wealthfolio-git
LOW
maintainer jaytau
0 votes
scanned 2026-10-17 00:21:55.226236
Why flagged
Package builds from the project's own GitHub repository, uses pinned tool versions via mise, and downloads no external binaries; the low severity is due to few votes and recent upload, not code risk.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Low
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 90%): Package builds from the project's own GitHub repository, uses pinned tool versions via mise, and downloads no external binaries; the low severity is due to few votes and recent upload, not code risk.
PKGBUILD
1
# Maintainer: Joel Tony <github at jaytau dot com>
2
3
pkgname=wealthfolio-git
4
_pkgname=Wealthfolio
5
pkgver=3.9.2.r4698.g5a6f99684
6
pkgrel=1
7
pkgdesc="A beautiful, private, local-first personal finance tracker (main branch)"
8
arch=('x86_64')
9
url="https://wealthfolio.app/"
10
license=('AGPL-3.0-only')
11
depends=('bzip2' 'cairo' 'dbus' 'gdk-pixbuf2' 'glib2' 'glibc' 'gtk3' 'hicolor-icon-theme'
12
'libgcc' 'libsoup3' 'webkit2gtk-4.1' 'xz')
13
makedepends=('cargo' 'git' 'mise')
14
optdepends=('org.freedesktop.secrets: secure storage for credentials and database keys')
15
provides=('wealthfolio')
16
conflicts=('wealthfolio' 'wealthfolio-bin')
17
options=('!lto' '!debug')
18
source=("wealthfolio::git+https://github.com/wealthfolio/wealthfolio.git#branch=main")
19
sha256sums=('SKIP')
20
21
_appver() {
22
sed -n 's/^ "version": "\([^"]*\)".*/\1/p' apps/tauri/tauri.conf.json
23
}
24
25
pkgver() {
26
cd wealthfolio
27
local ver
28
ver=$(_appver)
29
[[ $ver ]] || { error "Can't read the app version"; return 1; }
30
# pkgver can't hold hyphens; "pre" sorts before the release (3.0.0-beta.1).
31
[[ $ver != *-* ]] || ver="${ver%%-*}pre"
32
printf '%s.r%s.g%s' "$ver" "$(git rev-list --count HEAD)" "$(git rev-parse --short=9 HEAD)"
33
}
34
35
build() {
36
cd wealthfolio
37
# Use the Node and pnpm versions the repo pins. With rustup, cargo also
38
# follows rust-toolchain.toml.
39
local node pnpm
40
node=$(<.node-version)
41
pnpm=$(sed -n 's/.*"packageManager": *"pnpm@\([^"+]*\).*/\1/p' package.json)
42
[[ $node && $pnpm ]] || { error "Can't read the Node or pnpm version"; return 1; }
43
mise install "node@$node" "pnpm@$pnpm"
44
local tool_paths
45
tool_paths=$(mise bin-paths "node@$node" "pnpm@$pnpm")
46
[[ $tool_paths ]] || { error "Can't find the pinned Node and pnpm"; return 1; }
47
PATH="${tool_paths//$'\n'/:}:$PATH"
48
49
# Connect needs the public auth settings upstream documents for source builds.
50
export CONNECT_AUTH_URL CONNECT_AUTH_PUBLISHABLE_KEY
51
CONNECT_AUTH_URL=$(sed -n 's/^CONNECT_AUTH_URL=//p' docs/connect-source-builds.md)
52
CONNECT_AUTH_PUBLISHABLE_KEY=$(sed -n 's/^CONNECT_AUTH_PUBLISHABLE_KEY=//p' docs/connect-source-builds.md)
53
[[ $CONNECT_AUTH_URL && $CONNECT_AUTH_PUBLISHABLE_KEY ]] ||
54
{ error "Can't read the Connect settings"; return 1; }
55
56
pnpm install --frozen-lockfile
57
pnpm build:types
58
# pacman manages updates: the in-app updater would install a .deb with dpkg,
59
# so give it no update feed. Its artifacts also need a signing key.
60
pnpm tauri build --bundles deb \
61
--config '{"bundle":{"createUpdaterArtifacts":false},"plugins":{"updater":{"endpoints":[]}}}' \
62
-- --locked
63
}
64
65
package() {
66
cd wealthfolio
67
# Bundle names carry only the app version, so pick this build's by name.
68
local deb="target/release/bundle/deb/${_pkgname}_$(_appver)_amd64.deb"
69
rm -rf "${srcdir}/deb"
70
mkdir "${srcdir}/deb"
71
cd "${srcdir}/deb"
72
bsdtar -xf "${srcdir}/wealthfolio/${deb}" 'data.tar.*'
73
bsdtar -xf data.tar.*
74
75
# Lowercase names match wealthfolio-bin, so desktop shortcuts keep working.
76
install -Dm755 "usr/bin/${_pkgname}" "${pkgdir}/usr/bin/wealthfolio"
77
78
sed -e "s/^Exec=${_pkgname}/Exec=wealthfolio/" -e "s/^Icon=${_pkgname}/Icon=wealthfolio/" \
79
"usr/share/applications/${_pkgname}.desktop" > wealthfolio.desktop
80
install -Dm644 wealthfolio.desktop "${pkgdir}/usr/share/applications/wealthfolio.desktop"
81
82
local icon
83
for icon in usr/share/icons/hicolor/*/apps/"${_pkgname}".png; do
84
install -Dm644 "$icon" "${pkgdir}/${icon%/*}/wealthfolio.png"
85
done
86
}
87
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |
| 2026-10-14 00:06:47 | Low | 2 |
| 2026-10-13 21:18:20 | Low | 2 |