vagrant-manager-git

LOW
maintainer zxp19821005 0 votes scanned 2026-10-17 00:21:55.226236
View on AUR
Why flagged

The package builds from source using a git repository and runs yarn install on the project's own dependencies; the variable-named package installation is part of standard build tooling and does not introduce untrusted external code execution.

Triggered rules

Low AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it LOW (confidence 95%): The package builds from source using a git repository and runs yarn install on the project's own dependencies; the variable-named package installation is part of standard build tooling and does not introduce untrusted external code execution.

  • PKGBUILD:95 npm install -g "@yarnpkg/cli-dist@${_yarnver}" --prefix "${_yarnhome}" --registry "${npm_config_registry}"

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2pkgname=vagrant-manager-git
3_pkgname="Vagrant Manager"
4pkgver=2.3.2.r250.ga2d265f
5_electronversion=23
6_nodeversion=18
7pkgrel=1
8pkgdesc="An electron, status bar menu app that lets you manage all of your vagrant machines from one central location."
9arch=('any')
10url="https://github.com/absalomedia/vagrant-manager"
11license=('MIT')
12conflicts=("${pkgname%-git}")
13provides=("${pkgname%-git}=${pkgver%.r*}")
14depends=(
15 "electron${_electronversion}-bin"
16 'vagrant'
17)
18makedepends=(
19 'npm'
20 'yarn'
21 'git'
22 'nvm'
23 'gendesk'
24 'jq'
25)
26source=(
27 "${pkgname%-git}.git::git+${url}.git"
28 "${pkgname%-git}.sh"
29)
30sha256sums=('SKIP'
31 'dfcd6603d29c7b8d88e019b517a2e5c1a7b5ab905a0961a8b81adfa508b258b8')
32_get_project_dir() {
33 local d
34 while IFS= read -r d; do
35 find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
36 done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
37}
38pkgver() {
39 cd "$(_get_project_dir)"
40 set -o pipefail
41 git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
42 printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
43}
44_ensure_local_nvm() {
45 local NVM_DIR="${srcdir}/.nvm"
46 source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
47 nvm install "${_nodeversion}"
48 nvm use "${_nodeversion}"
49}
50_get_app_dir() {
51 find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -print 2>/dev/null | while read f; do [ -d "${f%/*}/resources" ] && echo "${f%/*}" && break; done
52}
53_get_electron_version() {
54 _elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
55 | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
56 | grep -oE '[0-9]+' | head -1)
57 [[ -z "${_elec_ver}" ]] && return 1
58 (( _elec_ver == _electronversion )) && c=32 || c=31
59 echo -e "Electron version: \033[1;${c}m${_elec_ver}$([[ $c -eq 31 ]] && echo " (expected ${_electronversion})")\033[0m"
60}
61_set_build_env() {
62 export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
63 export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
64 export ELECTRON_SKIP_BINARY_DOWNLOAD=1
65 export ELECTRON_BUILDER_OFFLINE=true
66 export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
67 export HOME="${srcdir}/.home"
68 export XDG_CACHE_HOME="${HOME}/.cache"
69 export XDG_CONFIG_HOME="${HOME}/.config"
70 export XDG_DATA_HOME="${HOME}/.local/share"
71 export YARN_CACHE_FOLDER="${HOME}/.yarn/cache"
72 export YARN_NETWORK_CONCURRENCY=32
73 export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
74 export COREPACK_HOME="${HOME}/.corepack"
75 export npm_config_registry="${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}"
76 local _yarnver _yarnmajor=0
77 _yarnver="$(node -p "require('./package.json').packageManager?.split('@')[1]?.split('-')[0] || ''" 2>/dev/null)"
78 _yarnmajor="${_yarnver%%.*}"
79 _yarnmajor="${_yarnmajor:-0}"
80 if [[ "${_yarnmajor}" -ge 2 ]] 2>/dev/null || [[ -f .yarnrc.yml ]]; then
81 export XDG_STATE_HOME="${HOME}/.local/state"
82 export YARN_ENABLE_GLOBAL_CACHE=false
83 export YARN_ENABLE_MIRROR=false
84 export YARN_GLOBAL_FOLDER="${HOME}/.yarn/berry"
85 export YARN_NODE_LINKER=node-modules
86 export YARN_NM_MODE=hardlinks-local
87 export YARN_ENABLE_TELEMETRY=false
88 export YARN_ENABLE_SCRIPTS=true
89 export YARN_HTTP_TIMEOUT=600000
90 export YARN_HTTP_RETRY=5
91 export YARN_NPM_REGISTRY_SERVER="${YARN_NPM_REGISTRY_SERVER:-${NPM_CONFIG_REGISTRY:-https://registry.yarnpkg.com}}"
92 local _yarnhome="${HOME}/.yarn/install"
93 mkdir -p "${HOME}" "${YARN_CACHE_FOLDER}" "${YARN_GLOBAL_FOLDER}" "${COREPACK_HOME}" "${_yarnhome}"
94 if [[ -n "${_yarnver}" ]]; then
95 npm install -g "@yarnpkg/cli-dist@${_yarnver}" --prefix "${_yarnhome}" --registry "${npm_config_registry}"
96 export PATH="${_yarnhome}/bin:${PATH}"
97 fi
98 else
99 export YARN_GLOBAL_FOLDER="${HOME}/.yarn/global"
100 export YARN_LINK_FOLDER="${HOME}/.yarn/link"
101 export YARN_TEMP_FOLDER="${HOME}/.yarn/tmp"
102 export YARN_NETWORK_TIMEOUT=600000
103 export YARN_CHILD_CONCURRENCY="$(nproc)"
104 export YARN_FROZEN_LOCKFILE=true
105 export YARN_IGNORE_ENGINES=true
106 export YARN_PRODUCTION=false
107 mkdir -p "${HOME}" "${YARN_CACHE_FOLDER}" "${YARN_GLOBAL_FOLDER}" "${YARN_LINK_FOLDER}" "${YARN_TEMP_FOLDER}" "${COREPACK_HOME}"
108 fi
109 local _reg="${NPM_CONFIG_REGISTRY:-https://registry.yarnpkg.com}"
110 export YARN_REGISTRY="${_reg}"
111 _reg="${_reg%/}"
112 if [[ -f .yarnrc ]]; then
113 sed -i "s|^registry .*|registry \"${_reg}\"|" .yarnrc
114 fi
115 if [[ -f yarn.lock ]] && grep -q 'resolved "https://registry.yarnpkg.com' yarn.lock; then
116 sed -i "s|https://registry.yarnpkg.com/|${_reg}/|g" yarn.lock
117 fi
118}
119prepare() {
120 cd "$(_get_project_dir)"
121 _get_electron_version
122 sed -i -e "
123 s/@electronversion@/${_electronversion}/g
124 s/@appname@/${pkgname%-git}/g
125 " "${srcdir}/${pkgname%-git}.sh"
126 gendesk -q -f -n \
127 --pkgname="${pkgname%-git}" \
128 --pkgdesc="${pkgdesc}" \
129 --categories="Utility" \
130 --name="${_pkgname}" \
131 --exec="${pkgname%-git} %U"
132 _ensure_local_nvm
133 _set_build_env
134 jq --arg ver "${SYSTEM_ELECTRON_VERSION}" '.devDependencies.electron = $ver' package.json > package.json.tmp && mv package.json.tmp package.json
135 export NODE_ENV=development
136 yarn install
137}
138build() {
139 cd "$(_get_project_dir)"
140 _ensure_local_nvm
141 _set_build_env
142 export NODE_ENV=production
143 yarn electron-builder --linux dir -c.electronDist="${ELECTRON_DIST}"
144}
145package() {
146 install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
147 install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-git}"
148 rm -rf "$(_get_app_dir)/resources/default_app.asar"
149 cp -a "$(_get_app_dir)/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"
150 _icon_sizes=(16x16 32x32 48x48 128x128 256x256 512x512)
151 for _icons in "${_icon_sizes[@]}";do
152 install -Dm644 "$(_get_project_dir)/build/icons/${_icons}.png" \
153 "${pkgdir}/usr/share/icons/hicolor/${_icons}/apps/${pkgname%-git}.png"
154 done
155 install -Dm644 "$(_get_project_dir)/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
156 install -Dm644 "$(_get_project_dir)/LICENSE.md" -t "${pkgdir}/usr/share/licenses/${pkgname}"
157}

Changes since previous scan

--- PKGBUILD @ 2026-06-18 16:11
+++ PKGBUILD @ 2026-10-17 00:21
@@ -5,14 +5,14 @@
_electronversion=23
_nodeversion=18
pkgrel=1
-pkgdesc="An electron, status bar menu app that lets you manage all of your vagrant machines from one central location.(Use system-wide electron)"
+pkgdesc="An electron, status bar menu app that lets you manage all of your vagrant machines from one central location."
arch=('any')
url="https://github.com/absalomedia/vagrant-manager"
license=('MIT')
conflicts=("${pkgname%-git}")
provides=("${pkgname%-git}=${pkgver%.r*}")
depends=(
- "electron${_electronversion}"
+ "electron${_electronversion}-bin"
'vagrant'
)
makedepends=(
@@ -21,73 +21,137 @@
'git'
'nvm'
'gendesk'
- 'curl'
+ 'jq'
)
source=(
"${pkgname%-git}.git::git+${url}.git"
"${pkgname%-git}.sh"
)
sha256sums=('SKIP'
- '291f50480f5a61bc9c68db7d44cd0412071128706baa868a9cb854f8779a1980')
+ 'dfcd6603d29c7b8d88e019b517a2e5c1a7b5ab905a0961a8b81adfa508b258b8')
+_get_project_dir() {
+ local d
+ while IFS= read -r d; do
+ find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
+ done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
+}
pkgver() {
- cd "${srcdir}/${pkgname%-git}.git"
+ cd "$(_get_project_dir)"
set -o pipefail
git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
}
_ensure_local_nvm() {
- export NVM_DIR="${srcdir}/.nvm"
+ local NVM_DIR="${srcdir}/.nvm"
source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
nvm install "${_nodeversion}"
nvm use "${_nodeversion}"
}
+_get_app_dir() {
+ find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -print 2>/dev/null | while read f; do [ -d "${f%/*}/resources" ] && echo "${f%/*}" && break; done
+}
+_get_electron_version() {
+ _elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
+ | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
+ | grep -oE '[0-9]+' | head -1)
+ [[ -z "${_elec_ver}" ]] && return 1
+ (( _elec_ver == _electronversion )) && c=32 || c=31
+ echo -e "Electron version: \033[1;${c}m${_elec_ver}$([[ $c -eq 31 ]] && echo " (expected ${_electronversion})")\033[0m"
+}
+_set_build_env() {
+ export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
+ export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
+ export ELECTRON_SKIP_BINARY_DOWNLOAD=1
+ export ELECTRON_BUILDER_OFFLINE=true
+ export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
+ export HOME="${srcdir}/.home"
+ export XDG_CACHE_HOME="${HOME}/.cache"
+ export XDG_CONFIG_HOME="${HOME}/.config"
+ export XDG_DATA_HOME="${HOME}/.local/share"
+ export YARN_CACHE_FOLDER="${HOME}/.yarn/cache"
+ export YARN_NETWORK_CONCURRENCY=32
+ export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
+ export COREPACK_HOME="${HOME}/.corepack"
+ export npm_config_registry="${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}"
+ local _yarnver _yarnmajor=0
+ _yarnver="$(node -p "require('./package.json').packageManager?.split('@')[1]?.split('-')[0] || ''" 2>/dev/null)"
+ _yarnmajor="${_yarnver%%.*}"
+ _yarnmajor="${_yarnmajor:-0}"
+ if [[ "${_yarnmajor}" -ge 2 ]] 2>/dev/null || [[ -f .yarnrc.yml ]]; then
+ export XDG_STATE_HOME="${HOME}/.local/state"
+ export YARN_ENABLE_GLOBAL_CACHE=false
+ export YARN_ENABLE_MIRROR=false
+ export YARN_GLOBAL_FOLDER="${HOME}/.yarn/berry"
+ export YARN_NODE_LINKER=node-modules
+ export YARN_NM_MODE=hardlinks-local
+ export YARN_ENABLE_TELEMETRY=false
+ export YARN_ENABLE_SCRIPTS=true
+ export YARN_HTTP_TIMEOUT=600000
+ export YARN_HTTP_RETRY=5
+ export YARN_NPM_REGISTRY_SERVER="${YARN_NPM_REGISTRY_SERVER:-${NPM_CONFIG_REGISTRY:-https://registry.yarnpkg.com}}"
+ local _yarnhome="${HOME}/.yarn/install"
+ mkdir -p "${HOME}" "${YARN_CACHE_FOLDER}" "${YARN_GLOBAL_FOLDER}" "${COREPACK_HOME}" "${_yarnhome}"
+ if [[ -n "${_yarnver}" ]]; then
+ npm install -g "@yarnpkg/cli-dist@${_yarnver}" --prefix "${_yarnhome}" --registry "${npm_config_registry}"
+ export PATH="${_yarnhome}/bin:${PATH}"
+ fi
+ else
+ export YARN_GLOBAL_FOLDER="${HOME}/.yarn/global"
+ export YARN_LINK_FOLDER="${HOME}/.yarn/link"
+ export YARN_TEMP_FOLDER="${HOME}/.yarn/tmp"
+ export YARN_NETWORK_TIMEOUT=600000
+ export YARN_CHILD_CONCURRENCY="$(nproc)"
+ export YARN_FROZEN_LOCKFILE=true
+ export YARN_IGNORE_ENGINES=true
+ export YARN_PRODUCTION=false
+ mkdir -p "${HOME}" "${YARN_CACHE_FOLDER}" "${YARN_GLOBAL_FOLDER}" "${YARN_LINK_FOLDER}" "${YARN_TEMP_FOLDER}" "${COREPACK_HOME}"
+ fi
+ local _reg="${NPM_CONFIG_REGISTRY:-https://registry.yarnpkg.com}"
+ export YARN_REGISTRY="${_reg}"
+ _reg="${_reg%/}"
+ if [[ -f .yarnrc ]]; then
+ sed -i "s|^registry .*|registry \"${_reg}\"|" .yarnrc
+ fi
+ if [[ -f yarn.lock ]] && grep -q 'resolved "https://registry.yarnpkg.com' yarn.lock; then
+ sed -i "s|https://registry.yarnpkg.com/|${_reg}/|g" yarn.lock
+ fi
+}
prepare() {
+ cd "$(_get_project_dir)"
+ _get_electron_version
sed -i -e "
s/@electronversion@/${_electronversion}/g
s/@appname@/${pkgname%-git}/g
- s/@runname@/app.asar/g
- s/@cfgdirname@/${_pkgname}/g
- s/@options@//g
" "${srcdir}/${pkgname%-git}.sh"
+ gendesk -q -f -n \
+ --pkgname="${pkgname%-git}" \
+ --pkgdesc="${pkgdesc}" \
+ --categories="Utility" \
+ --name="${_pkgname}" \
+ --exec="${pkgname%-git} %U"
_ensure_local_nvm
- gendesk -q -f -n --pkgname="${pkgname%-git}" --pkgdesc="${pkgdesc}" --categories="Utility" --name="${_pkgname}" --exec="${pkgname%-git} %U"
- cd "${srcdir}/${pkgname%-git}.git"
- #export ELECTRON_SKIP_BINARY_DOWNLOAD=1
- export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/v//g')"
- HOME="${srcdir}/.electron-gyp"
- mkdir -p "${srcdir}/.electron-gyp"
- if [[ "$(curl -s ipinfo.io/country)" == *"CN"* ]]; then
- {
- echo -e '\n'
- echo 'registry "https://registry.npmmirror.com"'
- echo 'electron_mirror "https://registry.npmmirror.com/-/binary/electron/"'
- echo 'electron_builder_binaries_mirror "https://registry.npmmirror.com/-/binary/electron-builder-binaries/"'
- echo "cacheFolder "${srcdir}"/.yarn/cache"
- echo "pluginsFolder "${srcdir}"/.yarn/plugins"
- echo "globalFolder "${srcdir}"/.yarn/global"
- echo 'useHardlinks true'
- #echo 'buildFromSource true'
- echo 'linkWorkspacePackages true'
- echo 'fetchRetries 3'
- echo 'fetchRetryTimeout 10000'
- } >> .yarnrc
- find ./ -type f -name "yarn.lock" -exec sed -i "s/registry.yarnpkg.com/registry.npmmirror.com/g" {} +
- fi
- NODE_ENV=development yarn install --cache-folder "${srcdir}/.yarn_cache"
+ _set_build_env
+ jq --arg ver "${SYSTEM_ELECTRON_VERSION}" '.devDependencies.electron = $ver' package.json > package.json.tmp && mv package.json.tmp package.json
+ export NODE_ENV=development
+ yarn install
}
build() {
- cd "${srcdir}/${pkgname%-git}.git"
- local electronDist="/usr/lib/electron${_electronversion}"
- NODE_ENV=production yarn electron-builder --linux dir -c.electronDist="${electronDist}"
+ cd "$(_get_project_dir)"
+ _ensure_local_nvm
+ _set_build_env
+ export NODE_ENV=production
+ yarn electron-builder --linux dir -c.electronDist="${ELECTRON_DIST}"
}
package() {
install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
- install -Dm644 "${srcdir}/${pkgname%-git}.git/dist/linux-"*/resources/app.asar -t "${pkgdir}/usr/lib/${pkgname%-git}"
- _icon_sizes=(16x16 32x32 48x48 64x64 128x128 256x256 512x512)
+ install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-git}"
+ rm -rf "$(_get_app_dir)/resources/default_app.asar"
+ cp -a "$(_get_app_dir)/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"
+ _icon_sizes=(16x16 32x32 48x48 128x128 256x256 512x512)
for _icons in "${_icon_sizes[@]}";do
- install -Dm644 "${srcdir}/${pkgname%-git}.git/build/icons/${_icons}.png" \
+ install -Dm644 "$(_get_project_dir)/build/icons/${_icons}.png" \
"${pkgdir}/usr/share/icons/hicolor/${_icons}/apps/${pkgname%-git}.png"
done
- install -Dm644 "${srcdir}/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
- install -Dm644 "${srcdir}/${pkgname%-git}.git/LICENSE.md" -t "${pkgdir}/usr/share/licenses/${pkgname}"
+ install -Dm644 "$(_get_project_dir)/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
+ install -Dm644 "$(_get_project_dir)/LICENSE.md" -t "${pkgdir}/usr/share/licenses/${pkgname}"
}

Scan history

Scanned at (UTC)SeverityRules
2026-10-17 00:21:55 Low 1
2026-10-16 00:12:47 Low 1
2026-10-15 00:28:05 Low 1
2026-10-14 00:06:47 Low 1
2026-10-13 09:16:20 Low 1
2026-06-18 16:11:54 Clean 0

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion