akiflow-bin

MEDIUM

maintainer shrimpwtf 0 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads a prebuilt Windows executable (Akiflow-${pkgver}.exe) from download.akiflow.com, which is not a standard code hosting platform, and extracts and repackages its contents; while the build process is transparent, the source of the binary is unverifiable and could pose a supply-chain risk if compromised.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source=("Akiflow-${pkgver}.exe::https://download.akiflow.com/builds/Akiflow-${pkgver}-${_buildhash}-x64.exe"

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads a prebuilt Windows executable (Akiflow-${pkgver}.exe) from download.akiflow.com, which is not a standard code hosting platform, and extracts and repackages its contents; while the build process is transparent, the source of the binary is unverifiable and could pose a supply-chain risk if compromised.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: shrimp
    
      2# Akiflow Desktop for Linux (unofficial)
    
      3
    
      4pkgname=akiflow-bin
    
      5pkgver=2.83.8
    
      6pkgrel=1
    
      7_buildhash=9f6f1262
    
      8pkgdesc="Akiflow - Time blocking and task management (unofficial Linux build)"
    
      9arch=('x86_64')
    
      10url="https://akiflow.com"
    
      11license=('custom')
    
      12depends=('electron')
    
      13makedepends=('p7zip' 'imagemagick' 'icoutils' 'python')
    
      14_ghraw="https://raw.githubusercontent.com/shrimpwtf/akiflow-arch/main"
    
      15source=("Akiflow-${pkgver}.exe::https://download.akiflow.com/builds/Akiflow-${pkgver}-${_buildhash}-x64.exe"
    
      16        "patch-main.py::${_ghraw}/patch-main.py"
    
      17        "plasma-widget-metadata.json::${_ghraw}/plasma-widget/package/metadata.json"
    
      18        "plasma-widget-main.qml::${_ghraw}/plasma-widget/package/contents/ui/main.qml"
    
      19        "plasma-widget-CompactRepresentation.qml::${_ghraw}/plasma-widget/package/contents/ui/CompactRepresentation.qml"
    
      20        "plasma-widget-FullRepresentation.qml::${_ghraw}/plasma-widget/package/contents/ui/FullRepresentation.qml"
    
      21        "plasma-widget-akiflow.png::${_ghraw}/plasma-widget/package/contents/icons/akiflow.png")
    
      22sha512sums=('f8764b23aa378b0ab4760284f80072e68756a82ae546bfaffc795abf514df59ff2953d04f15f03a3bb00667ebf44ad864bf11214d57445fe332255d65d8314d9'
    
      23            'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP')
    
      24
    
      25prepare() {
    
      26    cd "${srcdir}"
    
      27
    
      28    # Extract the NSIS installer
    
      29    7z x -y "Akiflow-${pkgver}.exe" -oextracted
    
      30
    
      31    # Extract icons from exe if present
    
      32    if [ -f "extracted/\$PLUGINSDIR/app-64.7z" ]; then
    
      33        7z x -y "extracted/\$PLUGINSDIR/app-64.7z" -oapp
    
      34    else
    
      35        # Fallback: the app might be directly in extracted
    
      36        cp -r extracted app 2>/dev/null || true
    
      37    fi
    
      38
    
      39    # Try to extract icon
    
      40    if [ -f "app/Akiflow.exe" ]; then
    
      41        wrestool -x -t 14 app/Akiflow.exe -o akiflow.ico 2>/dev/null || true
    
      42    elif [ -f "extracted/Akiflow.exe" ]; then
    
      43        wrestool -x -t 14 extracted/Akiflow.exe -o akiflow.ico 2>/dev/null || true
    
      44    fi
    
      45
    
      46    # Convert ico to png if we got one
    
      47    if [ -f "akiflow.ico" ]; then
    
      48        icotool -x akiflow.ico 2>/dev/null || true
    
      49        mkdir -p icons/hicolor
    
      50        for size in 16 24 32 48 64 128 256; do
    
      51            icon_file=$(ls akiflow_*"${size}x${size}"*.png 2>/dev/null | head -1)
    
