waveterm-git

maintainer zxp19821005 · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The flagged npm and gem installs are part of the build process for the project's own dependencies using sources from the cloned git repository, not external unreviewed code; the package builds from the project's official source and uses system-wide or vendor-mirrored tools safely.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The flagged npm and gem installs are part of the build process for the project's own dependencies using sources from the cloned git repository, not external unreviewed code; the package builds from the project's official source and uses system-wide or vendor-mirrored tools safely.

2 higher static findings superseded - not the current verdict (shown for transparency)

MEDIUM npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:101 s/npm install/NODE_ENV=development npm install --include=optional/g
PKGBUILD:107 NODE_ENV=development npm add -D node-gyp sharp

MEDIUM External install via pipx/uv/poetry/cargo/go/gem alt_pkg_manager_install

A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.

PKGBUILD:106 gem install fpm

PKGBUILD

3 offending line(s) highlighted

      1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
    
      2# Co-maintainer: Edu4rdSHL <edu4rdshl@protonmail.com>
    
      3pkgname=waveterm-git
    
      4_pkgname=Wave
    
      5pkgver=0.14.4.r1.g96c2526
    
      6_electronversion=41
    
      7_nodeversion=22
    
      8pkgrel=1
    
      9pkgdesc="An open-source, cross-platform terminal for seamless workflows.(Git version.Use system-wide electron)"
    
      10arch=('any')
    
      11url="https://www.waveterm.dev/"
    
      12_ghurl="https://github.com/wavetermdev/waveterm"
    
      13license=('Apache-2.0')
    
      14conflicts=("${pkgname%-git}")
    
      15provides=("${pkgname%-git}=${pkgver%.r}")
    
      16depends=(
    
  "electron${_electronversion}"
    
      18)
    
      19makedepends=(
    
  'gendesk'
    
  'npm'
    
  'git'
    
  'go'
    
  'ruby'
    
  'go-task'
    
  'cmake'
    
  'zip'
    
  'nvm'
    
  'curl'
    
  'zig'
    
  'libarchive'
    
  'openjpeg2'
    
  'jq'
    
      34)
    
      35source=(
    
  "${pkgname//-/.}::git+${_ghurl}.git"
    
  "${pkgname%-git}.sh"
    
      38)
    
      39sha256sums=('SKIP'
    
          '31ad33b633744f5361abd964be306cea53ae1050e760c787115f7eca60045ae6')
    
      41pkgver() {
    
  cd "${srcdir}/${pkgname//-/.}"
    
  set -o pipefail
    
  git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
    
  printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
    
      46}
    
      47_ensure_local_nvm() {
    
  local NVM_DIR="${srcdir}/.nvm"
    
  source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
    
  nvm install "${_nodeversion}"
    
  nvm use "${_nodeversion}"
    
      52}
    
      53_get_electron_version() {
    
  _elec_ver=$(jq -r '.devDependencies["electron"] // .dependencies["electron"]' "${srcdir}/${pkgname//-/.}/package.json" | tr -d '^')
    
  _main_ver=$(echo "${_elec_ver}" | cut -d. -f1)
    
  echo -e "The electron version is: \033[1;31m${_main_ver}\033[0m"
    
      57}
    
      58prepare() {
    
  cd "${srcdir}/${pkgname//-/.}"
    
  sed -i -e "
    
      s/@electronversion@/${_electronversion}/g
    
      s/@appname@/${pkgname%-git}/g
    
      s/@runname@/app.asar/g
    
      s/@cfgdirname@/${_pkgname}/g
    
      s/@options@/env ELECTRON_OZONE_PLATFORM_HINT=auto/g
    
  " "${srcdir}/${pkgname%-git}.sh"
    
  export CGO_ENABLED=1
    
  export GO111MODULE=on
    
  export GOOS=linux
    
  export GOCACHE="${srcdir}/go-build"
    
  export GOMODCACHE="${srcdir}/go/pkg/mod"
    
  export RUBY_ENV="production"
    
  export ELECTRON_SKIP_BINARY_DOWNLOAD=1
    
  export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/v//g')"
    
  HOME="${srcdir}/.electron-gyp"
    
  {
    
      echo -e '\n'
    
      #echo 'build_from_source=true'
    
      echo "cache=${srcdir}/.npm_cache"
    
      echo "maxsockets=32"
    
