zulip-desktop-git

LOW
maintainer zxp19821005 1 votes scanned 2026-11-02 12:02:29.906667
View on AUR
Why flagged

The package builds from the official upstream git repository, uses pnpm to install dependencies declared in the project's package.json, and runs standard build tools; the variable-named package installation refers to pnpm managing project dependencies, which is normal and not inherently risky.

Triggered rules

Low AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it LOW (confidence 95%): The package builds from the official upstream git repository, uses pnpm to install dependencies declared in the project's package.json, and runs standard build tools; the variable-named package installation refers to pnpm managing project dependencies, which is normal and not inherently risky.

  • PKGBUILD:99 npm install -g "pnpm@${_ver}" --prefix "${HOME}/.pnpm" \

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2# Maintainer: Jean Lucas <jean@4ray.co>
3pkgname=zulip-desktop-git
4_pkgname='Zulip Desktop'
5pkgver=5.14.2.r0.g308ea3b
6_electronversion=45
7_nodeversion=24
8pkgrel=1
9pkgdesc='Real-time team chat based on the email threading model.'
10arch=('any')
11url="https://zulip.com/apps"
12_ghurl="https://github.com/zulip/zulip-desktop"
13license=("Apache-2.0")
14conflicts=("${pkgname%-git}")
15provides=("${pkgname%-git}=${pkgver%.r*}")
16depends=(
17 "electron${_electronversion}"
18)
19makedepends=(
20 'pnpm'
21 'git'
22 'nvm'
23 'gendesk'
24 'jq'
25)
26source=(
27 "${pkgname%-git}.git::git+${_ghurl}.git"
28 "${pkgname%-git}.js"
29 "${pkgname%-git}.sh"
30)
31sha256sums=('SKIP'
32 '562897be8a17076176f8d985c0d7bc1c685f2e7c9b3a932339ce015963243627'
33 'ace275e253744ca62d2572776df26b947f3c89616239985003126db635fc300e')
34_get_project_dir() {
35 local d
36 while IFS= read -r d; do
37 find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
38 done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
39}
40pkgver() {
41 cd "$(_get_project_dir)"
42 set -o pipefail
43 git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
44 printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
45}
46_ensure_local_nvm() {
47 local NVM_DIR="${srcdir}/.nvm"
48 source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
49 nvm install "${_nodeversion}"
50 nvm use "${_nodeversion}"
51}
52_get_app_dir() {
53 find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -printf '%h\n' 2>/dev/null \
54 | while read -r d; do [[ -d "${d}/resources" ]] && { echo "$d"; return 0; }; done
55}
56_get_electron_version() {
57 _elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
58 | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
59 | grep -oE '[0-9]+' | head -1)
60 [[ -z "${_elec_ver}" ]] && return 1
61 (( _elec_ver == _electronversion )) && c=32 || c=31
62 echo -e "Electron version: \033[1;${c}m${_elec_ver}$([[ $c -eq 31 ]] && echo " (expected ${_electronversion})")\033[0m"
63}
64_set_electron_build_env() {
65 export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
66 export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
67 export ELECTRON_SKIP_BINARY_DOWNLOAD=1
68 export ELECTRON_BUILDER_OFFLINE=true
