ayugram-desktop-bin
MEDIUM
maintainer RSG245
31 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The package downloads a prebuilt binary from a non-standard, third-party CDN (cdn77.cachyos.org), which is not the project's official release infrastructure, creating a supply-chain risk if the host were compromised or the source silently swapped.
Triggered rules
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:31
source=("https://cdn77.cachyos.org/repo/${CARCH}/cachyos/ayugram-desktop-${pkgver}-${pkgrel}-${CARCH}.pkg.tar.zst")
Medium
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt binary from a non-standard, third-party CDN (cdn77.cachyos.org), which is not the project's official release infrastructure, creating a supply-chain risk if the host were compromised or the source silently swapped.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Maxim Balashov <me@rsg.su>
2
3
pkgname=ayugram-desktop-bin
4
pkgver=7.0.9
5
pkgrel=3
6
pkgdesc="Desktop Telegram client with good customization and Ghost mode"
7
arch=(x86_64)
8
url="https://github.com/AyuGram/AyuGramDesktop"
9
license=('GPL-3.0-or-later')
10
depends=(
11
'abseil-cpp' 'ada' 'ffmpeg' 'glib2' 'glibc' 'hicolor-icon-theme'
12
'hunspell' 'kcoreaddons' 'libavif' 'libdispatch' 'libgcc' 'libheif'
13
'libjpeg-turbo' 'libjxl' 'libstdc++' 'libvpx' 'libx11' 'libxcb'
14
'libxcomposite' 'libxdamage' 'libxext' 'libxfixes' 'libxkbcommon'
15
'libxrandr' 'libxtst' 'lz4' 'minizip' 'openal' 'openh264' 'openssl'
16
'opus' 'libpipewire' 'protobuf' 'qt6-base' 'qt6-declarative'
17
'qt6-svg' 'qt6-wayland' 'rnnoise'
18
'xcb-util-keysyms' 'xxhash' 'zlib' 'libfido2' 'qt6-imageformats'
19
)
20
optdepends=(
21
'geoclue: geoinformation support'
22
'geocode-glib-2: geocoding support'
23
'webkit2gtk-4.1: embedded browser features provided by webkit2gtk-4.1'
24
'webkitgtk-6.0: embedded browser features provided by webkitgtk-6.0 (Wayland only)'
25
'xdg-desktop-portal: desktop integration'
26
)
27
provides=('ayugram-desktop')
28
conflicts=('ayugram-desktop')
29
options=('!debug')
30
31
source=("https://cdn77.cachyos.org/repo/${CARCH}/cachyos/ayugram-desktop-${pkgver}-${pkgrel}-${CARCH}.pkg.tar.zst")
32
sha256sums=('8b0d0c517196327aae7ea7ebf97c4fcb92606ad946da1a05911970d9fa784967')
33
34
package() {
35
# Binary
36
install -Dm755 "$srcdir/usr/bin/AyuGram" "$pkgdir/usr/bin/AyuGram"
37
38
# Desktop entry
39
install -Dm644 "$srcdir/usr/share/applications/com.ayugram.desktop.desktop" \
40
"$pkgdir/usr/share/applications/com.ayugram.desktop.desktop"
41
42
# DBus service
43
install -Dm644 "$srcdir/usr/share/dbus-1/services/com.ayugram.desktop.service" \
44
"$pkgdir/usr/share/dbus-1/services/com.ayugram.desktop.service"
45
46
# Metainfo
47
install -Dm644 "$srcdir/usr/share/metainfo/com.ayugram.desktop.metainfo.xml" \
48
"$pkgdir/usr/share/metainfo/com.ayugram.desktop.metainfo.xml"
49
50
# Standard icons
51
local icon_size
52
for icon_size in 16 32 48 64 128 256 512; do
53
install -Dm644 "$srcdir/usr/share/icons/hicolor/${icon_size}x${icon_size}/apps/com.ayugram.desktop.png" \
54
"$pkgdir/usr/share/icons/hicolor/${icon_size}x${icon_size}/apps/com.ayugram.desktop.png"
55
done
56
57
# HiDPI (@2x) icons
58
for icon_size in 16 32 48 64 128 256 512; do
59
install -Dm644 "$srcdir/usr/share/icons/hicolor/${icon_size}x${icon_size}@2/apps/com.ayugram.desktop.png" \
60
"$pkgdir/usr/share/icons/hicolor/${icon_size}x${icon_size}@2/apps/com.ayugram.desktop.png"
61
done
62
63
# Symbolic icons
64
local sym_icon
65
for sym_icon in com.ayugram.desktop-attention-symbolic.svg \
66
com.ayugram.desktop-mute-symbolic.svg \
67
com.ayugram.desktop-symbolic.svg; do
68
install -Dm644 "$srcdir/usr/share/icons/hicolor/symbolic/apps/${sym_icon}" \
69
"$pkgdir/usr/share/icons/hicolor/symbolic/apps/${sym_icon}"
70
done
71
}
72
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Medium | 2 |
| 2026-10-31 00:07:41 | Medium | 2 |
| 2026-10-30 00:29:30 | Medium | 2 |
| 2026-10-29 00:13:55 | Medium | 2 |
| 2026-10-28 00:06:54 | Medium | 2 |
| 2026-10-27 00:23:28 | Medium | 2 |
| 2026-10-26 00:12:40 | Medium | 2 |
| 2026-10-25 00:20:48 | Medium | 2 |
| 2026-10-24 00:14:55 | Medium | 2 |
| 2026-10-23 00:02:19 | Medium | 2 |
| 2026-10-22 00:13:10 | Medium | 2 |
| 2026-10-21 00:12:50 | Medium | 2 |
| 2026-10-20 00:10:31 | Medium | 2 |
| 2026-10-19 00:03:55 | Medium | 2 |
| 2026-10-18 00:06:55 | Medium | 2 |
| 2026-10-17 00:21:55 | Medium | 2 |
| 2026-10-16 00:12:47 | Medium | 2 |
| 2026-10-15 00:28:05 | Medium | 2 |
| 2026-10-14 00:06:47 | Medium | 2 |
| 2026-10-13 00:23:45 | Medium | 2 |