ayugram-desktop-bin
maintainer RSG245
· 29 votes
· scanned 2026-08-03 00:08:14.047287
MEDIUM
View on AUR ↗
Why flagged
The package downloads a prebuilt binary package from a non-standard, third-party CDN (cdn77.cachyos.org) which is not the project's official release infrastructure, creating a supply-chain risk if the host is compromised or the source is swapped.
Triggered rules
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:31
source=("https://cdn77.cachyos.org/repo/${CARCH}/cachyos/ayugram-desktop-${pkgver}-${pkgrel}-${CARCH}.pkg.tar.zst")
MEDIUM
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-07-25) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads a prebuilt binary package from a non-standard, third-party CDN (cdn77.cachyos.org) which is not the project's official release infrastructure, creating a supply-chain risk if the host is compromised or the source is swapped.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Maxim Balashov <me@rsg.su>
2
3
pkgname=ayugram-desktop-bin
4
pkgver=6.7.8
5
pkgrel=7
6
pkgdesc="Desktop Telegram client with good customization and Ghost mode"
7
arch=(x86_64)
8
url="https://github.com/AyuGram/AyuGramDesktop"
9
license=('GPL-3.0-or-later')
10
depends=(
11
'abseil-cpp' 'ada' 'ffmpeg' 'glib2' 'glibc' 'hicolor-icon-theme'
12
'hunspell' 'kcoreaddons' 'libavif' 'libdispatch' 'libgcc' 'libheif'
13
'libjpeg-turbo' 'libjxl' 'libstdc++' 'libvpx' 'libx11' 'libxcb'
14
'libxcomposite' 'libxdamage' 'libxext' 'libxfixes' 'libxkbcommon'
15
'libxrandr' 'libxtst' 'lz4' 'minizip' 'openal' 'openh264' 'openssl'
16
'opus' 'libpipewire' 'protobuf' 'qt6-base' 'qt6-declarative'
17
'qt6-svg' 'qt6-wayland' 'rnnoise'
18
'xcb-util-keysyms' 'xxhash' 'zlib'
19
)
20
optdepends=(
21
'geoclue: geoinformation support'
22
'geocode-glib-2: geocoding support'
23
'webkit2gtk-4.1: embedded browser features provided by webkit2gtk-4.1'
24
'webkitgtk-6.0: embedded browser features provided by webkitgtk-6.0 (Wayland only)'
25
'xdg-desktop-portal: desktop integration'
26
)
27
provides=('ayugram-desktop')
28
conflicts=('ayugram-desktop')
29
options=('!debug')
30
31
source=("https://cdn77.cachyos.org/repo/${CARCH}/cachyos/ayugram-desktop-${pkgver}-${pkgrel}-${CARCH}.pkg.tar.zst")
32
sha256sums=('9d569ababce6f7a53c13a023f242abfbc47377aa4bc589b40f2d4499a118fed3')
33
34
package() {
35
# Binary
36
install -Dm755 "$srcdir/usr/bin/AyuGram" "$pkgdir/usr/bin/AyuGram"
37
38
# Desktop entry
39
install -Dm644 "$srcdir/usr/share/applications/com.ayugram.desktop.desktop" \
40
"$pkgdir/usr/share/applications/com.ayugram.desktop.desktop"
41
42
# DBus service
43
install -Dm644 "$srcdir/usr/share/dbus-1/services/com.ayugram.desktop.service" \
44
"$pkgdir/usr/share/dbus-1/services/com.ayugram.desktop.service"
45
46
# Metainfo
47
install -Dm644 "$srcdir/usr/share/metainfo/com.ayugram.desktop.metainfo.xml" \
48
"$pkgdir/usr/share/metainfo/com.ayugram.desktop.metainfo.xml"
49
50
# Standard icons
51
local icon_size
52
for icon_size in 16 32 48 64 128 256 512; do
53
install -Dm644 "$srcdir/usr/share/icons/hicolor/${icon_size}x${icon_size}/apps/com.ayugram.desktop.png" \
54
"$pkgdir/usr/share/icons/hicolor/${icon_size}x${icon_size}/apps/com.ayugram.desktop.png"
55
done
56
57
# HiDPI (@2x) icons
58
for icon_size in 16 32 48 64 128 256 512; do
59
install -Dm644 "$srcdir/usr/share/icons/hicolor/${icon_size}x${icon_size}@2/apps/com.ayugram.desktop.png" \
60
"$pkgdir/usr/share/icons/hicolor/${icon_size}x${icon_size}@2/apps/com.ayugram.desktop.png"
61
done
62
63
# Symbolic icons
64
local sym_icon
65
for sym_icon in com.ayugram.desktop-attention-symbolic.svg \
66
com.ayugram.desktop-mute-symbolic.svg \
67
com.ayugram.desktop-symbolic.svg; do
68
install -Dm644 "$srcdir/usr/share/icons/hicolor/symbolic/apps/${sym_icon}" \
69
"$pkgdir/usr/share/icons/hicolor/symbolic/apps/${sym_icon}"
70
done
71
}
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | MEDIUM | 2 |
| 2026-08-02 00:16:08 | MEDIUM | 2 |
| 2026-08-01 00:11:18 | MEDIUM | 2 |
| 2026-07-31 00:14:10 | MEDIUM | 2 |
| 2026-07-30 00:17:23 | MEDIUM | 2 |
| 2026-07-29 00:25:53 | MEDIUM | 2 |
| 2026-07-28 00:07:28 | MEDIUM | 2 |
| 2026-07-27 00:24:32 | MEDIUM | 2 |
| 2026-07-26 00:07:32 | MEDIUM | 2 |
| 2026-07-25 00:13:44 | MEDIUM | 2 |
| 2026-07-24 00:02:28 | MEDIUM | 2 |
| 2026-07-23 00:14:47 | MEDIUM | 2 |
| 2026-07-22 00:29:32 | MEDIUM | 2 |
| 2026-07-21 00:24:15 | MEDIUM | 2 |
| 2026-07-20 00:19:49 | MEDIUM | 2 |
| 2026-07-19 00:17:08 | MEDIUM | 2 |
| 2026-07-18 00:14:48 | MEDIUM | 2 |
| 2026-07-17 00:06:16 | MEDIUM | 2 |
| 2026-07-16 00:05:41 | MEDIUM | 2 |
| 2026-07-15 00:09:25 | MEDIUM | 2 |