69 export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
70}
71_set_pnpm_build_env() {
72 export HOME="${srcdir}/.home"
73 export XDG_CACHE_HOME="${HOME}/.cache"
74 export XDG_CONFIG_HOME="${HOME}/.config"
75 export XDG_DATA_HOME="${HOME}/.local/share"
76 export XDG_STATE_HOME="${HOME}/.local/state"
77 export PNPM_HOME="${HOME}/.pnpm/bin"
78 export pnpm_config_cache_dir="${HOME}/.pnpm_cache"
79 export pnpm_config_store_dir="${HOME}/.pnpm_store"
80 export pnpm_config_global_dir="${HOME}/.pnpm/global"
81 export pnpm_config_state_dir="${HOME}/.pnpm/state"
82 export pnpm_config_node_linker=hoisted
83 export pnpm_config_minimum_release_age=0
84 export pnpm_config_update_notifier=false
85 export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
86 export COREPACK_HOME="${HOME}/.corepack"
87 mkdir -p "${HOME}" "${PNPM_HOME}" "${pnpm_config_cache_dir}" "${pnpm_config_store_dir}" "${pnpm_config_global_dir}" "${pnpm_config_state_dir}" "${COREPACK_HOME}"
88 export PATH="${PNPM_HOME}:${PATH}"
89 local _detected=""
90 local _pkgjson="$(_get_project_dir)/package.json"
91 if [ -f "${_pkgjson}" ]; then
92 _detected="$(grep -o '"packageManager"[^,]*' "${_pkgjson}" 2>/dev/null | grep -oE 'pnpm@[^"+]+' | head -n1 | sed 's/^pnpm@//')"
93 if [ -z "${_detected}" ]; then
94 _detected="$(grep -oE '"pnpm"[[:space:]]*:[[:space:]]*"[^"]+"' "${_pkgjson}" 2>/dev/null | grep -oE '[0-9][0-9.]*' | head -n1)"
95 fi
96 fi
97 local _ver="${_pnpmver:-${_detected}}"
98 if [ -n "${_ver}" ]; then
99 npm install -g "pnpm@${_ver}" --prefix "${HOME}/.pnpm" \
100 --registry "${COREPACK_NPM_REGISTRY}"
101 fi
102}
103prepare() {
104 cd "${srcdir}/${pkgname%-git}.git"
105 _get_electron_version
106 sed -i -e "
107 s/@electronversion@/${_electronversion}/g
108 s/@appname@/${pkgname%-git}/g
109 " "${srcdir}/${pkgname%-git}.js" "${srcdir}/${pkgname%-git}.js"
110 gendesk -q -f -n \
111 --pkgname="${pkgname%-git}" \
112 --pkgdesc="${pkgdesc}" \
113 --categories="Network" \
114 --name="${_pkgname}" \
115 --exec="${pkgname%-git} %U"
116 _ensure_local_nvm
117 _set_electron_build_env
118 _set_pnpm_build_env
119 jq --arg ver "${SYSTEM_ELECTRON_VERSION}" '.devDependencies.electron = $ver' package.json > package.json.tmp && mv package.json.tmp package.json
120 export NODE_ENV=development
121 pnpm install
122}
123build() {
124 cd "${srcdir}/${pkgname%-git}.git"
125 _ensure_local_nvm
126 _set_electron_build_env
127 _set_pnpm_build_env
128 export NODE_ENV=production
129 pnpm exec electron-vite build
130 pnpm -c exec "electron-builder --linux dir -c.electronDist=${ELECTRON_DIST}"
131
132}
133package() {
134 install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
135 install -Dm644 "${srcdir}/${pkgname%-git}.js" -t "${pkgdir}/usr/lib/${pkgname%-git}"
136 cp -a "$(_get_app_dir)/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"
137 install -Dm644 "${srcdir}/${pkgname%-git}.git/build/zulip.png" "${pkgdir}/usr/share/pixmaps/${pkgname%-git}.png"
138 install -Dm644 "${srcdir}/${pkgname%-git}.git/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
139 install -Dm644 "${srcdir}/${pkgname%-git}.git/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"
140}
141

