zotero-translation-server-git
LOW
maintainer hrdl
2 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The npm install is run on the locally checked-out git source of the project itself, not on an external undeclared package; the flagged pattern is a false positive because the source is the project's own code being built and installed.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The npm install is run on the locally checked-out git source of the project itself, not on an external undeclared package; the flagged pattern is a false positive because the source is the project's own code being built and installed.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
npm/yarn/pnpm install of an undeclared external package
npm_install_external
Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.
-
PKGBUILD:57
npm install --location global --prefix "$pkgdir"/usr ./"$_src_dir_1" --install-links
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: hrdl <aur@hrdl.eu>
2
3
pkgname=zotero-translation-server-git
4
pkgver=20240914.0a9199e
5
pkgrel=1
6
pkgdesc='The Zotero translation server lets you use Zotero translators without the Zotero client.'
7
arch=('x86_64')
8
url='https://github.com/zotero/translation-server'
9
license=('AGPL3')
10
depends=('npm')
11
makedepends=('git')
12
_src_dir_1=translation-server
13
_src_dir_2=translate
14
_src_dir_3=translators
15
_src_dir_4=utilities
16
_src_dir_5=zotero-schema
17
source=("zotero-translation-server.service"
18
"zotero-translation-server.sysusers"
19
"zotero-translation-server.tmpfiles"
20
"${_src_dir_1}::git+https://github.com/zotero/translation-server"
21
"${_src_dir_2}::git+https://github.com/zotero/translate"
22
"${_src_dir_3}::git+https://github.com/zotero/translators"
23
"${_src_dir_4}::git+https://github.com/zotero/utilities"
24
"${_src_dir_5}::git+https://github.com/zotero/zotero-schema")
25
sha256sums=('325c4c7a4149b65b2c8d7924a849cc1aa30f4597318febc1bb51065f16a38148'
26
'd85e56ef2802841a33b44424cbed53b72eb6d26775123fd8c24197f3e5f40c39'
27
'474ac53ca5ed1c014030b7014433244aa39f883325fe512a62f9ad56718b2914'
28
'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP')
29
30
pkgver() {
31
cd ${_src_dir_1}
32
git log -1 --format='%cd.%h' --date=short |tr -d -
33
}
34
35
prepare() {
36
cd ${_src_dir_1}
37
sed -i '/"host"/s/0.0.0.0/127.0.0.1/' config/default.json5
38
git submodule init
39
git config submodule.modules/translate.url "$srcdir/translate"
40
git config submodule.modules/translators.url "$srcdir/translators"
41
git config submodule.modules/utilities.url "$srcdir/utilities"
42
git config submodule.modules/zotero-schema.url "$srcdir/zotero-schema"
43
git -c protocol.file.allow=always submodule update
44
45
cd ../${_src_dir_2}
46
git submodule init
47
git config submodule.modules/utilities.url "$srcdir/utilities"
48
git -c protocol.file.allow=always submodule update
49
50
cd ../${_src_dir_4}
51
git submodule init
52
git config submodule.resource/schema/global.url "$srcdir/zotero-schema"
53
git -c protocol.file.allow=always submodule update
54
}
55
56
package() {
57
npm install --location global --prefix "$pkgdir"/usr ./"$_src_dir_1" --install-links
58
59
# Avoid collisions with other packages
60
sed -i "s|Utils = require('util')|Utils = require('../../util')|" "$pkgdir"/usr/lib/node_modules/translation-server/node_modules/config/lib/config.js
61
62
# Non-deterministic race in npm gives 777 permissions to random directories.
63
# See https://github.com/npm/cli/issues/1103 for details.
64
find "${pkgdir}/usr" -type d -exec chmod 755 {} +
65
66
# npm gives ownership of ALL FILES to build user
67
# https://bugs.archlinux.org/task/63396
68
chown -R root:root "${pkgdir}"
69
70
# Experimental dedup rm -r "$pkgdir"/usr/lib/node_modules/$pkgname/node_modules/{,.bin/}nopt
71
rm -r "$pkgdir"/usr/lib/node_modules/"${_src_dir_1}"/node_modules/{,.bin/}semver
72
73
install -d "$pkgdir"/usr/share/licenses/${pkgname%-git}
74
ln -s ../../../lib/node_modules/$_src_dir_1/COPYING "$pkgdir"/usr/share/licenses/${pkgname%-git}/LICENSE
75
76
install -Dm 644 "$pkgdir"/usr/lib/node_modules/translation-server/config/default.json5 "$pkgdir/etc/${pkgname%-git}/default.json5"
77
install -Dm 644 "$pkgdir"/usr/lib/node_modules/translation-server/config/custom-environment-variables.json "$pkgdir/etc/${pkgname%-git}/custom-environment-variables.json"
78
79
install -Dm 644 "${pkgname%-git}".service \
80
"$pkgdir/usr/lib/systemd/system/${pkgname%-git}.service"
81
install -Dm 644 zotero-translation-server.sysusers "${pkgdir}"/usr/lib/sysusers.d/zotero-translation-server.conf
82
install -Dm 644 zotero-translation-server.tmpfiles "${pkgdir}"/usr/lib/tmpfiles.d/zotero-translation-server.conf
83
}
84
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |