voltius
MEDIUM
maintainer ezhkov
2 votes
scanned 2026-11-01 14:00:44.307000
Why flagged
Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.
Triggered rules
Medium
npm/yarn/pnpm install of an undeclared external package
npm_install_external
Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.
-
PKGBUILD:24
npm install -g pnpm@10.34.5 --prefix "$srcdir/npm-global"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: ezhkov <alexcez94@gmail.com>
2
pkgname=voltius
3
pkgver=0.66.0
4
pkgrel=1
5
pkgdesc="Local-first SSH/SFTP/Serial client with E2EE sync, plugins, and no account required"
6
arch=('x86_64' 'aarch64')
7
url="https://github.com/VoltiusApp/voltius"
8
license=('AGPL3')
9
depends=('webkit2gtk-4.1' 'gtk3' 'libappindicator-gtk3' 'librsvg' 'libsecret' 'hicolor-icon-theme')
10
makedepends=('rust' 'nodejs' 'npm' 'git' 'appmenu-gtk-module' 'desktop-file-utils')
11
options=('!lto')
12
source=(
13
"$pkgname-$pkgver.tar.gz::https://github.com/VoltiusApp/voltius/archive/refs/tags/v$pkgver.tar.gz"
14
"$pkgname.desktop"
15
)
16
sha256sums=('2ffd383f5b2a0fc3c986bae737e643b14b6b7b240b5e492f06bc4a7a379c2ec3'
17
'101c1683674e94e286f06627f76d0422e506afd2579620d202710bd304693f44')
18
19
prepare() {
20
cd "voltius-$pkgver"
21
# pnpm isn't in the official repos; install it into a local, writable
22
# prefix rather than relying on `corepack enable` (which tries to write
23
# shims next to the system-wide nodejs install under /usr).
24
npm install -g pnpm@10.34.5 --prefix "$srcdir/npm-global"
25
}
26
27
build() {
28
export CARGO_TARGET_X86_64_UNKNOWN_LINUX_GNU_LINKER=/usr/bin/gcc
29
cd "voltius-$pkgver"
30
export PATH="$srcdir/npm-global/bin:$PATH"
31
export TAURI_SIGNING_PRIVATE_KEY="aur-build-dummy-key"
32
export TAURI_SIGNING_PRIVATE_KEY_PASSWORD="aur-build-dummy-pass"
33
export NODE_ENV=production
34
pnpm install --frozen-lockfile
35
pnpm tauri build --no-bundle
36
}
37
38
package() {
39
cd "voltius-$pkgver"
40
41
install -Dm755 target/release/voltius "$pkgdir/usr/bin/voltius"
42
install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
43
44
install -Dm644 "$srcdir/$pkgname.desktop" "$pkgdir/usr/share/applications/$pkgname.desktop"
45
46
install -Dm644 src-tauri/icons/32x32.png \
47
"$pkgdir/usr/share/icons/hicolor/32x32/apps/$pkgname.png"
48
install -Dm644 src-tauri/icons/128x128.png \
49
"$pkgdir/usr/share/icons/hicolor/128x128/apps/$pkgname.png"
50
install -Dm644 src-tauri/icons/128x128@2x.png \
51
"$pkgdir/usr/share/icons/hicolor/256x256/apps/$pkgname.png"
52
}
53
Changes since previous scan
--- PKGBUILD @ 2026-11-01 00:21+++ PKGBUILD @ 2026-11-01 14:00@@ -1,6 +1,6 @@ # Maintainer: ezhkov <alexcez94@gmail.com> pkgname=voltius-pkgver=0.64.1+pkgver=0.66.0 pkgrel=1 pkgdesc="Local-first SSH/SFTP/Serial client with E2EE sync, plugins, and no account required" arch=('x86_64' 'aarch64')@@ -13,7 +13,7 @@ "$pkgname-$pkgver.tar.gz::https://github.com/VoltiusApp/voltius/archive/refs/tags/v$pkgver.tar.gz" "$pkgname.desktop" )-sha256sums=('2427732bd8c210a45ae141ae5eb67081145308094c878a4edb78a3cb8aed7ce6'+sha256sums=('2ffd383f5b2a0fc3c986bae737e643b14b6b7b240b5e492f06bc4a7a379c2ec3' '101c1683674e94e286f06627f76d0422e506afd2579620d202710bd304693f44') prepare() {Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 14:00:44 | Medium | 1 |
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 13:56:02 | Medium | 1 |
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 00:13:55 | Low | 2 |
| 2026-10-28 00:06:54 | Low | 2 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 11:42:44 | Medium | 1 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 17:35:31 | Medium | 1 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 19:26:12 | Medium | 1 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 23:23:07 | Medium | 1 |