visual-studio-code-bin-powershell
LOW
maintainer ChrisTX
0 votes
base
vscode-powershell
scanned 2026-10-31 08:00:22.627124
Why flagged
The `npx vscode-test` call in check() runs the project's own test suite using a locally installed npm package (vscode-test is already in node_modules from `npm ci`), not fetching a remote package at runtime; the rest of the PKGBUILD builds from the official upstream GitHub source with pinned checksums and installs only static extension files.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 80%): The `npx vscode-test` call in check() runs the project's own test suite using a locally installed npm package (vscode-test is already in node_modules from `npm ci`), not fetching a remote package at runtime; the rest of the PKGBUILD builds from the official upstream GitHub source with pinned checksums and installs only static extension files.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
npx/bunx/deno executes a remote package
remote_code_tool
`npx`/`bunx`/`pnpm dlx`/`deno run <url>` downloads AND runs a remote package at build time — the moral equivalent of piping a download into a shell. Severity downgraded: Node.js consumer context.
-
PKGBUILD:74
xvfb-run --auto-servernum npx vscode-test
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Christian Pfeiffer <cpfeiffer at rev-crew dot info>
2
# shellcheck disable=SC2034,SC2154
3
# shellcheck shell=bash
4
5
pkgbase=vscode-powershell
6
# A package per editor package, as each installs its built-in extensions somewhere else
7
pkgname=(
8
code-powershell
9
visual-studio-code-bin-powershell
10
vscodium-powershell
11
vscodium-bin-powershell
12
)
13
pkgver=2026.1.2preview
14
pkgrel=1
15
pkgdesc="PowerShell extension for Visual Studio Code, using powershell-editor-services"
16
arch=('any')
17
url='https://github.com/PowerShell/vscode-powershell'
18
license=('MIT')
19
# The extension of the version that bundles PowerShell Editor Services 4.7.0, which upstream
20
# released together
21
depends=(
22
powershell
23
'powershell-editor-services>=4.7.0'
24
)
25
makedepends=(
26
npm
27
)
28
# The tests run in Code - OSS, the editor in the repositories
29
checkdepends=(
30
code
31
xorg-server-xvfb
32
)
33
install="$pkgbase.install"
34
# Upstream versions the pre-releases (odd minor versions) as -preview
35
_tag="v${pkgver/preview/-preview}"
36
# The editor version the extension requires (engines.vscode in package.json)
37
_editorver=1.114.0
38
source=("vscode-powershell-$_tag.tar.gz::$url/archive/$_tag.tar.gz")
39
sha512sums=('b8e9fe217265d95bced8ff5dff315449f54b3cb8f8ebb579fa126aaf1faa62de57c74efbf5a78034a29df5206d525449115df4614481145513bc8d8b75747933')
40
b2sums=('9818181f73af82cd97a93af2c977fce4b69f803604da21ef2efeb7d29e6e5fdfbb4195e43e3d314fc6e4145fde6e7534c58f265b4fad1b471079b067d60508df')
41
42
prepare() {
43
cd "vscode-powershell-${_tag#v}" || exit
44
# With the npm registry instead of upstream's mirror on Azure Artifacts (.npmrc), the lockfile
45
# pins the integrity of the packages
46
npm ci --cache "$srcdir/npm-cache" --registry https://registry.npmjs.org/ --no-audit --no-fund
47
# The modules of PowerShell Editor Services and PSScriptAnalyzer, which upstream bundles, come from
48
# powershell-editor-services. Upstream links them like this to build from its repository as well.
49
ln -sfn /usr/share/powershell/Modules modules
50
# The tests run in the installed Code - OSS instead of a downloaded VS Code Insiders. They start
51
# its Electron directly, as /usr/bin/code only starts it in the background. Code - OSS has
52
# vscode.powershell built in, which test-cli would install in a downloaded VS Code.
53
sed -i -E \
54
-e '/It may break CI/d' \
55
-e 's|version: "insiders",|useInstallation: { fromPath: process.env.CODE_ELECTRON },\n skipExtensionDependencies: true,|' \
56
-e 's|^ launchArgs: \[|&\n "/usr/lib/code/code.mjs",|' \
57
.vscode-test.mjs
58
}
59
60
build() {
61
cd "vscode-powershell-${_tag#v}" || exit
62
# Like the release build (vscode-powershell.build.ps1)
63
npm run compile -- --minify
64
}
65
66
check() {
67
cd "vscode-powershell-${_tag#v}" || exit
68
# The Electron /usr/bin/code runs Code - OSS with
69
local _electron
70
_electron=$(sed -n -E 's/^name=(electron[0-9]+).*/\1/p' /usr/bin/code)
71
# Without npm test, whose pretest would replace the release build with a debug build. With the
72
# user's data of Code - OSS in $srcdir.
73
HOME="$srcdir/home" CODE_ELECTRON="/usr/lib/$_electron/electron" \
74
xvfb-run --auto-servernum npx vscode-test
75
}
76
77
# Installs the files of the extension package (.vscodeignore) as a built-in extension into the
78
# given directory of built-in extensions. The editors prefer an installed extension only if it's
79
# newer.
80
_package_extension() {
81
# Without cd, which namcap's restricted shell doesn't allow when it runs the package functions
82
local _src="$srcdir/vscode-powershell-${_tag#v}"
83
local _extdir="$pkgdir/$1/ms-vscode.powershell"
84
install -dm755 "$_extdir/dist"
85
install -m644 "$_src/package.json" "$_src"/*.md "$_src"/*.txt -t "$_extdir/"
86
install -m644 "$_src/dist/extension.js" -t "$_extdir/dist/"
87
cp -r --no-preserve=ownership "$_src"/{docs,examples,media,snippets,themes} "$_extdir/"
88
cp -a "$_src/modules" "$_extdir/"
89
# The package of the calling package function
90
install -Dm644 "$_src/LICENSE.txt" -t "$pkgdir/usr/share/licenses/${FUNCNAME[1]#package_}/"
91
}
92
93
package_code-powershell() {
94
pkgdesc="${pkgdesc/Visual Studio Code/Code - OSS}"
95
depends+=("code>=$_editorver")
96
_package_extension usr/lib/code/extensions
97
}
98
99
package_visual-studio-code-bin-powershell() {
100
pkgdesc+=" (for visual-studio-code-bin)"
101
depends+=("visual-studio-code-bin>=$_editorver")
102
_package_extension usr/share/code/resources/app/extensions
103
}
104
105
package_vscodium-powershell() {
106
pkgdesc="${pkgdesc/Visual Studio Code/VSCodium}"
107
depends+=("vscodium>=$_editorver")
108
_package_extension usr/share/vscodium/resources/app/extensions
109
}
110
111
package_vscodium-bin-powershell() {
112
pkgdesc="${pkgdesc/Visual Studio Code/VSCodium} (for vscodium-bin)"
113
depends+=("vscodium-bin>=$_editorver")
114
_package_extension opt/vscodium-bin/resources/app/extensions
115
}
116
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-31 08:00:22 | Low | 3 |
| 2026-10-31 07:58:04 | Medium | 2 |