wowup-native

LOW

maintainer cyano 1 votes scanned 2026-09-18 03:27:19.081861

View on AUR

Why flagged

The package installs a dependency named by a variable ($_electron), but it is a legitimate system Electron wrapper used for building, not an untrusted external package.

Triggered rules

Low AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it LOW (confidence 95%): The package installs a dependency named by a variable ($_electron), but it is a legitimate system Electron wrapper used for building, not an untrusted external package.

PKGBUILD:68 npm install electron@$_electronver <<<"N"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Cyano Hao <c@cyano.cn>
    
      2
    
      3_electron=electron39
    
      4_electronver=$(</usr/lib/$_electron/version)
    
      5
    
      6_pkgname=WowUp
    
      7pkgname=${_pkgname,,}-native
    
      8_pkgver=2.22.0
    
      9pkgver=${_pkgver/-/.}
    
      10pkgrel=1
    
      11pkgdesc='World of Warcraft addon updater (system Electron)'
    
      12arch=('x86_64')
    
      13
    
      14url='https://github.com/WowUp/WowUp'
    
      15license=('GPL3')
    
      16depends=(
    
      17    $_electron
    
      18)
    
      19makedepends=(
    
      20    'nodejs-lts-krypton' # may fail with latest nodejs, use lts
    
      21    'npm'
    
      22    'asar'
    
      23    'imagemagick'
    
      24)
    
      25source=(
    
      26    "$_pkgname-$_pkgver.tar.gz::$url/archive/v$_pkgver.tar.gz"
    
      27    aur-disable-updater.patch
    
      28    wago-fix.js
    
      29    wowup-native.desktop
    
      30    run_wowup-native.sh
    
      31)
    
      32sha256sums=('60724a35936c028a6711b613e441bbb0b13d3d7ae50d4628f29464648568fbe3'
    
      33            '6492656d15dc74254189767f92a3d6d73ee21d2de952ae8586a40330dc0b6ef3'
    
      34            '371d0e19917b031911ac5503e01e19170988230fb793f68e42eb15e4d1cfb97c'
    
      35            '76ebf12e022e15075a6a3824731a8288acbc6a4e1f69f6bd0fa3591d6f658656'
    
      36            '96b62f48ab60f289a375b93eef8ccbd67be818e1043f450da706894b2c958356')
    
      37
    
      38prepare() {
    
      39    # set correct electron path in launcher
    
      40    sed -i "s|/usr/bin/electron|/usr/bin/$_electron|" run_wowup-native.sh wowup-native.desktop
    
      41
    
      42    cd "$_pkgname-$_pkgver/"
    
      43
    
      44    # set legacy peer deps in .npmrc file to dependency conflict since npm 7
    
      45    echo "legacy-peer-deps=true" >>wowup-electron/.npmrc
    
      46
    
      47    # overwolf is impossible with system electron
    
      48    sed -i -E '/^\s*"@overwolf\// d' wowup-electron/package.json
    
      49    sed -i -E '/^\s*"postinstall":/ s/ow-electron-builder install-app-deps/true/' wowup-electron/package.json
    
      50
    
      51    # disable built-in updater (package manager handles it)
    
      52    patch --forward --strip=1 --input="${srcdir}/aur-disable-updater.patch"
    
      53
    
      54    # intergient.com refuse to provide service to users in some country/region
    
      55    # add a workaround that extracts the key manually
    
      56    cat "${srcdir}/wago-fix.js" >>wowup-electron/assets/preload/wago.js
    
      57}
    
      58
    
      59build() {
    
      60    cd "$srcdir/$_pkgname-$_pkgver/wowup-lib"
    
      61
    
      62    npm install
    
      63
    
      64    cd "$srcdir/$_pkgname-$_pkgver/wowup-electron"
    
      65
    
      66    # Angular may ask for sharing anonymous usage data during `npm install`.
    
      67    # Say “no” to it.
    
      68    npm install electron@$_electronver <<<"N"
    
      69
    
      70    # or use miorrors
    
      71    # export ELECTRON_MIRROR="https://npmmirror.com/mirrors/electron/"
    
      72    # npm --registry https://registry.npmmirror.com/ install electron@$_electronver <<<"N"
    
      73
    
      74    # electron-builder with `nodeGypRebuild=true` will fetch headers from electronjs.org,
    
      75    # which may lead to a 404 error. Explicitly call node-gyp-rebuild to avoid it.
    
      76    ./node_modules/.bin/electron-builder node-gyp-rebuild
    
      77
    
      78    npm run build:prod
    
      79    ./node_modules/.bin/electron-builder \
    
      80        --linux dir \
    
      81        -c electron-build/electron-builder.json \
    
      82        -c.nodeGypRebuild=false \
    
      83        -c.electronDist="/usr/lib/$_electron" \
    
      84        -c.electronVersion="$_electronver"
    
      85}
    
      86
    
      87package() {
    
      88    install -DTm755 run_wowup-native.sh "$pkgdir/usr/bin/$pkgname"
    
      89    install -Dm644 wowup-native.desktop -t "$pkgdir/usr/share/applications/"
    
      90
    
      91    _dest="$pkgdir/usr/lib/$pkgname"
    
      92    asar e "$srcdir/$_pkgname-$_pkgver/wowup-electron/release/linux-unpacked/resources/app.asar" "$_dest"
    
      93
    
      94    cd "$srcdir/$_pkgname-$_pkgver/wowup-electron/"
    
      95    install -Dm644 assets/wowup_logo_512np.png "$pkgdir/usr/share/icons/hicolor/512x512/apps/$pkgname.png"
    
      96    for size in 16 24 32 48 64 72 128 256; do
    
      97        target="$pkgdir/usr/share/icons/hicolor/${size}x${size}/apps"
    
      98        mkdir -p $target
    
      99        convert assets/wowup_logo_512np.png -resize ${size}x${size} "$target/$pkgname.png"
    
      100    done
    
      101}
    
      102

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-18 03:27:19	Low	1
2026-06-18 16:11:54	Clean	0