waveterm-git

LOW
maintainer zxp19821005 0 votes scanned 2026-09-17 00:27:14.276658
View on AUR
Why flagged

The flagged npm and gem installs are part of the build process for the project's own dependencies using sources from the cloned git repository, not external unreviewed code; the package builds from the project's official source and uses system-wide or vendor-mirrored tools safely.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The flagged npm and gem installs are part of the build process for the project's own dependencies using sources from the cloned git repository, not external unreviewed code; the package builds from the project's official source and uses system-wide or vendor-mirrored tools safely.

2 higher static findings superseded - not the current verdict (shown for transparency)
Medium npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

  • PKGBUILD:101 s/npm install/NODE_ENV=development npm install --include=optional/g
  • PKGBUILD:107 NODE_ENV=development npm add -D node-gyp sharp
Medium External install via pipx/uv/poetry/cargo/go/gem alt_pkg_manager_install

A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.

  • PKGBUILD:106 gem install fpm

PKGBUILD

3 offending line(s) highlighted
1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2# Co-maintainer: Edu4rdSHL <edu4rdshl@protonmail.com>
3pkgname=waveterm-git
4_pkgname=Wave
5pkgver=0.14.4.r1.g96c2526
6_electronversion=41
7_nodeversion=22
8pkgrel=1
9pkgdesc="An open-source, cross-platform terminal for seamless workflows.(Git version.Use system-wide electron)"
10arch=('any')
11url="https://www.waveterm.dev/"
12_ghurl="https://github.com/wavetermdev/waveterm"
13license=('Apache-2.0')
14conflicts=("${pkgname%-git}")
15provides=("${pkgname%-git}=${pkgver%.r}")
16depends=(
17 "electron${_electronversion}"
18)
19makedepends=(
20 'gendesk'
21 'npm'
22 'git'
23 'go'
24 'ruby'
25 'go-task'
26 'cmake'
27 'zip'
28 'nvm'
29 'curl'
30 'zig'
31 'libarchive'
32 'openjpeg2'
33 'jq'
34)
35source=(
36 "${pkgname//-/.}::git+${_ghurl}.git"
37 "${pkgname%-git}.sh"
38)
39sha256sums=('SKIP'
40 '31ad33b633744f5361abd964be306cea53ae1050e760c787115f7eca60045ae6')
41pkgver() {
42 cd "${srcdir}/${pkgname//-/.}"
43 set -o pipefail
44 git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
45 printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
46}
47_ensure_local_nvm() {
48 local NVM_DIR="${srcdir}/.nvm"
49 source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
50 nvm install "${_nodeversion}"
51 nvm use "${_nodeversion}"
52}
53_get_electron_version() {
54 _elec_ver=$(jq -r '.devDependencies["electron"] // .dependencies["electron"]' "${srcdir}/${pkgname//-/.}/package.json" | tr -d '^')
55 _main_ver=$(echo "${_elec_ver}" | cut -d. -f1)
56 echo -e "The electron version is: \033[1;31m${_main_ver}\033[0m"
57}
58prepare() {
59 cd "${srcdir}/${pkgname//-/.}"
60 sed -i -e "
61 s/@electronversion@/${_electronversion}/g
62 s/@appname@/${pkgname%-git}/g
63 s/@runname@/app.asar/g
64 s/@cfgdirname@/${_pkgname}/g
65 s/@options@/env ELECTRON_OZONE_PLATFORM_HINT=auto/g
66 " "${srcdir}/${pkgname%-git}.sh"
67 export CGO_ENABLED=1
68 export GO111MODULE=on
69 export GOOS=linux
70 export GOCACHE="${srcdir}/go-build"
71 export GOMODCACHE="${srcdir}/go/pkg/mod"
72 export RUBY_ENV="production"
73 export ELECTRON_SKIP_BINARY_DOWNLOAD=1
74 export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/v//g')"
75 HOME="${srcdir}/.electron-gyp"
76 {
77 echo -e '\n'
78 #echo 'build_from_source=true'
79 echo "cache=${srcdir}/.npm_cache"
80 echo "maxsockets=32"
81 } >> .npmrc
82 if [[ "$(curl -s ipinfo.io/country)" == *"CN"* ]]; then
83 # 设置Go代理
84 export GOPROXY=https://goproxy.cn,direct
85 # 设置Ruby使用国内镜像
86 gem sources --add https://mirrors.tuna.tsinghua.edu.cn/rubygems/ --remove https://rubygems.org/
87 bundle config mirror.https://rubygems.org https://mirrors.tuna.tsinghua.edu.cn/rubygems
88 # 设置npm使用国内镜像
89 {
90 echo 'registry=https://registry.npmmirror.com'
91 echo 'electron_mirror=https://registry.npmmirror.com/-/binary/electron/'
92 echo 'electron_builder_binaries_mirror=https://registry.npmmirror.com/-/binary/electron-builder-binaries/'
93 } >> .npmrc
94 find ./ -type f -name "package-lock.json" -exec sed -i "s/registry.npmjs.org/registry.npmmirror.com/g" {} +
95 fi
96 _get_electron_version
97 _ensure_local_nvm
98 sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g" package.json
99 sed -i "s/build\/icons.icns/build\/appicon.png/g" electron-builder.config.cjs
100 sed -i -e "
101 s/npm install/NODE_ENV=development npm install --include=optional/g
102 /- task: build:server:macos/d
103 /- task: build:server:windows/d
104 s/ && npm exec electron-builder -- -c electron-builder.config.cjs -p never {{.CLI_ARGS}}//g
105 " Taskfile.yml
106 gem install fpm
107 NODE_ENV=development npm add -D node-gyp sharp
108 NODE_ENV=development go-task init
109}
110build() {
111 cd "${srcdir}/${pkgname//-/.}"
112 _ensure_local_nvm
113 local electronDist="/usr/lib/electron${_electronversion}"
114 NODE_ENV=production go-task package
115 NODE_ENV=production npm exec -c "electron-builder --linux dir -c.electronDist=${electronDist} -c electron-builder.config.cjs"
116}
117package() {
118 install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
119 install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-git}"
120 find "${srcdir}/${pkgname//-/.}/make/linux-"*"/resources" -maxdepth 1 -type f -exec install -Dm644 -t "${pkgdir}/usr/lib/${pkgname%-git}" {} +
121 if find "${srcdir}/${pkgname//-/.}/make/linux-"*"/resources" -mindepth 1 -maxdepth 1 -type d | read; then
122 for _subdir in "${srcdir}/${pkgname//-/.}/make/linux-"*"/resources/"*; do
123 if [ -d "${_subdir}" ]; then
124 cp -Pr --no-preserve=ownership "${_subdir}" "${pkgdir}/usr/lib/${pkgname%-git}"
125 fi
126 done
127 fi
128 install -Dm644 "${srcdir}/${pkgname//-/.}/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
129 _icon_sizes=(16x16 32x32 128x128 256x256 512x512)
130 for _icons in "${_icon_sizes[@]}";do
131 install -Dm644 "${srcdir}/${pkgname//-/.}/build/icons/${_icons}.png" \
132 "${pkgdir}/usr/share/icons/hicolor/${_icons}/apps/${pkgname%-git}.png"
133 done
134}
135

Scan history

Scanned at (UTC)SeverityRules
2026-09-17 00:27:14 Low 3
2026-09-16 00:03:17 Low 3
2026-09-15 00:25:31 Low 3
2026-09-14 00:27:57 Low 3
2026-09-13 00:19:54 Low 3
2026-09-12 00:25:17 Low 3
2026-09-11 00:19:22 Low 3
2026-09-10 00:22:44 Low 3
2026-09-09 00:04:09 Low 3
2026-09-08 00:18:08 Low 3
2026-09-07 00:30:15 Low 3
2026-09-06 00:17:06 Low 3
2026-09-05 00:16:27 Low 3
2026-09-04 00:03:13 Low 3
2026-09-03 00:15:47 Low 3
2026-09-02 00:02:31 Low 3
2026-09-01 00:11:19 Low 3
2026-08-31 00:19:57 Low 3
2026-08-30 00:04:14 Low 3
2026-08-29 00:29:17 Low 3

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion