {
38 cd "${srcdir}/${pkgname%-git}.git"
39 set -o pipefail
40 git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
41 printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
42}
43_ensure_local_nvm() {
44 export NVM_DIR="${srcdir}/.nvm"
45 source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
46 nvm install "${_nodeversion}"
47 nvm use "${_nodeversion}"
48}
49_get_app_dir() {
50 find "${srcdir}" -type d -name "node_modules" -prune -o -type f -name "resources.pak" -print0 | xargs -0 dirname | head -n 1
51}
52_get_electron_version() {
53 _elec_ver=$(find "${srcdir}" -maxdepth 5 -name "package.json" ! -path "*/node_modules/*" \
54 -exec grep -l '"electron"' {} + | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null | head -1)
55 [[ -z "${_elec_ver}" ]] && return 1
56 echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
57}
58_set_build_env() {
59 export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
60 export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
61 export ELECTRON_SKIP_BINARY_DOWNLOAD=1
62 export ELECTRON_BUILDER_OFFLINE=true
63 export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
64 export HOME="${srcdir}/.home"
65 export XDG_CACHE_HOME="${HOME}/.cache"
66 export XDG_CONFIG_HOME="${HOME}/.config"
67 export XDG_DATA_HOME="${HOME}/.local/share"
68 export npm_config_cache="${HOME}/.npm_cache"
69 export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
70 export COREPACK_HOME="${HOME}/.corepack"
71 export npm_config_audit=false
72 mkdir -p "${HOME}" "${npm_config_cache}" "${COREPACK_HOME}"
73}
74_use_local_electron_zip() {
75 local _v="${SYSTEM_ELECTRON_VERSION}"
76 local _zd="${srcdir}/electron-zips"
77 case "${CARCH}" in
78 aarch64) _arch=arm64 ;;
79 x86_64) _arch=x64 ;;
80 esac
81 local _zf="${_zd}/electron-v${_v}-linux-${_arch}.zip"
82 if [[ ! -f "${_zf}" ]]; then
83 install -Dm755 -d "${_zd}"
84 ( cd "${ELECTRON_DIST}" && zip -r -q -0 "${_zf}" . )
85 fi
86 export ELECTRON_ZIP_DIR="${_zd}"
87}
88prepare() {
89 cd "${srcdir}/${pkgname//-/.}"
90 _get_electron_version
91 sed -i -e "
92 s/@electronversion@/${_electronversion}/g
93 s/@appname@/${pkgname%-git}/g
94 s/@runname@/app.asar/g
95 s/@cfgdirname@/${pkgname%-git}-beta/g
96 " "${srcdir}/${pkgname%-git}.sh"
97 gendesk -q -f -n \
98 --pkgname="${pkgname%-git}" \
99 --pkgdesc="${pkgdesc}" \
100 --categories="Graphics" \
101 --name="${_pkgname}" \
102 --exec="${pkgname%-git} %U"
103 _ensure_local_nvm
104 _set_build_env
105 sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g" package.json
106 find src -type f -exec sed -i "s/process.execPath/\'\/usr\/lib\/${pkgname%-git}\'/g" {} +
107 sed -i "s/${_appname}/${pkgname%-git}/g" res/{linux/"${_appname}.metainfo.xml",mime/"${pkgname%-git}.xml"}
108 export NODE_ENV=development
109 npm install --legacy-peer-deps
110 _use_local_electron_zip
111}
112build() {
113 cd "${srcdir}/${pkgname//-/.}"
114 _ensure_local_nvm
115 _set_build_env
116 export NODE_ENV=production
117 export SHARP_FORCE_GLOBAL_LIBVIPS=true
118 #node scripts/rebuild.js --force --global-libvips
119 local _app_name="${pkgname%-git}"
120 npx @electron/packager . "${pkgname%-git}" \
121 --platform=linux \
122 --arch=x64 \
123 --out=dist \
124 --overwrite \
125 --no-prune \
126 --electron-zip-dir="${ELECTRON_ZIP_DIR}" \
127 --asar \
128 --asar.unpack="**/{lib/node/**/*,lib/sharp-libvips-*/**/*,res/{icons,keymaps,plugins,views}/**/*,package.json,LICENSE*}"
129 local _dist_dir="dist/${_app_name}-linux-x64"
130 local _resources="${_dist_dir}/resources"
131 mkdir -p "${_resources}/icons/hicolor"
132 cp -r "res/icons/beta/tropy" "${_resources}/icons/hicolor/"
133 for _type in mtpy tpy ttp; do
134 if [[ -d "res/icons/mime/${_type}" ]]; then
135 mkdir -p "${_resources}/icons/hicolor/${_type}"
136 cp -r "res/icons/mime/${_type}"/* "${_resources}/icons/hicolor/${_type}/" 2>/dev/null || true
137 fi
138 done
139 mkdir -p "${_resources}/mime/packages"
140 cp "res/mime/tropy.xml" "${_resources}/mime/packages/${_appname}.xml"
141 local _app_dir=$(_get_app_dir)
142 case "${CARCH}" in
143 aarch64) _arch_rem=x64 ;;
144 x86_64) _arch_rem=arm ;;
145 esac
146 find "${_app_dir}" \
147 \( -name "*darwin*" -o -name "*win32*" -o -name "*${_arch_rem}*" \) \
148 -exec rm -rf {} +
149}
150package() {
151 install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
152 install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-git}"
153 local _app_dir=$(_get_app_dir)
154 cp -a "${_app_dir}/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"
155 icon_sizes=(16x16 24x24 32x32 40x40 48x48 64x64 128x128 256x256 512x512 1024x1024)
156 for _icons in "${icon_sizes[@]}";do
157 install -Dm644 "${srcdir}/${pkgname//-/.}/res/icons/beta/${pkgname%-git}/${_icons}.png" \
158 "${pkgdir}/usr/share/icons/hicolor/${_icons}/apps/${pkgname%-git}.png"
159 done
160 install -Dm644 "${srcdir}/${pkgname//-/.}/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
161 install -Dm644 "${srcdir}/${pkgname//-/.}/res/mime/${pkgname%-git}.xml" -t "${pkgdir}/usr/share/mime/packages"
162 install -Dm644 "${srcdir}/${pkgname//-/.}/res/linux/${_appname}.metainfo.xml" \
163 "${pkgdir}/usr/share/metainfo/${pkgname%-git}.metainfo.xml"
164 install -Dm644 "${srcdir}/${pkgname//-/.}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
165}
166

Scan history

Scanned at (UTC)SeverityRules
2026-09-24 01:43:24 Low 3
2026-09-24 01:41:16 Medium 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion