xdm-app-git
LOW
maintainer HanHaocheng
0 votes
scanned 2026-10-30 11:55:28.915114
Why flagged
The package builds from the project's own git repository and downloads a prebuilt JetBrains Runtime only for build-time use, which is verified against published checksums; no untrusted executable code is installed or executed at runtime.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Low
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from the project's own git repository and downloads a prebuilt JetBrains Runtime only for build-time use, which is verified against published checksums; no untrusted executable code is installed or executed at runtime.
PKGBUILD
1
# Maintainer: HanHaocheng <1849397656@qq.com>
2
#
3
# VCS package: tracks the upstream master branch (https://github.com/subhra74/xdm)
4
# and rebuilds the app image from whatever is at HEAD at build time.
5
#
6
# This is the counterpart of xdm-app (which pins the release tag) and of
7
# xdm-app-bin (which repackages the release). Upstream cuts releases every few
8
# days and keeps developing on master in between; master is currently several
9
# commits ahead of 9.0.8 - including the CJK font fallback fix
10
# (93e6d30f, merged as #1379) that no release tag contains yet.
11
#
12
# Caveat: upstream says in its README that the code is being restructured and
13
# that "pull requests made now may need a lot of rework". A commit on master can
14
# therefore fail to build; this package is for people who want the newest code
15
# and can wait out a broken commit.
16
#
17
# Why a prebuilt JetBrains Runtime has to be downloaded as a source (same
18
# reasoning as the xdm-app package, repeated here so this file stands alone):
19
# 1. packaging/build-bundle.sh refuses any java on PATH that is not the build
20
# named in packaging/jdk.properties (jbr.version=25.0.4.1,
21
# jbr.build=b635.70). --any-jdk exists for local experiments and must not
22
# be used for a package: the AppCDS class lists under packaging/cds are
23
# recorded on that exact build and only hold for it.
24
# 2. XDM's Linux UI needs JBR's java.desktop, whose native Wayland toolkit is a
25
# JetBrains patch that upstream OpenJDK does not carry.
26
# 3. That JBR build is not in the Arch repositories, so it is fetched from
27
# JetBrains' cache-redirector (the host upstream's Linux Docker build uses)
28
# and verified against the SHA-512 JetBrains publishes for it.
29
# The JBR is a build-time tool only: at runtime the package uses the jlink'd
30
# runtime inside /opt/xdm-app/lib/runtime.
31
#
32
# If upstream ever bumps packaging/jdk.properties, the check in build() stops
33
# with a clear message: update _jbr_ver/_jbr_build and the sha512sums here.
34
35
pkgname=xdm-app-git
36
pkgver=9.0.8.r10.ge5a9ecda
37
pkgrel=1
38
pkgdesc='Fast, resumable download accelerator and video downloader with HLS/DASH support (master branch)'
39
arch=('x86_64' 'aarch64')
40
url='https://xtremedownloadmanager.com/'
41
license=('GPL-3.0-only')
42
depends=('libx11' 'libxext' 'libxrender' 'libxtst' 'libxi' 'freetype2' 'fontconfig' 'ttf-font')
43
optdepends=(
44
'wayland: use the native Wayland toolkit instead of XWayland'
45
'libxkbcommon: use the native Wayland toolkit instead of XWayland'
46
'gtk3: native GTK file chooser dialogs'
47
'alsa-lib: sound notifications'
48
)
49
makedepends=('git' 'maven' 'zip' 'unzip' 'binutils')
50
# The release tag package, its binary counterpart and the Fedora-RPM repack by
51
# another maintainer all own /opt/xdm-app; only one of them may be installed.
52
provides=('xdm-app')
53
conflicts=('xdm-app' 'xdm-app-bin' 'xdman-bin' 'xdman' 'xdman_gtk')
54
replaces=('xdman' 'xdman_gtk')
55
options=('!strip' '!debug')
56
57
source=("$pkgname::git+https://github.com/subhra74/xdm.git")
58
sha256sums=('SKIP')
59
60
# The pinned build JDK (packaging/jdk.properties). Checksums are the SHA-512s
61
# JetBrains publishes at <url>.checksum; makepkg matches <integ>sums_<arch>
62
# against source_<arch> only, hence the per-architecture arrays.
63
_jbr_ver=25.0.4.1
64
_jbr_build=b635.70
65
_jbr_base=https://cache-redirector.jetbrains.com/intellij-jbr
66
source_x86_64=("$_jbr_base/jbrsdk-$_jbr_ver-linux-x64-$_jbr_build.tar.gz")
67
sha512sums_x86_64=('15b9e9788a1d658851a1bf32fc998fc6660f5f8084e4c303b42fd0f13cc2b2b77b72fab1b86476b066cadaa95f6a7186a058e5487128eb259a875e9c6d456f56')
68
source_aarch64=("$_jbr_base/jbrsdk-$_jbr_ver-linux-aarch64-$_jbr_build.tar.gz")
69
sha512sums_aarch64=('22771d9d166bd0f9d477c0100fc10bb32b11bc5c942953cf949f7e24d548f42e50e7c6f1c426eed590ca5326acb75e899c4b9f06ba13128aeb2876ca5d96a5f6')
70
71
# <app version from app-version.json>.r<commit count>.g<short sha>, e.g.
72
# 9.0.8.r10.ge5a9ecda. The commit count makes it sort monotonically.
73
pkgver() {
74
cd "$pkgname"
75
local ver tag rev
76
ver=$(sed -n 's/.*"currentVersion"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' \
77
xdm-app/src/main/resources/app-version.json | head -n1)
78
# commits since the newest tag ("r0" when HEAD is the tag itself)
79
tag=$(git describe --tags --abbrev=0 2>/dev/null || true)
80
if [[ -n $tag ]]; then
81
rev=$(git rev-list --count "$tag"..HEAD)
82
else
83
rev=$(git rev-list --count HEAD)
84
fi
85
printf '%s.r%s.g%s' "${ver:-0}" "$rev" "$(git rev-parse --short=8 HEAD)"
86
}
87
88
build() {
89
cd "$srcdir"
90
91
# ---- build JDK: the JBR tree makepkg already unpacked -------------------
92
local jbr_home jbr_jdk_version jbr_runtime_version release_file
93
jbr_home=$(find "$srcdir" -maxdepth 1 -mindepth 1 -type d \
94
-name "jbrsdk-$_jbr_ver-linux-*-$_jbr_build" | head -n1)
95
if [[ -z $jbr_home ]]; then
96
echo "no jbrsdk-$_jbr_ver-linux-*-$_jbr_build directory in $srcdir" >&2
97
return 1
98
fi
99
[[ -x $jbr_home/bin/java ]] ||
100
{ echo "unexpected JBR layout: $jbr_home/bin/java is missing" >&2; return 1; }
101
102
_release_field() { grep -m1 "^$2=" "$1" | cut -d= -f2- | tr -d '"'; }
103
release_file=$jbr_home/release
104
[[ -f $release_file ]] || { echo "missing $release_file" >&2; return 1; }
105
jbr_jdk_version=$(_release_field "$release_file" JAVA_VERSION)
106
jbr_runtime_version=$(_release_field "$release_file" JAVA_RUNTIME_VERSION)
107
108
if [[ $jbr_jdk_version != "$_jbr_ver" ]]; then
109
echo "JBR JAVA_VERSION is '$jbr_jdk_version', expected '$_jbr_ver'" >&2
110
echo "upstream packaging/jdk.properties may have bumped the pin: update the PKGBUILD" >&2
111
return 1
112
fi
113
if [[ $jbr_runtime_version != *"-$_jbr_build"* ]]; then
114
echo "JBR JAVA_RUNTIME_VERSION is '$jbr_runtime_version'," >&2
115
echo "expected it to contain '-$_jbr_build'" >&2
116
return 1
117
fi
118
119
export JAVA_HOME="$jbr_home"
120
export PATH="$JAVA_HOME/bin:$PATH"
121
122
# ---- Maven toolchain ---------------------------------------------------
123
# The root pom's maven-toolchains-plugin selects a JDK 25 toolchain. The file
124
# lives in $srcdir (never in ~/.m2) and points at the unpacked JBR.
125
cat > "$srcdir/toolchains.xml" <<EOF
126
<?xml version="1.0" encoding="UTF-8"?>
127
<toolchains>
128
<toolchain>
129
<type>jdk</type>
130
<provides>
131
<version>25</version>
132
</provides>
133
<configuration>
134
<jdkHome>$JAVA_HOME</jdkHome>
135
</configuration>
136
</toolchain>
137
</toolchains>
138
EOF
139
140
cd "$srcdir/$pkgname"
141
142
# ---- fat jar -----------------------------------------------------------
143
# Maven runs on the JBR (JAVA_HOME + PATH above). The local repository is kept
144
# inside $srcdir so the build never reads or writes the user's ~/.m2.
145
mvn -q clean package -DskipTests -t "$srcdir/toolchains.xml" -Dmaven.repo.local="$srcdir/m2repo"
146
147
[[ -f xdm-app/target/xdm-app.jar ]] ||
148
{ echo "xdm-app/target/xdm-app.jar was not produced" >&2; return 1; }
149
150
# ---- app image ---------------------------------------------------------
151
# -s: reuse the jar just built. The pinned JBR is re-stated on the command
152
# line because the script validates (and then uses for jlink/jpackage) the
153
# java it finds on PATH.
154
PATH="$JAVA_HOME/bin:$PATH" JAVA_HOME="$JAVA_HOME" packaging/build-bundle.sh -s -t app-image -o "$srcdir/dist"
155
156
[[ -x "$srcdir/dist/xdm-app/bin/xdm-app" ]] ||
157
{ echo "app image not produced at $srcdir/dist/xdm-app" >&2; return 1; }
158
}
159
160
package() {
161
install -dm755 "$pkgdir/opt" "$pkgdir/usr/bin" \
162
"$pkgdir/usr/share/applications" \
163
"$pkgdir/usr/share/icons/hicolor/256x256/apps"
164
165
cp -a "$srcdir/dist/xdm-app" "$pkgdir/opt/xdm-app"
166
ln -s /opt/xdm-app/bin/xdm-app "$pkgdir/usr/bin/xdm-app"
167
168
install -Dm644 "$srcdir/dist/xdm-app/lib/xdm-app.png" \
169
"$pkgdir/usr/share/icons/hicolor/256x256/apps/xdm-app.png"
170
171
# Verbatim copy of packaging/linux/xdm-app.desktop from the tracked tree.
172
cat > "$pkgdir/usr/share/applications/xdm-app.desktop" <<'DESKTOP'
173
[Desktop Entry]
174
Type=Application
175
Name=Xtreme Download Manager
176
GenericName=Download Manager
177
Comment=Download accelerator and video downloader
178
Exec=/opt/xdm-app/bin/xdm-app %U
179
Icon=xdm-app
180
Terminal=false
181
Categories=Network;FileTransfer;
182
Keywords=download;accelerator;video;hls;dash;
183
MimeType=x-scheme-handler/xdm-app;
184
# No launch feedback: GNOME ends its busy cursor when the first window hands back the launch's
185
# XDG_ACTIVATION_TOKEN, and JBR's Wayland toolkit never does, so the cursor stayed busy until the
186
# timeout (PACKAGING.md 7.2).
187
StartupNotify=false
188
# X11 window class; under native Wayland the window's app id is xdm-app, which matches this file's name.
189
StartupWMClass=xdm-app-AppMain
190
DESKTOP
191
chmod 644 "$pkgdir/usr/share/applications/xdm-app.desktop"
192
}
193
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-30 11:55:28 | Low | 2 |