      52            if [ -n "$icon_file" ]; then
    
      53                mkdir -p "icons/hicolor/${size}x${size}/apps"
    
      54                cp "$icon_file" "icons/hicolor/${size}x${size}/apps/akiflow.png"
    
      55            fi
    
      56        done
    
      57    fi
    
      58}
    
      59
    
      60_find_asar() {
    
      61    if [ -f "${srcdir}/app/resources/app.asar" ]; then
    
      62        echo "${srcdir}/app/resources"
    
      63    elif [ -f "${srcdir}/extracted/resources/app.asar" ]; then
    
      64        echo "${srcdir}/extracted/resources"
    
      65    else
    
      66        dirname "$(find "${srcdir}" -name 'app.asar' -type f | head -1)"
    
      67    fi
    
      68}
    
      69
    
      70build() {
    
      71    # Patch app.asar to write tray status for the KDE Plasma widget
    
      72    ASAR_PATH="$(_find_asar)"
    
      73    if [ -z "$ASAR_PATH" ] || [ ! -f "$ASAR_PATH/app.asar" ]; then
    
      74        echo "ERROR: Could not find app.asar"
    
      75        exit 1
    
      76    fi
    
      77
    
      78    cd "$ASAR_PATH"
    
      79    python "${srcdir}/patch-main.py"
    
      80}
    
      81
    
      82package() {
    
      83    ASAR_PATH="$(_find_asar)"
    
      84    if [ -z "$ASAR_PATH" ] || [ ! -f "$ASAR_PATH/app.asar" ]; then
    
      85        echo "ERROR: Could not find app.asar"
    
      86        exit 1
    
      87    fi
    
      88
    
      89    # Install app files
    
      90    install -d "${pkgdir}/usr/lib/${pkgname}"
    
      91    cp "$ASAR_PATH/app.asar" "${pkgdir}/usr/lib/${pkgname}/"
    
      92
    
      93    # Copy unpacked resources if they exist
    
      94    if [ -d "$ASAR_PATH/app.asar.unpacked" ]; then
    
      95        cp -r "$ASAR_PATH/app.asar.unpacked" "${pkgdir}/usr/lib/${pkgname}/"
    
      96    fi
    
      97
    
      98    # Install icons if we extracted them
    
      99    if [ -d "${srcdir}/icons/hicolor" ]; then
    
      100        install -d "${pkgdir}/usr/share/icons"
    
      101        cp -r "${srcdir}/icons/"* "${pkgdir}/usr/share/icons/"
    
      102    fi
    
      103
    
      104    # Create desktop file
    
      105    install -Dm644 /dev/stdin "${pkgdir}/usr/share/applications/${pkgname}.desktop" <<EOF
    
      106[Desktop Entry]
    
      107Name=Akiflow
    
      108GenericName=Task Management
    
      109Comment=Time blocking and task management
    
      110Exec=${pkgname} %u
    
      111Icon=akiflow
    
      112Type=Application
    
      113Terminal=false
    
      114Categories=Office;ProjectManagement;Calendar;
    
      115MimeType=x-scheme-handler/akiflow;
    
      116StartupWMClass=Akiflow
    
      117EOF
    
      118
    
      119    # Create launcher script
    
      120    install -Dm755 /dev/stdin "${pkgdir}/usr/bin/${pkgname}" <<EOF
    
      121#!/bin/sh
    
      122exec electron --class=Akiflow --name=Akiflow /usr/lib/${pkgname}/app.asar "\$@"
    
      123EOF
    
      124
    
      125    # Install KDE Plasma widget for upcoming events
    
      126    install -d "${pkgdir}/usr/share/plasma/plasmoids/com.akiflow.panelwidget/contents/ui"
    
