voltius-git
LOW
maintainer ezhkov
1 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The npm install in prepare() is for pnpm, a build tool used locally to support the project's own build process from a trusted, declared git source; it does not install arbitrary external packages or execute untrusted code.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The npm install in prepare() is for pnpm, a build tool used locally to support the project's own build process from a trusted, declared git source; it does not install arbitrary external packages or execute untrusted code.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
npm/yarn/pnpm install of an undeclared external package
npm_install_external
Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.
-
PKGBUILD:30
npm install -g pnpm@10.34.5 --prefix "$srcdir/npm-global"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: ezhkov <alexcez94@gmail.com>
2
pkgname=voltius-git
3
_pkgname=voltius
4
pkgver=0.37.0.r0.g55e3ba87
5
pkgrel=1
6
pkgdesc="Local-first SSH/SFTP/Serial client with E2EE sync, plugins, and no account required (main branch)"
7
arch=('x86_64' 'aarch64')
8
url="https://github.com/VoltiusApp/voltius"
9
license=('AGPL3')
10
provides=('voltius')
11
conflicts=('voltius')
12
depends=('webkit2gtk-4.1' 'gtk3' 'libappindicator-gtk3' 'librsvg' 'libsecret' 'hicolor-icon-theme')
13
makedepends=('rust' 'nodejs' 'npm' 'git' 'appmenu-gtk-module' 'desktop-file-utils')
14
options=('!lto')
15
source=("$_pkgname::git+https://github.com/VoltiusApp/voltius.git"
16
"$_pkgname.desktop")
17
sha256sums=('SKIP'
18
'SKIP')
19
20
pkgver() {
21
cd "$_pkgname"
22
git describe --long --tags | sed 's/^v//;s/\([^-]*-g\)/r\1/;s/-/./g'
23
}
24
25
prepare() {
26
cd "$_pkgname"
27
# pnpm isn't in the official repos; install it into a local, writable
28
# prefix rather than relying on `corepack enable` (which tries to write
29
# shims next to the system-wide nodejs install under /usr).
30
npm install -g pnpm@10.34.5 --prefix "$srcdir/npm-global"
31
}
32
33
build() {
34
export CARGO_TARGET_X86_64_UNKNOWN_LINUX_GNU_LINKER=/usr/bin/gcc
35
cd "$_pkgname"
36
export PATH="$srcdir/npm-global/bin:$PATH"
37
export TAURI_SIGNING_PRIVATE_KEY="aur-build-dummy-key"
38
export TAURI_SIGNING_PRIVATE_KEY_PASSWORD="aur-build-dummy-pass"
39
export NODE_ENV=production
40
pnpm install --frozen-lockfile
41
pnpm tauri build --no-bundle
42
}
43
44
package() {
45
cd "$_pkgname"
46
47
install -Dm755 target/release/voltius "$pkgdir/usr/bin/voltius"
48
install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
49
50
install -Dm644 "$srcdir/$_pkgname.desktop" "$pkgdir/usr/share/applications/$_pkgname.desktop"
51
52
install -Dm644 src-tauri/icons/32x32.png \
53
"$pkgdir/usr/share/icons/hicolor/32x32/apps/$_pkgname.png"
54
install -Dm644 src-tauri/icons/128x128.png \
55
"$pkgdir/usr/share/icons/hicolor/128x128/apps/$_pkgname.png"
56
install -Dm644 src-tauri/icons/128x128@2x.png \
57
"$pkgdir/usr/share/icons/hicolor/256x256/apps/$_pkgname.png"
58
}
59
Changes since previous scan
--- PKGBUILD @ 2026-09-16 00:03+++ PKGBUILD @ 2026-09-17 00:27@@ -1,7 +1,7 @@ # Maintainer: ezhkov <alexcez94@gmail.com> pkgname=voltius-git _pkgname=voltius-pkgver=0.34.5.r0.g94028801+pkgver=0.37.0.r0.g55e3ba87 pkgrel=1 pkgdesc="Local-first SSH/SFTP/Serial client with E2EE sync, plugins, and no account required (main branch)" arch=('x86_64' 'aarch64')Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 21:23:45 | Medium | 1 |
| 2026-09-16 19:23:36 | Medium | 1 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 09:19:41 | Medium | 1 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 19:17:46 | Medium | 1 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 17:14:56 | Medium | 1 |
| 2026-09-13 13:14:45 | Medium | 1 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 21:12:39 | Medium | 1 |
| 2026-09-12 15:12:25 | Medium | 1 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 11:22:29 | Medium | 1 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 17:21:08 | Medium | 1 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 09:16:51 | Medium | 1 |