vega-nostr-git

LOW

maintainer hoornet 0 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The npx tauri build command executes a local Tauri CLI from the project's own source, not a remote package, so the risk is low despite the static analyzer flag.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The npx tauri build command executes a local Tauri CLI from the project's own source, not a remote package, so the risk is low despite the static analyzer flag.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium npx/bunx/deno executes a remote package remote_code_tool

`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.

PKGBUILD:56 npx tauri build --no-bundle -- --locked

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: hoornet <hoornet@users.noreply.github.com>
    
      2pkgname=vega-nostr-git
    
      3pkgver=0.16.3
    
      4pkgrel=1
    
      5pkgdesc="Cross-platform Nostr desktop client with Lightning integration"
    
      6arch=('x86_64')
    
      7url="https://github.com/hoornet/vega"
    
      8license=('MIT')
    
      9depends=(
    
      10    'webkit2gtk-4.1'
    
      11    'gtk3'
    
      12    'libayatana-appindicator'
    
      13    'openssl'
    
      14    'gst-plugins-base'
    
      15    'gst-plugins-good'
    
      16    'gst-libav'
    
      17)
    
      18makedepends=(
    
      19    'rust'
    
      20    'nodejs'
    
      21    'npm'
    
      22    'git'
    
      23)
    
      24optdepends=(
    
      25    'gnome-keyring: persistent key storage (any Secret Service provider works)'
    
      26    'kwallet: Secret Service provider on KDE'
    
      27)
    
      28provides=('vega-nostr')
    
      29conflicts=('vega-nostr')
    
      30options=('!debug')
    
      31source=("$pkgname::git+https://github.com/hoornet/vega.git")
    
      32sha256sums=('SKIP')
    
      33
    
      34pkgver() {
    
      35    cd "$pkgname"
    
      36    git describe --tags --long 2>/dev/null | sed 's/^v//;s/-/.r/;s/-/./' || echo "$pkgver"
    
      37}
    
      38
    
      39build() {
    
      40    cd "$pkgname"
    
      41    # Reset makepkg flags — they interfere with Rust cc crate
    
      42    # compiling bundled SQLite and Ring assembly
    
      43    unset CFLAGS CXXFLAGS LDFLAGS
    
      44
    
      45    # `npm ci --ignore-scripts`, never `npm install` — this mirrors
    
      46    # .github/workflows/release.yml. `install` re-resolves inside the caret
    
      47    # ranges, so a compromised patch release could reach a user's build
    
      48    # without ever appearing in the reviewed lockfile, and postinstall
    
      49    # scripts run as the building user. This package builds on the user's
    
      50    # own machine, so that gap is theirs, not CI's.
    
      51    npm ci --ignore-scripts
    
      52
    
      53    # `-- --locked` forwards to cargo (the Tauri CLI passes trailing args
    
      54    # through). Cargo's equivalent of `npm ci`: refuse to re-resolve, fail
    
      55    # instead of silently building a lockfile nobody reviewed.
    
      56    npx tauri build --no-bundle -- --locked
    
      57}
    
      58
    
      59package() {
    
      60    cd "$pkgname"
    
      61
    
      62    install -Dm755 "src-tauri/target/release/vega" \
    
      63        "$pkgdir/usr/bin/vega"
    
      64
    
      65    # Strip build paths from binary (fixes $srcdir reference warning)
    
      66    strip --strip-unneeded "$pkgdir/usr/bin/vega"
    
      67
    
      68    # Icons
    
      69    install -Dm644 "src-tauri/icons/32x32.png" \
    
      70        "$pkgdir/usr/share/icons/hicolor/32x32/apps/vega.png"
    
      71    install -Dm644 "src-tauri/icons/128x128.png" \
    
      72        "$pkgdir/usr/share/icons/hicolor/128x128/apps/vega.png"
    
      73    install -Dm644 "src-tauri/icons/128x128@2x.png" \
    
      74        "$pkgdir/usr/share/icons/hicolor/256x256/apps/vega.png"
    
      75
    
      76    # Desktop entry
    
      77    install -Dm644 /dev/stdin \
    
      78        "$pkgdir/usr/share/applications/vega.desktop" << 'EOF'
    
      79[Desktop Entry]
    
      80Name=Vega
    
      81Comment=Nostr desktop client
    
      82Exec=env WEBKIT_DISABLE_DMABUF_RENDERER=1 /usr/bin/vega
    
      83Icon=vega
    
      84Type=Application
    
      85Categories=Network;InstantMessaging;
    
      86StartupNotify=true
    
      87EOF
    
      88
    
      89    install -Dm644 "LICENSE" \
    
      90        "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      91}
    
      92

Changes since previous scan

--- PKGBUILD @ 2026-10-21 00:12
+++ PKGBUILD @ 2026-11-01 00:21
@@ -1,6 +1,6 @@
 # Maintainer: hoornet <hoornet@users.noreply.github.com>
 pkgname=vega-nostr-git
-pkgver=0.16.1
+pkgver=0.16.3
 pkgrel=1
 pkgdesc="Cross-platform Nostr desktop client with Lightning integration"
 arch=('x86_64')

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 00:13:55	Low	2
2026-10-28 00:06:54	Low	2
2026-10-27 00:23:28	Low	2
2026-10-26 00:12:40	Low	2
2026-10-25 00:20:48	Low	2
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 00:13:10	Low	2
2026-10-21 15:32:06	Medium	1
2026-10-21 11:31:16	Medium	1
2026-10-21 00:12:50	Low	2
2026-10-20 15:28:05	Medium	1
2026-10-20 13:28:00	Medium	1
2026-10-20 00:10:31	Low	2
2026-10-19 19:26:12	Medium	1
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2