unofficial-homestuck-collection-git

maintainer HurricanePootis · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The 'yarn add crc' in build() is a legitimate dependency needed for building the project; it is not obfuscated or malicious, and the package builds from source hosted on the project's official GitHub repository.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The 'yarn add crc' in build() is a legitimate dependency needed for building the project; it is not obfuscated or malicious, and the package builds from source hosted on the project's official GitHub repository.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:30 yarn add crc

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: HurricanePootis <hurricanepootis@protonmail.com>
    
      2pkgname=unofficial-homestuck-collection-git
    
      3pkgver=2.7.2.r0.g6e65920
    
      4pkgrel=1
    
      5pkgdesc="An offline collection of Homestuck and its related works."
    
      6arch=('x86_64')
    
      7url="https://github.com/GiovanH/unofficial-homestuck-collection"
    
      8license=('GPL-3.0-only')
    
      9depends=('nspr' 'hicolor-icon-theme' 'libx11' 'libdrm' 'libxfixes' 'gtk3' 'libxext' 'libxcursor' 'libxrender' 'cairo' 'mesa' 'gcc-libs' 'alsa-lib' 'dbus' 'at-spi2-core' 'libxrandr' 'bash' 'expat' 'libxtst' 'glibc' 'libxcb' 'libxdamage' 'libxcomposite' 'libxi' 'pango' 'libcups' 'libxss' 'glib2' 'nss' 'gdk-pixbuf2')
    
      10makedepends=('nodejs-lts-jod' 'yarn' 'gendesk')
    
      11provides=(${pkgname::-4})
    
      12conflicts=(${pkgname::-4})
    
      13source=("git+$url.git")
    
      14sha256sums=('SKIP')
    
      15
    
      16pkgver() {
    
      17	cd "$srcdir/${pkgname::-4}"
    
      18	git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g'
    
      19}
    
      20
    
      21
    
      22prepare() {
    
      23	cd "$srcdir"
    
      24	sed -i 's/18.20/22/g' ${pkgname::-4}/package.json
    
      25
    
      26}
    
      27
    
      28build() {
    
      29	cd "$srcdir/${pkgname::-4}"
    
      30	yarn add crc #for now
    
      31	SHARP_IGNORE_GLOBAL_LIBVIPS=true make build
    
      32}
    
      33
    
      34package() {
    
      35	cd "$srcdir"
    
      36
    
      37	gendesk -f \
    
      38	--pkgname="${pkgname::-4}" \
    
      39	--name="Unofficial Homestuck Collection" \
    
      40	--comment="Unofficial Reader For Homestuck" \
    
      41	--exec="${pkgname::-4}" \
    
      42	--icon="${pkgname::-4}" \
    
      43	--categories="AudioVideo;Graphics;Game"
    
      44
    
      45	install -dm755 "$pkgdir/usr/lib/${pkgname::-4}"
    
      46	cp -a -T "$srcdir/${pkgname::-4}/dist_electron/linux-unpacked" "$pkgdir/usr/lib/${pkgname::-4}/"
    
      47
    
      48	install -Dm644 "$srcdir/${pkgname::-4}.desktop" "$pkgdir/usr/share/applications/${pkgname::-4}.desktop"
    
      49	cd "$srcdir/${pkgname::-4}/build/icons"
    
      50	for _size in 16 24 48 64 128 256 512 1024
    
      51	do
    
      52		install -Dm644 ${_size}x${_size}.png \
    
      53		"$pkgdir/usr/share/icons/hicolor/${_size}x${_size}/apps/${pkgname::-4}.png"
    
      54	done
    
      55	install -dm755 "$pkgdir/usr/bin"
    
      56	cat > "$pkgdir/usr/bin/${pkgname::-4}"<<EOF
    
      57#!/usr/bin/env sh
    
      58
    
      59XDG_CONFIG_HOME=${XDG_CONFIG_HOME:-~/.config}
    
      60
    
      61# Allow users to override command-line options
    
      62if [ -f "$XDG_CONFIG_HOME/homestuck-flags.conf" ]; then
    
      63    HOMESTUCK_USER_FLAGS="\$(grep -v '^#' "\$XDG_CONFIG_HOME/homestuck-flags.conf")"
    
      64fi
    
      65
    
      66# Launch (each word in VESKTOP_USER_FLAGS must be split)
    
      67# shellcheck disable=SC2086
    
      68echo \$HOMESTUCK_USER_FLAGS
    
      69exec /usr/lib/${pkgname::-4}/${pkgname::-4} \$HOMESTUCK_USER_FLAGS "\$@"
    
      70EOF
    
      71	chmod 755 "$pkgdir/usr/bin/${pkgname::-4}"
    
      72}
    
      73

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2