typbase

LOW

maintainer lemueldls 0 votes scanned 2026-09-23 21:43:13.095267

View on AUR

Why flagged

Package builds from the project's own GitHub source tarball with a verified checksum; the flagged 'privileged install' is a false positive as no sudoers/setuid actions occur — it simply installs a binary to /usr/bin via install -Dm755, which is normal packaging practice. The build process uses rustup and pnpm with locked dependencies, and the git init is a harmless workaround for missing VCS metadata in the release tarball.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): Package builds from the project's own GitHub source tarball with a verified checksum; the flagged 'privileged install' is a false positive as no sudoers/setuid actions occur — it simply installs a binary to /usr/bin via install -Dm755, which is normal packaging practice. The build process uses rustup and pnpm with locked dependencies, and the git init is a harmless workaround for missing VCS metadata in the release tarball.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium Privileged / out-of-pacman install (sudoers, setuid, or self-update) privileged_install

The package grants elevated privileges or installs an update path outside pacman: a /etc/sudoers.d rule (often passwordless), a setuid/setgid binary, or a self-update script/service that can fetch and run future code with no checksum verification. The initial install may be verified, but the ongoing privilege + update surface is a real supply-chain / privilege-escalation risk.

PKGBUILD:23 rustup toolchain install $RUSTUP_TOOLCHAIN --profile minimal --no-self-update

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Lemuel De Los Santos <aur@lemueldls.dev>
    
      2pkgname=typbase
    
      3pkgver=0.1.1
    
      4pkgrel=1
    
      5pkgdesc="Local-first knowledge base made for Typst and the Atmosphere."
    
      6arch=('x86_64')
    
      7url="https://github.com/lemueldls/typbase"
    
      8license=('AGPL-3.0')
    
      9depends=('cairo' 'desktop-file-utils' 'gdk-pixbuf2' 'glib2' 'gtk3' 'hicolor-icon-theme' 'libsoup3' 'pango' 'webkit2gtk-4.1' 'openssl')
    
      10makedepends=('cargo' 'nodejs' 'pnpm' 'git' 'file' 'appmenu-gtk-module' 'libappindicator-gtk3' 'librsvg' 'base-devel' 'curl' 'wget' 'rustup' 'wasm-pack')
    
      11options=('!strip' '!emptydirs')
    
      12source=("typbase-v$pkgver.tar.gz::https://github.com/lemueldls/typbase/archive/refs/tags/typbase-v$pkgver.tar.gz")
    
      13sha256sums=('14bfedc69913b1235d6ea13d318909ebd2f148f75afeed4a836fdcafb57a113a')
    
      14_builddir="$pkgname-typbase-v$pkgver"
    
      15
    
      16prepare() {
    
      17    cd "$srcdir/$_builddir" || exit 1
    
      18    # moon reads the VCS revision during the Tauri build; the release tarball
    
      19    # carries no git metadata, so give it a repository with a HEAD.
    
      20    git init -q
    
      21    git -c user.email=build@localhost -c user.name=build commit -q --allow-empty -m release
    
      22    export RUSTUP_TOOLCHAIN=stable
    
      23    rustup toolchain install $RUSTUP_TOOLCHAIN --profile minimal --no-self-update
    
      24    rustup target add wasm32-unknown-unknown
    
      25    pnpm install --frozen-lockfile
    
      26    cargo fetch --locked --target "$(rustc -vV | sed -n 's/host: //p')"
    
      27}
    
      28
    
      29build() {
    
      30    cd "$srcdir/$_builddir" || exit 1
    
      31    export RUSTUP_TOOLCHAIN=stable
    
      32    # LTO flags from makepkg.conf break linking for some native deps; clear them.
    
      33    export CFLAGS="${CFLAGS//-flto=auto//}"
    
      34    export NUXT_PUBLIC_APP_URL="https://typbase.at"
    
      35    cd apps/native || exit 1
    
      36    pnpm tauri build -b deb -c tauri.package.conf.json
    
      37}
    
      38
    
      39package() {
    
      40    cd "$srcdir/$_builddir" || exit 1
    
      41    install -Dm755 target/release/typbase "$pkgdir"/usr/bin/typbase
    
      42
    
      43    cd "target/release/bundle/deb/Typbase_${pkgver}_amd64/data" || exit 1
    
      44    install -Dm644 usr/share/applications/Typbase.desktop "$pkgdir"/usr/share/applications/Typbase.desktop
    
      45    install -Dm644 usr/share/icons/hicolor/32x32/apps/typbase.png "$pkgdir"/usr/share/icons/hicolor/32x32/apps/typbase.png
    
      46    install -Dm644 usr/share/icons/hicolor/128x128/apps/typbase.png "$pkgdir"/usr/share/icons/hicolor/128x128/apps/typbase.png
    
      47    install -Dm644 usr/share/icons/hicolor/256x256@2/apps/typbase.png "$pkgdir"/usr/share/icons/hicolor/256x256@2/apps/typbase.png
    
      48    install -Dm644 usr/share/licenses/typbase/LICENSE "$pkgdir"/usr/share/licenses/typbase/LICENSE
    
      49}
    
      50

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-23 21:43:13	Low	3
2026-09-23 21:40:52	Medium	2