Changes since previous scan

--- PKGBUILD @ 2026-09-20 01:31
+++ PKGBUILD @ 2026-11-02 12:02
@@ -2,8 +2,8 @@
# Maintainer: Jean Lucas <jean@4ray.co>
pkgname=zulip-desktop-git
_pkgname='Zulip Desktop'
-pkgver=5.13.1.r0.g9cd09fb
-_electronversion=44
+pkgver=5.14.2.r0.g308ea3b
+_electronversion=45
_nodeversion=24
pkgrel=1
pkgdesc='Real-time team chat based on the email threading model.'
@@ -21,76 +21,84 @@
'git'
'nvm'
'gendesk'
- 'curl'
'jq'
)
source=(
"${pkgname%-git}.git::git+${_ghurl}.git"
- "${pkgname%-git}.sh"\
+ "${pkgname%-git}.js"
+ "${pkgname%-git}.sh"
)
sha256sums=('SKIP'
- 'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
+ '562897be8a17076176f8d985c0d7bc1c685f2e7c9b3a932339ce015963243627'
+ 'ace275e253744ca62d2572776df26b947f3c89616239985003126db635fc300e')
+_get_project_dir() {
+ local d
+ while IFS= read -r d; do
+ find "$d" -name "package.json" ! -path "*/node_modules/*" 2>/dev/null | grep -q . && { echo "$d"; return; }
+ done < <(find "${srcdir}" -maxdepth 1 -mindepth 1 -type d ! -name '.*')
+}
pkgver() {
- cd "${srcdir}/${pkgname%-git}.git"
- set -o pipefail
- git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
- printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
+ cd "$(_get_project_dir)"
+ set -o pipefail
+ git describe --long --tags --abbrev=7 | sed 's/\([^-]*-g\)/r\1/;s/-/./g;s/v//g' ||
+ printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
}
_ensure_local_nvm() {
- local NVM_DIR="${srcdir}/.nvm"
- source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
- nvm install "${_nodeversion}"
- nvm use "${_nodeversion}"
+ local NVM_DIR="${srcdir}/.nvm"
+ source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
+ nvm install "${_nodeversion}"
+ nvm use "${_nodeversion}"
}
_get_app_dir() {
- find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1
+ find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -printf '%h\n' 2>/dev/null \
+ | while read -r d; do [[ -d "${d}/resources" ]] && { echo "$d"; return 0; }; done
}
-_set_build_env() {
+_get_electron_version() {
+ _elec_ver=$(find "$(_get_project_dir)" -name "package.json" ! -path "*/node_modules/*" -print \
+ | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null \
+ | grep -oE '[0-9]+' | head -1)
+ [[ -z "${_elec_ver}" ]] && return 1
+ (( _elec_ver == _electronversion )) && c=32 || c=31
+ echo -e "Electron version: \033[1;${c}m${_elec_ver}$([[ $c -eq 31 ]] && echo " (expected ${_electronversion})")\033[0m"
+}
+_set_electron_build_env() {
export ELECTRON_DIST="/usr/lib/electron${_electronversion}"
export ELECTRON_OVERRIDE_DIST_PATH="${ELECTRON_DIST}"
export ELECTRON_SKIP_BINARY_DOWNLOAD=1
- _ev="$(electron${_electronversion} -v)"
- export SYSTEM_ELECTRON_VERSION="${_ev#v}"
- export HOME="${srcdir}/.electron-gyp"
- mkdir -p "${HOME}"
- export XDG_CACHE_HOME="${srcdir}/.cache"
- export XDG_CONFIG_HOME="${srcdir}/.config"
- export XDG_DATA_HOME="${srcdir}/.local/share"
- export XDG_STATE_HOME="${srcdir}/.local/state"
- export PNPM_CACHE_DIR="${srcdir}/.pnpm_cache"
- export PNPM_STORE_DIR="${srcdir}/.pnpm_store"
- export PNPM_GLOBAL_DIR="${srcdir}/.pnpm/global"
- export PNPM_GLOBAL_BIN_DIR="${srcdir}/.pnpm/bin"
- export PNPM_STATE_DIR="${srcdir}/.pnpm/state"
- export PNPM_MINIMUM_RELEASE_AGE=0
- export PNPM_NODE_LINKER=hoisted
- export PNPM_FETCH_RETRIES=3
- export PNPM_FETCH_RETRY_MAXTIMEOUT=10000
- export PNPM_UPDATE_NOTIFIER=false
- export PNPM_NO_COLOR=true
- export PNPM_NO_PROGRESS=true
- export pnpm_config_platform=linux
- export pnpm_config_arch="${CARCH}"
- export NODE_OPTIONS="--max-old-space-size=4096"
- export npm_config_node_options="--max-old-space-size=4096"
- mkdir -p "${PNPM_CACHE_DIR}" "${PNPM_STORE_DIR}" "${PNPM_GLOBAL_DIR}" "${PNPM_GLOBAL_BIN_DIR}" "${PNPM_STATE_DIR}"
- local _pnpmver="${_pnpmversion}"
- if [[ -z "${_pnpmver}" ]]; then
- _pnpmver="$(node -p "const pm=require('./package.json').packageManager; pm && pm.startsWith('pnpm@') ? pm.split('@')[1] : ''" 2>/dev/null)"
+ export ELECTRON_BUILDER_OFFLINE=true
+ export SYSTEM_ELECTRON_VERSION="$(electron${_electronversion} -v | sed 's/^v//')"
+}
+_set_pnpm_build_env() {
+ export HOME="${srcdir}/.home"
+ export XDG_CACHE_HOME="${HOME}/.cache"
+ export XDG_CONFIG_HOME="${HOME}/.config"
+ export XDG_DATA_HOME="${HOME}/.local/share"
+ export XDG_STATE_HOME="${HOME}/.local/state"
+ export PNPM_HOME="${HOME}/.pnpm/bin"
+ export pnpm_config_cache_dir="${HOME}/.pnpm_cache"
+ export pnpm_config_store_dir="${HOME}/.pnpm_store"
+ export pnpm_config_global_dir="${HOME}/.pnpm/global"
+ export pnpm_config_state_dir="${HOME}/.pnpm/state"
+ export pnpm_config_node_linker=hoisted
+ export pnpm_config_minimum_release_age=0
+ export pnpm_config_update_notifier=false
+ export COREPACK_NPM_REGISTRY="${COREPACK_NPM_REGISTRY:-${NPM_CONFIG_REGISTRY:-https://registry.npmjs.org}}"
+ export COREPACK_HOME="${HOME}/.corepack"
+ mkdir -p "${HOME}" "${PNPM_HOME}" "${pnpm_config_cache_dir}" "${pnpm_config_store_dir}" "${pnpm_config_global_dir}" "${pnpm_config_state_dir}" "${COREPACK_HOME}"
+ export PATH="${PNPM_HOME}:${PATH}"
+ local _detected=""
+ local _pkgjson="$(_get_project_dir)/package.json"
+ if [ -f "${_pkgjson}" ]; then
+ _detected="$(grep -o '"packageManager"[^,]*' "${_pkgjson}" 2>/dev/null | grep -oE 'pnpm@[^"+]+' | head -n1 | sed 's/^pnpm@//')"
+ if [ -z "${_detected}" ]; then
+ _detected="$(grep -oE '"pnpm"[[:space:]]*:[[:space:]]*"[^"]+"' "${_pkgjson}" 2>/dev/null | grep -oE '[0-9][0-9.]*' | head -n1)"
+ fi
fi
- if [[ -n "${_pnpmver}" ]]; then
- export COREPACK_HOME="${srcdir}/.corepack"
- install -dm755 "${srcdir}/.bin"
- corepack enable --install-directory "${srcdir}/.bin"
- export PATH="${srcdir}/.bin:${PATH}"
- corepack prepare "pnpm@${_pnpmver}" --activate
+ local _ver="${_pnpmver:-${_detected}}"
+ if [ -n "${_ver}" ]; then
+ npm install -g "pnpm@${_ver}" --prefix "${HOME}/.pnpm" \
+ --registry "${COREPACK_NPM_REGISTRY}"
fi
-}
-_get_electron_version() {
- _elec_ver=$(find "${srcdir}" -maxdepth 5 -name "package.json" ! -path "*/node_modules/*" \
- -exec grep -l '"electron"' {} + | xargs -I{} jq -r '(.devDependencies.electron // .dependencies.electron) // empty' {} 2>/dev/null | head -1)
- [[ -z "${_elec_ver}" ]] && return 1
- echo -e "The electron version is: \033[1;31m${_elec_ver%%.*}\033[0m"
}
prepare() {
cd "${srcdir}/${pkgname%-git}.git"
@@ -98,9 +106,7 @@
sed -i -e "
s/@electronversion@/${_electronversion}/g
s/@appname@/${pkgname%-git}/g
- s/@runname@/app.asar/g
- s/@cfgdirname@/${_pkgname}/g
- " "${srcdir}/${pkgname%-git}.sh"
+ " "${srcdir}/${pkgname%-git}.js" "${srcdir}/${pkgname%-git}.js"
gendesk -q -f -n \
--pkgname="${pkgname%-git}" \
--pkgdesc="${pkgdesc}" \
@@ -108,23 +114,26 @@
--name="${_pkgname}" \
--exec="${pkgname%-git} %U"
_ensure_local_nvm
- _set_build_env
- sed -i "s/\"electron\": \"[^\"]*\"/\"electron\": \"${SYSTEM_ELECTRON_VERSION}\"/g" package.json
- NODE_ENV=development pnpm install
+ _set_electron_build_env
+ _set_pnpm_build_env
+ jq --arg ver "${SYSTEM_ELECTRON_VERSION}" '.devDependencies.electron = $ver' package.json > package.json.tmp && mv package.json.tmp package.json
+ export NODE_ENV=development
+ pnpm install
}
build() {
cd "${srcdir}/${pkgname%-git}.git"
_ensure_local_nvm
- _set_build_env
- NODE_ENV=production pnpm exec electron-vite build
- NODE_ENV=production pnpm -c exec "electron-builder --linux dir -c.electronDist=${ELECTRON_DIST}"
+ _set_electron_build_env
+ _set_pnpm_build_env
+ export NODE_ENV=production
+ pnpm exec electron-vite build
+ pnpm -c exec "electron-builder --linux dir -c.electronDist=${ELECTRON_DIST}"
}
package() {
install -Dm755 "${srcdir}/${pkgname%-git}.sh" "${pkgdir}/usr/bin/${pkgname%-git}"
- install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-git}"
- local _app_dir=$(_get_app_dir)
- cp -a "${_app_dir}/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"
+ install -Dm644 "${srcdir}/${pkgname%-git}.js" -t "${pkgdir}/usr/lib/${pkgname%-git}"
+ cp -a "$(_get_app_dir)/resources/." "${pkgdir}/usr/lib/${pkgname%-git}/"
install -Dm644 "${srcdir}/${pkgname%-git}.git/build/zulip.png" "${pkgdir}/usr/share/pixmaps/${pkgname%-git}.png"
install -Dm644 "${srcdir}/${pkgname%-git}.git/${pkgname%-git}.desktop" -t "${pkgdir}/usr/share/applications"
install -Dm644 "${srcdir}/${pkgname%-git}.git/LICENSE" -t "${pkgdir}/usr/share/licenses/${pkgname}"

Scan history

Scanned at (UTC)SeverityRules
2026-11-02 12:02:29 Low 1
2026-09-20 01:31:57 Clean 0
2026-07-01 10:41:16 Clean 0
2026-06-18 16:11:54 Clean 0

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion