wiki2pdf-git

maintainer dreieck · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The source is a named GitHub repository (madajaju/wiki2pdf) cloned via git+https, which is a standard AUR pattern for -git packages. The SKIP checksum is expected for VCS sources. The 'npm install' in prepare() fetches dependencies declared in the upstream package.json from the npm registry (standard practice), and the npm cache is redirected to a local srcdir path. The flagged line 69 ('npm install -g ... $(npm pack . | tail -n1)') installs the locally-packed tarball of the project itself — not an external untrusted package — so the variable substitution is not a supply-chain risk. The main concerns are: (1) npm dependencies are fetched at build time without lockfile pinning, which is sloppy but common in AUR npm packages; (2) the upstream repo could be compromised, but this applies to any VCS source. There is no executed binary from an unofficial host, no obfuscation, and no piracy. This is standard -git AUR packaging with the usual npm dependency fetching pattern — low risk, not medium.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 82%): The source is a named GitHub repository (madajaju/wiki2pdf) cloned via git+https, which is a standard AUR pattern for -git packages. The SKIP checksum is expected for VCS sources. The 'npm install' in prepare() fetches dependencies declared in the upstream package.json from the npm registry (standard practice), and the npm cache is redirected to a local srcdir path. The flagged line 69 ('npm install -g ... $(npm pack . | tail -n1)') installs the locally-packed tarball of the project itself — not an external untrusted package — so the variable substitution is not a supply-chain risk. The main concerns are: (1) npm dependencies are fetched at build time without lockfile pinning, which is sloppy but common in AUR npm packages; (2) the upstream repo could be compromised, but this applies to any VCS source. There is no executed binary from an unofficial host, no obfuscation, and no piracy. This is standard -git AUR packaging with the usual npm dependency fetching pattern — low risk, not medium.

PKGBUILD:69 npm install -g --cache "${srcdir}/npm-cache" --prefix="${pkgdir}/usr" "$(npm pack . | tail -n1)"

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:69 npm install -g --cache "${srcdir}/npm-cache" --prefix="${pkgdir}/usr" "$(npm pack . | tail -n1)"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: dreieck
    
      2
    
      3_pkgname='wiki2pdf'
    
      4pkgname="${_pkgname}-git"
    
      5epoch=2
    
      6pkgver=1.0.5.r6.20171207.19e936a
    
      7pkgrel=3
    
      8pkgdesc='Github Wiki to pdf Converter allows you to generate HTML & PDF documentation from your Github wiki or any other markdown-based wiki.'
    
      9arch=('any')
    
      10url='https://github.com/madajaju/wiki2pdf'
    
      11license=('MIT')
    
      12depends=(
    
      13  'gcc-libs'
    
      14  'glibc'
    
      15  'nodejs'
    
      16  'libfontconfig.so'
    
      17  'libfreetype.so'
    
      18  'libz.so'
    
      19  'wkhtmltopdf'
    
      20)
    
      21makedepends=(
    
      22  'git'
    
      23  'jshon' # To get package version
    
      24  'npm'
    
      25)
    
      26provides=(
    
      27  "${_pkgname}=${pkgver}"
    
      28)
    
      29conflicts=(
    
      30  "${_pkgname}"
    
      31)
    
      32
    
      33source=(
    
      34  "${_pkgname}::git+https://github.com/madajaju/wiki2pdf.git"
    
      35)
    
      36sha256sums=(
    
      37  'SKIP'
    
      38)
    
      39
    
      40prepare() {
    
      41  cd "${srcdir}/${_pkgname}"
    
      42  msg2 "Installing npm modules ..."
    
      43  npm install --cache "${srcdir}/npm-cache"
    
      44}
    
      45
    
      46pkgver () {
    
      47  cd "${srcdir}/${_pkgname}"
    
      48  _ver="$(jshon -e version < package.json | tr -d '"')"
    
      49  _rev="$(git rev-list --count HEAD)"
    
      50  _date="$(git log -1 --date=format:"%Y%m%d" --format="%ad")"
    
      51  _hash="$(git rev-parse --short HEAD)"
    
      52
    
      53  if [ -z "${_ver}" ]; then
    
      54    error "Version could not be determined."
    
      55    return 1
    
      56  else
    
      57    printf '%s' "${_ver}.r${_rev}.${_date}.${_hash}"
    
      58  fi
    
      59}
    
      60
    
      61build() {
    
      62  cd "${srcdir}/${_pkgname}"
    
      63  npm run build
    
      64}
    
      65
    
      66package() {
    
      67  cd "${srcdir}/${_pkgname}"
    
      68
    
      69  npm install -g --cache "${srcdir}/npm-cache" --prefix="${pkgdir}/usr" "$(npm pack . | tail -n1)"
    
      70  chown -R root:root "${pkgdir}"/*
    
      71
    
      72  install -D -v -m644 README.md "${pkgdir}/usr/share/doc/${_pkgname}/README.md"
    
      73  install -D -v -m644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.MIT.txt"
    
      74}
    
      75

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2