ayugram-desktop-bin
MEDIUM
maintainer RSG245
31 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads a prebuilt binary from a non-standard, third-party CDN (cdn77.cachyos.org), which is not the project's official release infrastructure, creating a supply-chain risk if the host were compromised or the source silently swapped.
Triggered rules
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:31
source=("https://cdn77.cachyos.org/repo/${CARCH}/cachyos/ayugram-desktop-${pkgver}-${pkgrel}-${CARCH}.pkg.tar.zst")
Medium
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt binary from a non-standard, third-party CDN (cdn77.cachyos.org), which is not the project's official release infrastructure, creating a supply-chain risk if the host were compromised or the source silently swapped.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Maxim Balashov <me@rsg.su>
2
3
pkgname=ayugram-desktop-bin
4
pkgver=7.0.9
5
pkgrel=3
6
pkgdesc="Desktop Telegram client with good customization and Ghost mode"
7
arch=(x86_64)
8
url="https://github.com/AyuGram/AyuGramDesktop"
9
license=('GPL-3.0-or-later')
10
depends=(
11
'abseil-cpp' 'ada' 'ffmpeg' 'glib2' 'glibc' 'hicolor-icon-theme'
12
'hunspell' 'kcoreaddons' 'libavif' 'libdispatch' 'libgcc' 'libheif'
13
'libjpeg-turbo' 'libjxl' 'libstdc++' 'libvpx' 'libx11' 'libxcb'
14
'libxcomposite' 'libxdamage' 'libxext' 'libxfixes' 'libxkbcommon'
15
'libxrandr' 'libxtst' 'lz4' 'minizip' 'openal' 'openh264' 'openssl'
16
'opus' 'libpipewire' 'protobuf' 'qt6-base' 'qt6-declarative'
17
'qt6-svg' 'qt6-wayland' 'rnnoise'
18
'xcb-util-keysyms' 'xxhash' 'zlib' 'libfido2' 'qt6-imageformats'
19
)
20
optdepends=(
21
'geoclue: geoinformation support'
22
'geocode-glib-2: geocoding support'
23
'webkit2gtk-4.1: embedded browser features provided by webkit2gtk-4.1'
24
'webkitgtk-6.0: embedded browser features provided by webkitgtk-6.0 (Wayland only)'
25
'xdg-desktop-portal: desktop integration'
26
)
27
provides=('ayugram-desktop')
28
conflicts=('ayugram-desktop')
29
options=('!debug')
30
31
source=("https://cdn77.cachyos.org/repo/${CARCH}/cachyos/ayugram-desktop-${pkgver}-${pkgrel}-${CARCH}.pkg.tar.zst")
32
sha256sums=('8b0d0c517196327aae7ea7ebf97c4fcb92606ad946da1a05911970d9fa784967')
33
34
package() {
35
# Binary
36
install -Dm755 "$srcdir/usr/bin/AyuGram" "$pkgdir/usr/bin/AyuGram"
37
38
# Desktop entry
39
install -Dm644 "$srcdir/usr/share/applications/com.ayugram.desktop.desktop" \
40
"$pkgdir/usr/share/applications/com.ayugram.desktop.desktop"
41
42
# DBus service
43
install -Dm644 "$srcdir/usr/share/dbus-1/services/com.ayugram.desktop.service" \
44
"$pkgdir/usr/share/dbus-1/services/com.ayugram.desktop.service"
45
46
# Metainfo
47
install -Dm644 "$srcdir/usr/share/metainfo/com.ayugram.desktop.metainfo.xml" \
48
"$pkgdir/usr/share/metainfo/com.ayugram.desktop.metainfo.xml"
49
50
# Standard icons
51
local icon_size
52
for icon_size in 16 32 48 64 128 256 512; do
53
install -Dm644 "$srcdir/usr/share/icons/hicolor/${icon_size}x${icon_size}/apps/com.ayugram.desktop.png" \
54
"$pkgdir/usr/share/icons/hicolor/${icon_size}x${icon_size}/apps/com.ayugram.desktop.png"
55
done
56
57
# HiDPI (@2x) icons
58
for icon_size in 16 32 48 64 128 256 512; do
59
install -Dm644 "$srcdir/usr/share/icons/hicolor/${icon_size}x${icon_size}@2/apps/com.ayugram.desktop.png" \
60
"$pkgdir/usr/share/icons/hicolor/${icon_size}x${icon_size}@2/apps/com.ayugram.desktop.png"
61
done
62
63
# Symbolic icons
64
local sym_icon
65
for sym_icon in com.ayugram.desktop-attention-symbolic.svg \
66
com.ayugram.desktop-mute-symbolic.svg \
67
com.ayugram.desktop-symbolic.svg; do
68
install -Dm644 "$srcdir/usr/share/icons/hicolor/symbolic/apps/${sym_icon}" \
69
"$pkgdir/usr/share/icons/hicolor/symbolic/apps/${sym_icon}"
70
done
71
}
72
Changes since previous scan
--- PKGBUILD @ 2026-09-15 00:25+++ PKGBUILD @ 2026-09-17 00:27@@ -2,7 +2,7 @@ pkgname=ayugram-desktop-bin pkgver=7.0.9-pkgrel=2+pkgrel=3 pkgdesc="Desktop Telegram client with good customization and Ghost mode" arch=(x86_64) url="https://github.com/AyuGram/AyuGramDesktop"@@ -29,7 +29,7 @@ options=('!debug') source=("https://cdn77.cachyos.org/repo/${CARCH}/cachyos/ayugram-desktop-${pkgver}-${pkgrel}-${CARCH}.pkg.tar.zst")-sha256sums=('991a8e944dffedf2d0f2f8934064a4cf0b65f33c5a217e2683d82652f42ba334')+sha256sums=('8b0d0c517196327aae7ea7ebf97c4fcb92606ad946da1a05911970d9fa784967') package() { # BinaryScan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Medium | 2 |
| 2026-09-16 00:03:17 | Medium | 2 |
| 2026-09-15 01:18:20 | Medium | 2 |
| 2026-09-15 00:25:31 | Medium | 2 |
| 2026-09-14 00:27:57 | Medium | 2 |
| 2026-09-13 00:19:54 | Medium | 2 |
| 2026-09-12 00:25:17 | Medium | 2 |
| 2026-09-11 00:19:22 | Medium | 2 |
| 2026-09-10 00:22:44 | Medium | 2 |
| 2026-09-09 00:04:09 | Medium | 2 |
| 2026-09-08 00:18:08 | Medium | 2 |
| 2026-09-07 00:30:15 | Medium | 2 |
| 2026-09-06 00:17:06 | Medium | 2 |
| 2026-09-05 00:16:27 | Medium | 2 |
| 2026-09-04 00:03:13 | Medium | 2 |
| 2026-09-03 00:15:47 | Medium | 2 |
| 2026-09-02 00:02:31 | Medium | 2 |
| 2026-09-01 00:11:19 | Medium | 2 |
| 2026-08-31 00:19:57 | Medium | 2 |
| 2026-08-30 13:42:42 | Medium | 2 |