wubi-dict-editor

LOW
maintainer zxp19821005 0 votes scanned 2026-10-26 07:44:04.928873
View on AUR
Why flagged

The package builds from a legitimate project source and uses standard development tools; the variable package installation via yarn is part of normal build workflow with no evidence of malicious intent or supply-chain redirection.

Triggered rules

Low AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it LOW (confidence 95%): The package builds from a legitimate project source and uses standard development tools; the variable package installation via yarn is part of normal build workflow with no evidence of malicious intent or supply-chain redirection.

  • PKGBUILD:97 npm install -g "@yarnpkg/cli-dist@${_yarnver}" --prefix "${_yarnhome}" --registry "${npm_config_registry}"

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2pkgname=wubi-dict-editor
3_zhname='五笔码表助手'
4pkgver=1.5.2
5_electronversion=28
6_nodeversion=20
7pkgrel=1
8pkgdesc="Five Pen Watch Assistant for Rime.五笔码表助手 for Rime."
9arch=('x86_64')
10url="https://github.com/KyleBing/wubi-dict-editor"
11license=('GPL-3.0-only')
12conflicts=("${pkgname}")
13depends=(
14 "electron${_electronversion}"
15)
16makedepends=(
17 'npm'
18 'yarn'
19 'nvm'
20 'gendesk'
21 'libicns'
22 'git'
23 'jq'
24 'zip'
25)
26optdepends=(
27 'ibus-rime: Rime input method framework for IBus'
28 'fcitx5-rime: Rime input method framework for Fcitx5'
29)
30options=(
31 '!emptydirs'
32)
33source=(
34 "${pkgname}-${pkgver}.tar.gz::${url}/archive/refs/tags/v${pkgver}.tar.gz"
35 "${pkgname}.sh"
36)
37sha256sums=('6e288bc6392c020d47cccac7faae36cb74eaa1b463a73a176f315bfc2f5201d7'
38 '983ddfde8e06d067be65dd41ccc555f4da0a635358eac915c40863d0782206c7')
39_get_project_dir() {
40 local d
41 while IFS= read -r d; do
42 find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
43 done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
44}
45_ensure_local_nvm() {
46 local NVM_DIR="${srcdir}/.nvm"
47 source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
48 nvm install "${_nodeversion}"
49 nvm use "${_nodeversion}"
50}
51_get_app_dir() {
52 find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -printf '%h\n' 2>/dev/null \
53 | while read -r d; do [[ -d "${d}/resources" ]] && { echo "$d"; return 0; }; done
54}
55_get_electron_version() {
56 _elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
57 | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
58 | grep -oE '[0-9]+' | head -1)
59 [[ -z "${_elec_ver}" ]] && return 1
60 (( _elec_ver == _electronversion )) && c=32 || c=31
61 echo -e "Electron version: \033[1;${c}m${_elec_ver}$([[ $c -eq 31 ]] && echo " (expected ${_electronversion})")\033[0m"
62}
63_set_build_env() {
64 export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
65 export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
66 export ELECTRON_SKIP_BINARY_DOWNLOAD=1
67 export ELECTRON_BUILDER_OFFLINE=true
68 export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
69 export HOME="${srcdir}/.home"
70 export XDG_CACHE_HOME="${HOME}/.cache"
71 export XDG_CONFIG_HOME="${HOME}/.config"
72 export XDG_DATA_HOME="${HOME}/.local/share"
73 export YARN_CACHE_FOLDER="${HOME}/.yarn/cache"
74 export YARN_NETWORK_CONCURRENCY=32
75 export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
76 export COREPACK_HOME="${HOME}/.corepack"
77 export npm_config_registry="${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}"
78 local _yarnver _yarnmajor=0
79 _yarnver="$(node -p "try { require('./package.json').packageManager?.split('@')[1]?.split('-')[0] || '' } catch { '' }" 2>/dev/null || true)"
80 _yarnmajor="${_yarnver%%.*}"
81 _yarnmajor="${_yarnmajor:-0}"
82 if [[ "${_yarnmajor}" -ge 2 ]] 2>/dev/null || [[ -f .yarnrc.yml ]]; then
83 export XDG_STATE_HOME="${HOME}/.local/state"
84 export YARN_ENABLE_GLOBAL_CACHE=false
85 export YARN_ENABLE_MIRROR=false
86 export YARN_GLOBAL_FOLDER="${HOME}/.yarn/berry"
87 export YARN_NODE_LINKER=node-modules
88 export YARN_NM_MODE=hardlinks-local
89 export YARN_ENABLE_TELEMETRY=false
90 export YARN_ENABLE_SCRIPTS=true
91 export YARN_HTTP_TIMEOUT=600000
92 export YARN_HTTP_RETRY=5
93 export YARN_NPM_REGISTRY_SERVER="${YARN_NPM_REGISTRY_SERVER:-${NPM_CONFIG_REGISTRY:-https://registry.yarnpkg.com}}"
94 local _yarnhome="${HOME}/.yarn/install"
95 mkdir -p "${HOME}" "${YARN_CACHE_FOLDER}" "${YARN_GLOBAL_FOLDER}" "${COREPACK_HOME}" "${_yarnhome}"
96 if [[ -n "${_yarnver}" ]]; then
97 npm install -g "@yarnpkg/cli-dist@${_yarnver}" --prefix "${_yarnhome}" --registry "${npm_config_registry}"
98 export PATH="${_yarnhome}/bin:${PATH}"
99 fi
100 else
101 export YARN_GLOBAL_FOLDER="${HOME}/.yarn/global"
102 export YARN_LINK_FOLDER="${HOME}/.yarn/link"
103 export YARN_TEMP_FOLDER="${HOME}/.yarn/tmp"
104 export YARN_NETWORK_TIMEOUT=600000
105 export YARN_CHILD_CONCURRENCY="$(nproc)"
106 export YARN_FROZEN_LOCKFILE=true
107 export YARN_IGNORE_ENGINES=true
108 export YARN_PRODUCTION=false
109 mkdir -p "${HOME}" "${YARN_CACHE_FOLDER}" "${YARN_GLOBAL_FOLDER}" "${YARN_LINK_FOLDER}" "${YARN_TEMP_FOLDER}" "${COREPACK_HOME}"
110 fi
111 local _reg="${NPM_CONFIG_REGISTRY:-https://registry.yarnpkg.com}"
112 export YARN_REGISTRY="${_reg}"
113 _reg="${_reg%/}"
114 if [[ -f .yarnrc ]]; then
115 sed -i "s|^registry .*|registry \"${_reg}\"|" .yarnrc
116 fi
117 if [[ -f yarn.lock ]] && grep -q 'resolved "https://registry.yarnpkg.com' yarn.lock; then
118 sed -i "s|https://registry.yarnpkg.com/|${_reg}/|g" yarn.lock
119 fi
120}
121_use_local_electron_for_forge() {
122 local _arch=$([[ "${CARCH}" == "aarch64" ]] && echo arm64 || [[ "${CARCH}" == "armv7h" ]] && echo armv7l || echo x64)
123 local _zd="${srcdir}/electron-zips"
124 local _zf="${_zd}/electron-v${SYSTEM_ELECTRON_VERSION}-linux-${_arch}.zip"
125 mkdir -p "${_zd}"
126 rm -f "${_zf}"
127 ( cd "${ELECTRON_DIST}" && find . \( -type f -o -type l \) -readable -print | zip -@ -0 -q -y "${_zf}" )
128 [[ -s "${_zf}" ]] || { echo "ERROR: Failed to generate electron zip (directory not readable?)"; return 1; }
129 find . -name "forge.config.*" ! -path "*/node_modules/*" -print0 | while IFS= read -r -d '' _cfg; do
130 sed -i "/packagerConfig:[[:space:]]*{/a\\ electronZipDir: '${_zd}'," "${_cfg}"
131 done
132}
133prepare() {
134 cd "$(_get_project_dir)"
135 _get_electron_version
136 sed -i -e "
137 s/@electronversion@/${_electronversion}/g
138 s/@appname@/${pkgname}/g
139 " "${srcdir}/${pkgname}.sh"
140 gendesk -q -f -n \
141 --pkgname="${pkgname}" \
142 --pkgdesc="${pkgdesc}" \
143 --categories="Utility" \
144 --name="${pkgname}" \
145 --genericname="${_zhname} for Rime" \
146 --exec="${pkgname} %U" \
147 --custom="Name[zh_CN]=${_zhname}"
148 _ensure_local_nvm
149 _set_build_env
150 icns2png -d 32 -x assets/img/appIcon/appIcon.icns -o assets/img/appIcon/
151 cp assets/img/appIcon/appIcon_16x16x32.png assets/img/appIcon/appicon.png
152 jq --arg ver "${SYSTEM_ELECTRON_VERSION}" '.devDependencies.electron = $ver' package.json > package.json.tmp && mv package.json.tmp package.json
153 rm -rf package-lock.json yarn.lock
154 export NODE_ENV=development
155 yarn install
156 _use_local_electron_for_forge
157}
158build() {
159 cd "$(_get_project_dir)"
160 _ensure_local_nvm
161 _set_build_env
162 export NODE_ENV=production
163 yarn run package
164 rm -rf "$(_get_app_dir)/resources/default_app.asar"
165}
166package() {
167 install -Dm755 "${srcdir}/${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
168 install -Dm755 -d "${pkgdir}/usr/lib/${pkgname}"
169 cp -a "$(_get_app_dir)/resources/." "${pkgdir}/usr/lib/${pkgname}/"
170 _icon_sizes=(16x16 32x32 256x256 512x512 1024x1024)
171 for _icons in "${_icon_sizes[@]}";do
172 install -Dm644 "$(_get_project_dir)/assets/img/appIcon/appIcon_${_icons}x32.png" \
173 "${pkgdir}/usr/share/icons/hicolor/${_icons}/app/${pkgname}.png"
174 done
175 install -Dm644 "$(_get_project_dir)/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
176 install -Dm644 "$(_get_project_dir)/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
177}
178