      127    install -d "${pkgdir}/usr/share/plasma/plasmoids/com.akiflow.panelwidget/contents/icons"
    
      128    install -Dm644 "${srcdir}/plasma-widget-metadata.json" \
    
      129        "${pkgdir}/usr/share/plasma/plasmoids/com.akiflow.panelwidget/metadata.json"
    
      130    install -Dm644 "${srcdir}/plasma-widget-main.qml" \
    
      131        "${pkgdir}/usr/share/plasma/plasmoids/com.akiflow.panelwidget/contents/ui/main.qml"
    
      132    install -Dm644 "${srcdir}/plasma-widget-CompactRepresentation.qml" \
    
      133        "${pkgdir}/usr/share/plasma/plasmoids/com.akiflow.panelwidget/contents/ui/CompactRepresentation.qml"
    
      134    install -Dm644 "${srcdir}/plasma-widget-FullRepresentation.qml" \
    
      135        "${pkgdir}/usr/share/plasma/plasmoids/com.akiflow.panelwidget/contents/ui/FullRepresentation.qml"
    
      136    install -Dm644 "${srcdir}/plasma-widget-akiflow.png" \
    
      137        "${pkgdir}/usr/share/plasma/plasmoids/com.akiflow.panelwidget/contents/icons/akiflow.png"
    
      138}
    
      139

Changes since previous scan

--- PKGBUILD @ 2026-10-24 00:14
+++ PKGBUILD @ 2026-11-01 00:21
@@ -2,9 +2,9 @@
 # Akiflow Desktop for Linux (unofficial)
 
 pkgname=akiflow-bin
-pkgver=2.72.5
+pkgver=2.83.8
 pkgrel=1
-_buildhash=7536ef84
+_buildhash=9f6f1262
 pkgdesc="Akiflow - Time blocking and task management (unofficial Linux build)"
 arch=('x86_64')
 url="https://akiflow.com"
@@ -19,13 +19,8 @@
         "plasma-widget-CompactRepresentation.qml::${_ghraw}/plasma-widget/package/contents/ui/CompactRepresentation.qml"
         "plasma-widget-FullRepresentation.qml::${_ghraw}/plasma-widget/package/contents/ui/FullRepresentation.qml"
         "plasma-widget-akiflow.png::${_ghraw}/plasma-widget/package/contents/icons/akiflow.png")
-sha512sums=('e4aeadcf7ec8a2a9c46dda84fe59d1cf38898808f891d28f98c73c8e1514d61051f4fa19215774c56c5c297befddefce4f8e55a6ec9bc92ed5d6a8b59c5a155d'
-            'SKIP'
-            'SKIP'
-            'SKIP'
-            'SKIP'
-            'SKIP'
-            'SKIP')
+sha512sums=('f8764b23aa378b0ab4760284f80072e68756a82ae546bfaffc795abf514df59ff2953d04f15f03a3bb00667ebf44ad864bf11214d57445fe332255d65d8314d9'
+            'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP' 'SKIP')
 
 prepare() {
     cd "${srcdir}"

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Medium	2
2026-10-31 00:07:41	Medium	2
2026-10-30 00:29:30	Medium	2
2026-10-29 00:13:55	Medium	2
2026-10-28 00:06:54	Medium	2
2026-10-27 00:23:28	Medium	2
2026-10-26 00:12:40	Medium	2
2026-10-25 09:42:04	Medium	2
2026-10-25 00:20:48	Medium	2
2026-10-24 21:41:28	Medium	2
2026-10-24 00:14:55	Medium	2
2026-10-23 00:02:19	Medium	2
2026-10-22 00:13:10	Medium	2
2026-10-21 00:12:50	Medium	2
2026-10-20 00:10:31	Medium	2
2026-10-19 00:03:55	Medium	2
2026-10-18 00:06:55	Medium	2
2026-10-17 00:21:55	Medium	2
2026-10-16 00:12:47	Medium	2
2026-10-15 00:28:05	Medium	2