  } >> .npmrc
    
  if [[ "$(curl -s ipinfo.io/country)" == *"CN"* ]]; then
    
      # 设置Go代理
    
      export GOPROXY=https://goproxy.cn,direct
    
      # 设置Ruby使用国内镜像
    
      gem sources --add https://mirrors.tuna.tsinghua.edu.cn/rubygems/ --remove https://rubygems.org/
    
      bundle config mirror.https://rubygems.org https://mirrors.tuna.tsinghua.edu.cn/rubygems
    
      # 设置npm使用国内镜像
    
      {
    
          echo 'registry=https://registry.npmmirror.com'
    
          echo 'electron_mirror=https://registry.npmmirror.com/-/binary/electron/'
    
          echo 'electron_builder_binaries_mirror=https://registry.npmmirror.com/-/binary/electron-builder-binaries/'
    
      } >> .npmrc
    
      find ./ -type f -name "package-lock.json" -exec sed -i "s/registry.npmjs.org/registry.npmmirror.com/g" {} +
    
  fi
    
  _get_electron_version
    
  _ensure_local_nvm
    
  sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g" package.json
    
  sed -i "s/build\/icons.icns/build\/appicon.png/g" electron-builder.config.cjs
    
  sed -i -e "
    
      s/npm install/NODE_ENV=development npm install --include=optional/g
    
      /- task: build:server:macos/d
    
      /- task: build:server:windows/d
    
      s/ && npm exec electron-builder -- -c electron-builder.config.cjs -p never {{.CLI_ARGS}}//g
    
  " Taskfile.yml
    
  gem install fpm
    
  NODE_ENV=development    npm add -D node-gyp sharp
    
  NODE_ENV=development    go-task init
    
      109}
    
      110build() {
    
  cd "${srcdir}/${pkgname//-/.}"
    
  _ensure_local_nvm
    
  local electronDist="/usr/lib/electron${_electronversion}"
    
  NODE_ENV=production     go-task package
    
  NODE_ENV=production     npm exec -c "electron-builder --linux dir -c.electronDist=${electronDist} -c electron-builder.config.cjs"
    
      116}
    
      117package() {
    
  install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
    
  install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-git}"
    
find "${srcdir}/${pkgname//-/.}/make/linux-"*"/resources" -maxdepth 1 -type f -exec install -Dm644 -t "${pkgdir}/usr/lib/${pkgname%-git}" {} +
    
  if find "${srcdir}/${pkgname//-/.}/make/linux-"*"/resources" -mindepth 1 -maxdepth 1 -type d | read; then
    
      for _subdir in "${srcdir}/${pkgname//-/.}/make/linux-"*"/resources/"*; do
    
          if [ -d "${_subdir}" ]; then
    
              cp -Pr --no-preserve=ownership "${_subdir}" "${pkgdir}/usr/lib/${pkgname%-git}"
    
          fi
    
      done
    
  fi
    
  install -Dm644 "${srcdir}/${pkgname//-/.}/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
    
  _icon_sizes=(16x16 32x32 128x128 256x256 512x512)
    
  for _icons in "${_icon_sizes[@]}";do
    
      install -Dm644 "${srcdir}/${pkgname//-/.}/build/icons/${_icons}.png" \
    
          "${pkgdir}/usr/share/icons/hicolor/${_icons}/apps/${pkgname%-git}.png"
    
  done
    
      134}
    
      135

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	3
2026-08-02 00:16:08	LOW	3
2026-08-01 00:11:18	LOW	3
2026-07-31 00:14:10	LOW	3
2026-07-30 00:17:23	LOW	3
2026-07-29 00:25:53	LOW	3
2026-07-28 00:07:28	LOW	3
2026-07-27 00:24:32	LOW	3
2026-07-26 00:07:32	LOW	3
2026-07-25 00:13:44	LOW	3
2026-07-24 00:02:28	LOW	3
2026-07-23 00:14:47	LOW	3
2026-07-22 00:29:32	LOW	3
2026-07-21 00:24:15	LOW	3
2026-07-20 00:19:49	LOW	3
2026-07-19 00:17:08	LOW	3
2026-07-18 00:14:48	LOW	3
2026-07-17 00:06:16	LOW	3
2026-07-16 00:05:41	LOW	3
2026-07-15 00:09:25	LOW	3