waveterm-git

LOW

maintainer zxp19821005 0 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The flagged npm and go-task usage installs development dependencies and builds the project from its own source; no untrusted remote code execution or supply-chain risks are present.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The flagged npm and go-task usage installs development dependencies and builds the project from its own source; no untrusted remote code execution or supply-chain risks are present.

2 higher static findings superseded - not the current verdict (shown for transparency)

Medium npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:104 s/npm install/NODE_ENV=development npm install --include=optional/g
PKGBUILD:111 npm add -D node-gyp sharp

Medium External install via pipx/uv/poetry/cargo/go/gem alt_pkg_manager_install

A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.

PKGBUILD:109 gem install fpm

PKGBUILD

3 offending line(s) highlighted

      1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
    
      2# Co-maintainer: Edu4rdSHL <edu4rdshl@protonmail.com>
    
      3pkgname=waveterm-git
    
      4_pkgname=Wave
    
      5pkgver=0.14.5.r42.ga4447c1
    
      6_electronversion=41
    
      7_nodeversion=22
    
      8pkgrel=1
    
      9pkgdesc="An open-source, cross-platform terminal for seamless workflows."
    
      10arch=('any')
    
      11url="https://www.waveterm.dev/"
    
      12_ghurl="https://github.com/wavetermdev/waveterm"
    
      13license=('Apache-2.0')
    
      14conflicts=("${pkgname%-git}")
    
      15provides=("${pkgname%-git}=${pkgver%.r}")
    
      16depends=(
    
  "electron${_electronversion}"
    
      18)
    
      19makedepends=(
    
  'gendesk'
    
  'npm'
    
  'git'
    
  'go'
    
  'ruby'
    
  'cmake'
    
  'zip'
    
  'nvm'
    
  'curl'
    
  'zig'
    
  'libarchive'
    
  'openjpeg2'
    
  'jq'
    
      33)
    
      34source=(
    
  "${pkgname//-/.}::git+${_ghurl}.git"
    
  "${pkgname%-git}.sh"
    
      37)
    
      38sha256sums=('SKIP'
    
          'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
    
      40pkgver() {
    
  cd "${srcdir}/${pkgname//-/.}"
    
  set -o pipefail
    
  git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
    
  printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
    
      45}
    
      46_ensure_local_nvm() {
    
  local NVM_DIR="${srcdir}/.nvm"
    
  source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
    
  nvm install "${_nodeversion}"
    
  nvm use "${_nodeversion}"
    
      51}
    
      52_get_app_dir() {
    
find "${srcdir}" -type d -name "node_modules" -prune -o -type f -name "resources.pak" -print0 | xargs -0 dirname | head -n 1
    
      54}
    
      55_get_electron_version() {
    
  _elec_ver=$(find "${srcdir}" -maxdepth 5 -name "package.json" ! -path "*/node_modules/*" \
    
      -exec grep -l '"electron"' {} + | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null | head -1)
    
  [[ -z "${_elec_ver}" ]] && return 1
    
  echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
    
      60}
    
      61_set_build_env() {
    
export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
    
export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
    
export ELECTRON_SKIP_BINARY_DOWNLOAD=1
    
export ELECTRON_BUILDER_OFFLINE=true
    
export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
    
export HOME="${srcdir}/.home"
    
export XDG_CACHE_HOME="${HOME}/.cache"
    
export XDG_CONFIG_HOME="${HOME}/.config"
    
export XDG_DATA_HOME="${HOME}/.local/share"
    
export npm_config_cache="${HOME}/.npm_cache"
    
export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
    
export COREPACK_HOME="${HOME}/.corepack"
    
export npm_config_audit=false
    
  export GOPATH="${HOME}/go"
    
export GOCACHE="${HOME}/go-build"
    
export GOENV="${HOME}/go/env"
    
export XDG_CONFIG_HOME="${HOME}/.config"
    
export XDG_CACHE_HOME="${HOME}/.cache"
    
export CGO_CPPFLAGS="${CPPFLAGS}"
    
export CGO_CFLAGS="${CFLAGS}"
    
export CGO_CXXFLAGS="${CXXFLAGS}"
    
export CGO_LDFLAGS="${LDFLAGS}"
    
export GOFLAGS="-buildmode=pie -trimpath -ldflags=-linkmode=external -mod=readonly -modcacherw"
    
export GOTOOLCHAIN=local
    
export GOWORK=off
    
mkdir -p "${HOME}" "${GOCACHE}" "${XDG_CONFIG_HOME}" "${XDG_CACHE_HOME}" "$(dirname "${GOENV}")" "${npm_config_cache}" "${COREPACK_HOME}"
    
: > "${GOENV}"
    
      89}
    
      90prepare() {
    
  cd "${srcdir}/${pkgname//-/.}"
    
  _get_electron_version
    
  sed -i -e "
    
      s/@electronversion@/${_electronversion}/g
    
      s/@appname@/${pkgname%-git}/g
    
      s/@runname@/app.asar/g
    
      s/@cfgdirname@/${_pkgname}/g
    
  " "${srcdir}/${pkgname%-git}.sh"
    
  _ensure_local_nvm
    
  _set_build_env
    
  sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g" package.json
    
  sed -i "s/build\/icons.icns/build\/appicon.png/g" electron-builder.config.cjs
    
  sed -i -e "
    
      s/npm install/NODE_ENV=development npm install --include=optional/g
    
      /- task: build:server:macos/d
    
      /- task: build:server:windows/d
    
      s/ && npm exec electron-builder -- -c electron-builder.config.cjs -p never {{.CLI_ARGS}}//g
    
  " Taskfile.yml
    
  gem install fpm
    
  export NODE_ENV=development
    
  npm add -D node-gyp sharp
    
  go-task init
    
      113}
    
      114build() {
    
  cd "${srcdir}/${pkgname//-/.}"
    
  _ensure_local_nvm
    
  _set_build_env
    
  export NODE_ENV=production
    
  go-task package
    
  npm exec -c "electron-builder --linux dir -c.electronDist=${ELECTRON_DIST} -c electron-builder.config.cjs"
    
      121}
    
      122package() {
    
  install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
    
  install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-git}"
    
local _app_dir=$(_get_app_dir)
    
cp -a "${_app_dir}/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"
    
  install -Dm644 "${srcdir}/${pkgname//-/.}/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
    
  _icon_sizes=(16x16 32x32 128x128 256x256 512x512)
    
  for _icons in "${_icon_sizes[@]}";do
    
      install -Dm644 "${srcdir}/${pkgname//-/.}/build/icons/${_icons}.png" \
    
          "${pkgdir}/usr/share/icons/hicolor/${_icons}/apps/${pkgname%-git}.png"
    
  done
    
      133}
    
      134

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	3
2026-10-31 00:07:41	Low	3
2026-10-30 00:29:30	Low	3
2026-10-29 00:13:55	Low	3
2026-10-28 00:06:54	Low	3
2026-10-27 00:23:28	Low	3
2026-10-26 00:12:40	Low	3
2026-10-25 00:20:48	Low	3
2026-10-24 00:14:55	Low	3
2026-10-23 00:02:19	Low	3
2026-10-22 00:13:10	Low	3
2026-10-21 00:12:50	Low	3
2026-10-20 00:10:31	Low	3
2026-10-19 00:03:55	Low	3
2026-10-18 00:06:55	Low	3
2026-10-17 00:21:55	Low	3
2026-10-16 00:12:47	Low	3
2026-10-15 00:28:05	Low	3
2026-10-14 00:06:47	Low	3
2026-10-13 00:23:45	Low	3