waveterm

LOW

maintainer zxp19821005 1 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The flagged npm and go installs are part of building the project from its own source via git clone from the official repository, using declared build tools; this is normal AUR packaging behavior and not inherently dangerous.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The flagged npm and go installs are part of building the project from its own source via git clone from the official repository, using declared build tools; this is normal AUR packaging behavior and not inherently dangerous.

2 higher static findings superseded - not the current verdict (shown for transparency)

Medium npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:104 s/npm install/NODE_ENV=development npm install --include=optional/g
PKGBUILD:111 NODE_ENV=development npm add -D node-gyp sharp

Medium External install via pipx/uv/poetry/cargo/go/gem alt_pkg_manager_install

A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.

PKGBUILD:110 gem install fpm

PKGBUILD

3 offending line(s) highlighted

      1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
    
      2# Maintainer: Edu4rdSHL <edu4rdshl@protonmail.com>
    
      3# Maintainer: Evan Simkowitz <https://simkowitz.dev/>
    
      4pkgname=waveterm
    
      5_pkgname=Wave
    
      6_appname="${_pkgname} Terminal"
    
      7pkgver=0.14.5
    
      8_electronversion=41
    
      9_nodeversion=22
    
      10pkgrel=1
    
      11pkgdesc="An open-source, cross-platform terminal for seamless workflows.(Use system-wide electron)"
    
      12arch=(
    
  'aarch64'
    
  'x86_64'
    
      15)
    
      16url="https://www.waveterm.dev/"
    
      17_ghurl="https://github.com/wavetermdev/waveterm"
    
      18license=('Apache-2.0')
    
      19conflicts=("${pkgname}")
    
      20depends=(
    
  "electron${_electronversion}"
    
      22)
    
      23makedepends=(
    
  'gendesk'
    
  'npm'
    
  'go'
    
  'curl'
    
  'zip'
    
  'curl'
    
  'nvm'
    
  'ruby'
    
  'go-task'
    
  'zig'
    
  'ruby-bundler'
    
  'libarchive'
    
  'openjpeg2'
    
  'python'
    
  'git'
    
  'yarn'
    
      40)
    
      41source=("${pkgname}.sh")
    
      42sha256sums=('31ad33b633744f5361abd964be306cea53ae1050e760c787115f7eca60045ae6')
    
      43_ensure_local_nvm() {
    
  local NVM_DIR="${srcdir}/.nvm"
    
  source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
    
  nvm install "${_nodeversion}"
    
  nvm use "${_nodeversion}"
    
      48}
    
      49_get_electron_version() {
    
  _elec_ver="$(grep '"electron":' "${srcdir}/${pkgname}-${pkgver}/package.json" | cut -d'"' -f4 | tr -d '^' | cut -d. -f1)"
    
  echo -e "The electron version is: \033[1;31m${_elec_ver}\033[0m"
    
      52}
    
      53prepare() {
    
  cd "${srcdir}"
    
  if [[ ! -d "${pkgname}-${pkgver}" ]]; then
    
      git clone \
    
          --depth 1 \
    
          --branch "v${pkgver}" \
    
          "${_ghurl}" \
    
          "${pkgname}-${pkgver}"
    
  fi
    
  cd "${srcdir}/${pkgname}-${pkgver}"
    
  sed -i -e "
    
      s/@electronversion@/${_electronversion}/g
    
      s/@appname@/${pkgname}/g
    
      s/@runname@/app.asar/g
    
      s/@cfgdirname@/${_pkgname}/g
    
      s/@options@/env ELECTRON_OZONE_PLATFORM_HINT=auto/g
    
  " "${srcdir}/${pkgname}.sh"
    
  _get_electron_version
    
  _ensure_local_nvm
    
  gendesk -f -n -q \
    
      --pkgname="${pkgname}" \
    
      --pkgdesc="${pkgdesc}" \
    
      --categories="Utility" \
    
      --name="${_appname}" \
    
      --exec="${pkgname} %U"
    
  export CGO_ENABLED=1
    
  export GO111MODULE=on
    
  export GOOS=linux
    
  export GOCACHE="${srcdir}/go-build"
    
  export GOMODCACHE="${srcdir}/go/pkg/mod"
    
  export RUBY_ENV="production"
    
  export ELECTRON_SKIP_BINARY_DOWNLOAD=1
    
  export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/v//g')"
    
  local HOME="${srcdir}/.electron-gyp"
    
  export NPM_CONFIG_CACHE="${srcdir}/.npm_cache"
    
  export NPM_CONFIG_MAXSOCKETS=32
    
  if [[ "$(curl -s ipinfo.io/country)" == *"CN"* ]]; then
    
      # 设置Go代理
    
      export GOPROXY=https://goproxy.cn,direct
    
      # 设置Ruby使用国内镜像
    
      gem sources --add https://mirrors.tuna.tsinghua.edu.cn/rubygems/ --remove https://rubygems.org/
    
      bundle config mirror.https://rubygems.org https://mirrors.tuna.tsinghua.edu.cn/rubygems
    
      # 设置npm使用国内镜像
    
      export NPM_CONFIG_REGISTRY="https://registry.npmmirror.com"
    
export NPM_CONFIG_ELECTRON_MIRROR="https://registry.npmmirror.com/-/binary/electron/"
    
export NPM_CONFIG_ELECTRON_BUILDER_BINARIES_MIRROR="https://registry.npmmirror.com/-/binary/electron-builder-binaries/"
    
      find ./ -type f -name "package-lock.json" -exec sed -i "s/registry.npmjs.org/registry.npmmirror.com/g" {} +
    
  fi
    
  sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g" package.json
    
  sed -i "s/build\/icons.icns/build\/appicon.png/g" electron-builder.config.cjs
    
  sed -i -e "
    
      s/npm install/NODE_ENV=development npm install --include=optional/g
    
      /- task: build:server:macos/d
    
      /- task: build:server:windows/d
    
      s/ && npm exec electron-builder -- -c electron-builder.config.cjs -p never {{.CLI_ARGS}}//g
    
  " Taskfile.yml
    
  find emain -type f -exec sed -i "s/process.resourcesPath/\'\/usr\/lib\/${pkgname}\'/g" {} +
    
  gem install fpm
    
  NODE_ENV=development    npm add -D node-gyp sharp
    
  NODE_ENV=development    go-task init
    
      113}
    
      114build() {
    
  cd "${srcdir}/${pkgname}-${pkgver}"
    
  _ensure_local_nvm
    
  export ELECTRON_SKIP_BINARY_DOWNLOAD=1
    
  local electronDist="/usr/lib/electron${_electronversion}"
    
  NODE_ENV=production     go-task package
    
  NODE_ENV=production     npm exec -c "electron-builder --linux dir -c.electronDist=${electronDist} -c electron-builder.config.cjs"
    
      121}
    
      122package() {
    
  install -Dm755 "${srcdir}/${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
    
  install -Dm755 -d "${pkgdir}/usr/lib/${pkgname}"
    
  cp -a "${srcdir}/${pkgname}-${pkgver}/make/linux-"*"/resources/". "${pkgdir}/usr/lib/${pkgname}/"
    
  install -Dm644 "${srcdir}/${pkgname}-${pkgver}/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
    
  _icon_sizes=(16x16 32x32 128x128 256x256 512x512)
    
  for _icons in "${_icon_sizes[@]}";do
    
      install -Dm644 "${srcdir}/${pkgname}-${pkgver}/build/icons/${_icons}.png" \
    
          "${pkgdir}/usr/share/icons/hicolor/${_icons}/apps/${pkgname%-git}.png"
    
  done
    
      132}
    
      133

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	3
2026-09-16 00:03:17	Low	3
2026-09-15 00:25:31	Low	3
2026-09-14 00:27:57	Low	3
2026-09-13 00:19:54	Low	3
2026-09-12 00:25:17	Low	3
2026-09-11 00:19:22	Low	3
2026-09-10 00:22:44	Low	3
2026-09-09 00:04:09	Low	3
2026-09-08 00:18:08	Low	3
2026-09-07 00:30:15	Low	3
2026-09-06 00:17:06	Low	3
2026-09-05 00:16:27	Low	3
2026-09-04 00:03:13	Low	3
2026-09-03 00:15:47	Low	3
2026-09-02 00:02:31	Low	3
2026-09-01 00:11:19	Low	3
2026-08-31 00:19:57	Low	3
2026-08-30 00:04:14	Low	3
2026-08-29 00:29:17	Low	3