voltius-git
MEDIUM
maintainer ezhkov
2 votes
scanned 2026-11-01 14:00:44.307000
Why flagged
Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.
Triggered rules
Medium
npm/yarn/pnpm install of an undeclared external package
npm_install_external
Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.
-
PKGBUILD:30
npm install -g pnpm@10.34.5 --prefix "$srcdir/npm-global"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: ezhkov <alexcez94@gmail.com>
2
pkgname=voltius-git
3
_pkgname=voltius
4
pkgver=0.66.0.r0.g75228866
5
pkgrel=1
6
pkgdesc="Local-first SSH/SFTP/Serial client with E2EE sync, plugins, and no account required (main branch)"
7
arch=('x86_64' 'aarch64')
8
url="https://github.com/VoltiusApp/voltius"
9
license=('AGPL3')
10
provides=('voltius')
11
conflicts=('voltius')
12
depends=('webkit2gtk-4.1' 'gtk3' 'libappindicator-gtk3' 'librsvg' 'libsecret' 'hicolor-icon-theme')
13
makedepends=('rust' 'nodejs' 'npm' 'git' 'appmenu-gtk-module' 'desktop-file-utils')
14
options=('!lto')
15
source=("$_pkgname::git+https://github.com/VoltiusApp/voltius.git"
16
"$_pkgname.desktop")
17
sha256sums=('SKIP'
18
'SKIP')
19
20
pkgver() {
21
cd "$_pkgname"
22
git describe --long --tags | sed 's/^v//;s/\([^-]*-g\)/r\1/;s/-/./g'
23
}
24
25
prepare() {
26
cd "$_pkgname"
27
# pnpm isn't in the official repos; install it into a local, writable
28
# prefix rather than relying on `corepack enable` (which tries to write
29
# shims next to the system-wide nodejs install under /usr).
30
npm install -g pnpm@10.34.5 --prefix "$srcdir/npm-global"
31
}
32
33
build() {
34
export CARGO_TARGET_X86_64_UNKNOWN_LINUX_GNU_LINKER=/usr/bin/gcc
35
cd "$_pkgname"
36
export PATH="$srcdir/npm-global/bin:$PATH"
37
export TAURI_SIGNING_PRIVATE_KEY="aur-build-dummy-key"
38
export TAURI_SIGNING_PRIVATE_KEY_PASSWORD="aur-build-dummy-pass"
39
export NODE_ENV=production
40
pnpm install --frozen-lockfile
41
pnpm tauri build --no-bundle
42
}
43
44
package() {
45
cd "$_pkgname"
46
47
install -Dm755 target/release/voltius "$pkgdir/usr/bin/voltius"
48
install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
49
50
install -Dm644 "$srcdir/$_pkgname.desktop" "$pkgdir/usr/share/applications/$_pkgname.desktop"
51
52
install -Dm644 src-tauri/icons/32x32.png \
53
"$pkgdir/usr/share/icons/hicolor/32x32/apps/$_pkgname.png"
54
install -Dm644 src-tauri/icons/128x128.png \
55
"$pkgdir/usr/share/icons/hicolor/128x128/apps/$_pkgname.png"
56
install -Dm644 src-tauri/icons/128x128@2x.png \
57
"$pkgdir/usr/share/icons/hicolor/256x256/apps/$_pkgname.png"
58
}
59
Changes since previous scan
--- PKGBUILD @ 2026-11-01 00:21+++ PKGBUILD @ 2026-11-01 14:00@@ -1,7 +1,7 @@ # Maintainer: ezhkov <alexcez94@gmail.com> pkgname=voltius-git _pkgname=voltius-pkgver=0.64.1.r0.g6e1d30a2+pkgver=0.66.0.r0.g75228866 pkgrel=1 pkgdesc="Local-first SSH/SFTP/Serial client with E2EE sync, plugins, and no account required (main branch)" arch=('x86_64' 'aarch64')Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 14:00:44 | Medium | 1 |
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 13:56:02 | Medium | 1 |
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 00:13:55 | Low | 2 |
| 2026-10-28 00:06:54 | Low | 2 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 13:42:47 | Medium | 1 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 17:35:31 | Medium | 1 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 19:26:12 | Medium | 1 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 23:23:07 | Medium | 1 |