vega-nostr

LOW

maintainer hoornet 0 votes scanned 2026-09-13 13:16:06.742034

View on AUR

Why flagged

The `npx tauri build` invocation runs the locally installed `@tauri-apps/cli` package from the project's own `node_modules` (installed via `npm ci --ignore-scripts` from the checked-in lockfile), not a remote package fetched at runtime; the source is the project's own GitHub repo at a tagged release, and the build is otherwise a standard Tauri/Rust compile with no exfiltration or obfuscated payloads — the SKIP'd checksum on a git source is normal AUR practice.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): The `npx tauri build` invocation runs the locally installed `@tauri-apps/cli` package from the project's own `node_modules` (installed via `npm ci --ignore-scripts` from the checked-in lockfile), not a remote package fetched at runtime; the source is the project's own GitHub repo at a tagged release, and the build is otherwise a standard Tauri/Rust compile with no exfiltration or obfuscated payloads — the SKIP'd checksum on a git source is normal AUR practice.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:66 npx tauri build --no-bundle -- --locked

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: hoornet <hoornet@users.noreply.github.com>
    
      2#
    
      3# Stable, tagged Vega. This is the package Arch users should install; it
    
      4# builds a released tag and nothing else.
    
      5#
    
      6# Its sibling `vega-nostr-git` builds the default branch, which is what a
    
      7# `-git` package is supposed to do — but that means it ships whatever was
    
      8# last pushed to main, including unreleased work. It was the only Vega
    
      9# package on the AUR until this one existed, and the README pointed at it,
    
      10# so every Arch user was running development code without being told.
    
      11#
    
      12# Keep the build steps here in sync with vega-nostr-git's. They are the same
    
      13# build; only the source ref differs.
    
      14pkgname=vega-nostr
    
      15pkgver=0.15.7
    
      16pkgrel=1
    
      17pkgdesc="Cross-platform Nostr desktop client with Lightning integration"
    
      18arch=('x86_64')
    
      19url="https://github.com/hoornet/vega"
    
      20license=('MIT')
    
      21depends=(
    
      22    'webkit2gtk-4.1'
    
      23    'gtk3'
    
      24    'libayatana-appindicator'
    
      25    'openssl'
    
      26    'gst-plugins-base'
    
      27    'gst-plugins-good'
    
      28    'gst-libav'
    
      29)
    
      30optdepends=(
    
      31    'gnome-keyring: persistent key storage (any Secret Service provider works)'
    
      32    'kwallet: Secret Service provider on KDE'
    
      33)
    
      34makedepends=(
    
      35    'rust'
    
      36    'cargo'
    
      37    'nodejs'
    
      38    'npm'
    
      39    'git'
    
      40)
    
      41options=('!debug')
    
      42# Pinned to the release tag. Tags in this repo are immutable by policy — a bad
    
      43# release is superseded by a patch release, never re-tagged (see CLAUDE.md), so
    
      44# a tag names one commit forever. Harden further with `#commit=<sha>` if you
    
      45# ever want the ref to be cryptographically pinned rather than policy-pinned.
    
      46source=("$pkgname-$pkgver::git+https://github.com/hoornet/vega.git#tag=v$pkgver")
    
      47sha256sums=('SKIP')
    
      48
    
      49build() {
    
      50    cd "$pkgname-$pkgver"
    
      51    # Reset makepkg flags — they interfere with Rust cc crate
    
      52    # compiling bundled SQLite and Ring assembly
    
      53    unset CFLAGS CXXFLAGS LDFLAGS
    
      54
    
      55    # `npm ci --ignore-scripts`, never `npm install` — this mirrors
    
      56    # .github/workflows/release.yml. `install` re-resolves inside the caret
    
      57    # ranges, so a compromised patch release could reach a user's build
    
      58    # without ever appearing in the reviewed lockfile, and postinstall
    
      59    # scripts run as the building user. This package builds on the user's
    
      60    # own machine, so that gap is theirs, not CI's.
    
      61    npm ci --ignore-scripts
    
      62
    
      63    # `-- --locked` forwards to cargo (the Tauri CLI passes trailing args
    
      64    # through). Cargo's equivalent of `npm ci`: refuse to re-resolve, fail
    
      65    # instead of silently building a lockfile nobody reviewed.
    
      66    npx tauri build --no-bundle -- --locked
    
      67}
    
      68
    
      69package() {
    
      70    cd "$pkgname-$pkgver"
    
      71
    
      72    install -Dm755 "src-tauri/target/release/vega" \
    
      73        "$pkgdir/usr/bin/vega"
    
      74
    
      75    # Strip build paths from binary (fixes $srcdir reference warning)
    
      76    strip --strip-unneeded "$pkgdir/usr/bin/vega"
    
      77
    
      78    # Icons
    
      79    install -Dm644 "src-tauri/icons/32x32.png" \
    
      80        "$pkgdir/usr/share/icons/hicolor/32x32/apps/vega.png"
    
      81    install -Dm644 "src-tauri/icons/128x128.png" \
    
      82        "$pkgdir/usr/share/icons/hicolor/128x128/apps/vega.png"
    
      83    install -Dm644 "src-tauri/icons/128x128@2x.png" \
    
      84        "$pkgdir/usr/share/icons/hicolor/256x256/apps/vega.png"
    
      85
    
      86    # Desktop entry. WEBKIT_DISABLE_DMABUF_RENDERER=1 is required on Wayland —
    
      87    # without it the WebKit DMA-BUF renderer produces a blank window.
    
      88    install -Dm644 /dev/stdin \
    
      89        "$pkgdir/usr/share/applications/vega.desktop" << 'EOF'
    
      90[Desktop Entry]
    
      91Name=Vega
    
      92Comment=Nostr desktop client
    
      93Exec=env WEBKIT_DISABLE_DMABUF_RENDERER=1 /usr/bin/vega
    
      94Icon=vega
    
      95Type=Application
    
      96Categories=Network;InstantMessaging;
    
      97StartupNotify=true
    
      98EOF
    
      99
    
      100    install -Dm644 "LICENSE" \
    
      101        "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      102}
    
      103

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-13 13:16:06	Low	3
2026-09-13 13:14:45	Medium	2