Changes since previous scan

--- PKGBUILD @ 2026-10-05 23:40
+++ PKGBUILD @ 2026-10-26 07:44
@@ -1,7 +1,7 @@
# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
pkgname=wubi-dict-editor
_zhname='五笔码表助手'
-pkgver=1.4.3
+pkgver=1.5.2
_electronversion=28
_nodeversion=20
pkgrel=1
@@ -31,32 +31,34 @@
'!emptydirs'
)
source=(
- "${pkgname}-${pkgver}::git+${url}#tag=v${pkgver}"
+ "${pkgname}-${pkgver}.tar.gz::${url}/archive/refs/tags/v${pkgver}.tar.gz"
"${pkgname}.sh"
)
-sha256sums=('b25c01fa9c1fa71ce1a52efcefdb33511c573f431365c5c02991ecf850587856'
- 'bd5358d8f323d3c2c2f0733364ee4ea55f551dd86ba0be2a76846210b60897fc')
-_ensure_local_nvm() {
- local NVM_DIR="${srcdir}/.nvm"
- source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
- nvm install "${_nodeversion}"
- nvm use "${_nodeversion}"
-}
+sha256sums=('6e288bc6392c020d47cccac7faae36cb74eaa1b463a73a176f315bfc2f5201d7'
+ '983ddfde8e06d067be65dd41ccc555f4da0a635358eac915c40863d0782206c7')
_get_project_dir() {
local d
while IFS= read -r d; do
find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
}
+_ensure_local_nvm() {
+ local NVM_DIR="${srcdir}/.nvm"
+ source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
+ nvm install "${_nodeversion}"
+ nvm use "${_nodeversion}"
+}
_get_app_dir() {
- find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1
+ find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -printf '%h\n' 2>/dev/null \
+ | while read -r d; do [[ -d "${d}/resources" ]] && { echo "$d"; return 0; }; done
}
_get_electron_version() {
_elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
| xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
- | grep -v '^$' | sed 's/^[^0-9]*//' | head -1)
+ | grep -oE '[0-9]+' | head -1)
[[ -z "${_elec_ver}" ]] && return 1
- echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
+ (( _elec_ver == _electronversion )) && c=32 || c=31
+ echo -e "Electron version: \033[1;${c}m${_elec_ver}$([[ $c -eq 31 ]] && echo " (expected ${_electronversion})")\033[0m"
}
_set_build_env() {
export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
@@ -74,7 +76,7 @@
export COREPACK_HOME="${HOME}/.corepack"
export npm_config_registry="${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}"
local _yarnver _yarnmajor=0
- _yarnver="$(node -p "require('./package.json').packageManager?.split('@')[1]?.split('-')[0] || ''" 2>/dev/null)"
+ _yarnver="$(node -p "try { require('./package.json').packageManager?.split('@')[1]?.split('-')[0] || '' } catch { '' }" 2>/dev/null || true)"
_yarnmajor="${_yarnver%%.*}"
_yarnmajor="${_yarnmajor:-0}"
if [[ "${_yarnmajor}" -ge 2 ]] 2>/dev/null || [[ -f .yarnrc.yml ]]; then
@@ -89,7 +91,12 @@
export YARN_HTTP_TIMEOUT=600000
export YARN_HTTP_RETRY=5
export YARN_NPM_REGISTRY_SERVER="${YARN_NPM_REGISTRY_SERVER:-${NPM_CONFIG_REGISTRY:-https://registry.yarnpkg.com}}"
- mkdir -p "${HOME}" "${YARN_CACHE_FOLDER}" "${YARN_GLOBAL_FOLDER}" "${COREPACK_HOME}"
+ local _yarnhome="${HOME}/.yarn/install"
+ mkdir -p "${HOME}" "${YARN_CACHE_FOLDER}" "${YARN_GLOBAL_FOLDER}" "${COREPACK_HOME}" "${_yarnhome}"
+ if [[ -n "${_yarnver}" ]]; then
+ npm install -g "@yarnpkg/cli-dist@${_yarnver}" --prefix "${_yarnhome}" --registry "${npm_config_registry}"
+ export PATH="${_yarnhome}/bin:${PATH}"
+ fi
else
export YARN_GLOBAL_FOLDER="${HOME}/.yarn/global"
export YARN_LINK_FOLDER="${HOME}/.yarn/link"
@@ -102,6 +109,7 @@
mkdir -p "${HOME}" "${YARN_CACHE_FOLDER}" "${YARN_GLOBAL_FOLDER}" "${YARN_LINK_FOLDER}" "${YARN_TEMP_FOLDER}" "${COREPACK_HOME}"
fi
local _reg="${NPM_CONFIG_REGISTRY:-https://registry.yarnpkg.com}"
+ export YARN_REGISTRY="${_reg}"
_reg="${_reg%/}"
if [[ -f .yarnrc ]]; then
sed -i "s|^registry .*|registry \"${_reg}\"|" .yarnrc
@@ -111,15 +119,13 @@
fi
}
_use_local_electron_for_forge() {
- local _v="${SYSTEM_ELECTRON_VERSION}"
+ local _arch=$([[ "${CARCH}" == "aarch64" ]] && echo arm64 || [[ "${CARCH}" == "armv7h" ]] && echo armv7l || echo x64)
local _zd="${srcdir}/electron-zips"
- case "${CARCH}" in
- aarch64) _arch=arm64 ;;
- x86_64) _arch=x64 ;;
- esac
- local _zf="${_zd}/electron-v${_v}-linux-${_arch}.zip"
- install -Dm755 -d "${_zd}"
- ( cd "${ELECTRON_DIST}" && zip -r -q -0 "${_zf}" . )
+ local _zf="${_zd}/electron-v${SYSTEM_ELECTRON_VERSION}-linux-${_arch}.zip"
+ mkdir -p "${_zd}"
+ rm -f "${_zf}"
+ ( cd "${ELECTRON_DIST}" && find . \( -type f -o -type l \) -readable -print | zip -@ -0 -q -y "${_zf}" )
+ [[ -s "${_zf}" ]] || { echo "ERROR: Failed to generate electron zip (directory not readable?)"; return 1; }
find . -name "forge.config.*" ! -path "*/node_modules/*" -print0 | while IFS= read -r -d '' _cfg; do
sed -i "/packagerConfig:[[:space:]]*{/a\\ electronZipDir: '${_zd}'," "${_cfg}"
done
@@ -130,8 +136,6 @@
sed -i -e "
s/@electronversion@/${_electronversion}/g
s/@appname@/${pkgname}/g
- s/@runname@/app/g
- s/@cfgdirname@/${pkgname}/g
" "${srcdir}/${pkgname}.sh"
gendesk -q -f -n \
--pkgname="${pkgname}" \
@@ -145,7 +149,7 @@
_set_build_env
icns2png -d 32 -x assets/img/appIcon/appIcon.icns -o assets/img/appIcon/
cp assets/img/appIcon/appIcon_16x16x32.png assets/img/appIcon/appicon.png
- sed -i "s/appIcon\/appicon\ico/img\/appIcon\/appicon\.png/g" main.js
+ jq --arg ver "${SYSTEM_ELECTRON_VERSION}" '.devDependencies.electron = $ver' package.json > package.json.tmp && mv package.json.tmp package.json
rm -rf package-lock.json yarn.lock
export NODE_ENV=development
yarn install
@@ -157,19 +161,18 @@
_set_build_env
export NODE_ENV=production
yarn run package
+ rm -rf "$(_get_app_dir)/resources/default_app.asar"
}
package() {
install -Dm755 "${srcdir}/${pkgname}.sh" "${pkgdir}/usr/bin/${pkgname}"
install -Dm755 -d "${pkgdir}/usr/lib/${pkgname}"
- local _app_dir=$(find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -exec dirname {} + | head -n 1)
- cp -a "${_app_dir}/resources/." "${pkgdir}/usr/lib/${pkgname}/"
- local _src="$(_get_project_dir)"
+ cp -a "$(_get_app_dir)/resources/." "${pkgdir}/usr/lib/${pkgname}/"
_icon_sizes=(16x16 32x32 256x256 512x512 1024x1024)
for _icons in "${_icon_sizes[@]}";do
- install -Dm644 "${_src}/assets/img/appIcon/appIcon_${_icons}x32.png" \
+ install -Dm644 "$(_get_project_dir)/assets/img/appIcon/appIcon_${_icons}x32.png" \
"${pkgdir}/usr/share/icons/hicolor/${_icons}/app/${pkgname}.png"
done
- install -Dm644 "${_src}/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
- install -Dm644 "${_src}/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
+ install -Dm644 "$(_get_project_dir)/${pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
+ install -Dm644 "$(_get_project_dir)/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
}

Scan history

Scanned at (UTC)SeverityRules
2026-10-26 07:44:04 Low 1
2026-10-05 23:40:58 Clean 0
2026-09-28 03:20:12 Clean 0
2026-09-17 11:25:44 Clean 0
2026-09-10 23:21:28 Clean 0
2026-09-10 03:20:13 Clean 0
2026-09-09 11:19:32 Clean 0
2026-09-09 05:18:57 Clean 0
2026-09-09 00:04:09 Low 2
2026-09-08 00:18:08 Low 2
2026-09-07 00:30:15 Low 2
2026-09-06 00:17:06 Low 2
2026-09-05 00:16:27 Low 2
2026-09-04 00:03:13 Low 2
2026-09-03 00:15:47 Low 2
2026-09-02 00:02:31 Low 2
2026-09-01 00:11:19 Low 2
2026-08-31 00:19:57 Low 2
2026-08-30 00:04:14 Low 2
2026-08-29 00:29:17 Low 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion