beeper-v4-bin

MEDIUM

maintainer mathix 0 votes scanned 2026-09-03 15:53:41.931206

View on AUR

Why flagged

The package downloads and repacks a prebuilt AppImage from an official domain but skips checksum verification, creating a supply-chain risk if the download source is compromised.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 90%): The package downloads and repacks a prebuilt AppImage from an official domain but skips checksum verification, creating a supply-chain risk if the download source is compromised.

PKGBUILD

      1# Maintainer: Arnaud Gissinger (contact: mathix.dev)
    
      2
    
      3## options
    
      4: ${_autoupdate:=true}
    
      5
    
      6: ${_install_path:=opt}
    
      7
    
      8: ${_pkgtype=-v4-bin}
    
      9
    
      10# basic info
    
      11_pkgname='beeper'
    
      12pkgname="$_pkgname${_pkgtype:-}"
    
      13pkgver=4.3.73
    
      14pkgrel=1
    
      15pkgdesc="The ultimate messaging app"
    
      16depends=(libappindicator-gtk3 libnotify libsecret hicolor-icon-theme)
    
      17makedepends=(asar)
    
      18url="https://www.beeper.com/beta"
    
      19license=('LicenseRef-beeper')
    
      20arch=('x86_64')
    
      21
    
      22options=('!strip' '!debug')
    
      23
    
      24_source_main() {
    
      25  provides=("$_pkgname")
    
      26  conflicts=("$_pkgname")
    
      27
    
      28  source=("$_filename"::"$_dl_url")
    
      29  sha256sums=('SKIP')
    
      30}
    
      31
    
      32pkgver() {
    
      33  printf '%s' "${_pkgver:?}"
    
      34}
    
      35
    
      36build() {
    
      37  # extract appimage
    
      38  chmod +x "$_filename"
    
      39  "$srcdir/$_filename" --appimage-extract
    
      40
    
      41  # fix apprun script
    
      42  sed -Ei \
    
      43    's@^(if \[ -z \"\$APPDIR\" ] ; then)$@APPDIR="/'"$_install_path"'/beeper"\n\1@' \
    
      44    "$srcdir/squashfs-root/AppRun"
    
      45}
    
      46
    
      47_package_beeper() {
    
      48  # apprun script
    
      49  install -Dm755 "$srcdir/squashfs-root/AppRun" "$pkgdir/usr/bin/beeper"
    
      50
    
      51  # The app source is now packed into an asar archive (resources/app.asar) with
    
      52  # native modules kept in resources/app.asar.unpacked. To patch the source we
    
      53  # extract the archive, edit it, then repack preserving the same unpacked set.
    
      54  local _app_dir="$srcdir/squashfs-root/resources"
    
      55  local _asar_file="$_app_dir/app.asar"
    
      56  local _extract_dir="$srcdir/app.asar.extracted"
    
      57  # exact list of currently-unpacked files, used as the repack --unpack glob
    
      58  local _unpacked_files_glob
    
      59  _unpacked_files_glob="{$(cd "$_asar_file.unpacked" && find . -type f | sed -E 's,^\./,,' | paste -s -d, -)}"
    
      60  asar extract "$_asar_file" "$_extract_dir"
    
      61
    
      62  # replace registerLinuxConfig function
    
      63  # Find the file that exports registerLinuxConfig and replace the export statement.
    
      64  # The upstream filename has changed across versions (e.g. linux-*.mjs, main-entry-*.mjs),
    
      65  # so locate it by content instead of hardcoding the name.
    
      66  local _main_dir="$_extract_dir/build/main"
    
      67  local _linux_config_file
    
      68  _linux_config_file=$(grep -lE 'export\{[a-zA-Z0-9_]+ as registerLinuxConfig\};' "$_main_dir"/*.mjs | head -n1)
    
      69  if [ -z "$_linux_config_file" ]; then
    
      70    echo "error: could not find file exporting registerLinuxConfig in $_main_dir" >&2
    
      71    return 1
    
      72  fi
    
      73  sed -i 's/export{[a-zA-Z0-9_]* as registerLinuxConfig};/const noopFunc=function(){};export{noopFunc as registerLinuxConfig};/' "$_linux_config_file"
    
      74
    
      75  # repack into a new asar, unpacking the same files as the original
    
      76  asar pack --unpack "$_extract_dir/$_unpacked_files_glob" "$_extract_dir" "$srcdir/app.asar"
    
      77  # sanity-check: repacked unpacked files must be byte-identical to the originals.
    
      78  # We keep the original app.asar.unpacked dir (extraction drops the executable
    
      79  # bit on native binaries), so only the app.asar archive itself is replaced.
    
      80  # null-delimited so filenames with spaces (e.g. "Beeper Squared.png") survive
    
      81  local _fp
    
      82  while IFS= read -r -d '' _fp; do
    
      83    cmp "$_app_dir/app.asar.unpacked/$_fp" "$srcdir/app.asar.unpacked/$_fp" || return 1
    
      84  done < <(cd "$_app_dir/app.asar.unpacked" && find . -type f -print0)
    
      85  mv -Tf "$srcdir/app.asar" "$_asar_file"
    
      86
    
      87  # everything else
    
      88  install -dm755 "$pkgdir/$_install_path"
    
      89  mv "$srcdir/squashfs-root" "$pkgdir/$_install_path/beeper"
    
      90
    
      91  # remove default .desktop file
    
      92  rm -f "$pkgdir/$_install_path/beeper/beepertexts.desktop"
    
      93}
    
      94
    
      95package() {
    
      96  depends+=('hicolor-icon-theme')
    
      97
    
      98  # Window class the app actually uses at runtime, so launchers and Wayland
    
      99  # compositors (e.g. sway) can map the window to this entry and its icon.
    
      100  # Upstream declares it in its bundled .desktop (currently "Beeper"); read it
    
      101  # from there so we stay correct if it changes, falling back to "Beeper".
    
      102  local _wmclass
    
      103  _wmclass=$(sed -nE 's/^StartupWMClass=(.+)$/\1/p' "$srcdir/squashfs-root/beepertexts.desktop" | head -n1)
    
      104  : "${_wmclass:=Beeper}"
    
      105
    
      106  # desktop file
    
      107  install -Dm644 /dev/stdin "$pkgdir/usr/share/applications/beeper.desktop" << END
    
      108[Desktop Entry]
    
      109Type=Application
    
      110Name=${_pkgname^}
    
      111GenericName=Unified Messenger
    
      112Comment=$pkgdesc
    
      113Exec=$_pkgname --no-sandbox %U
    
      114Icon=beepertexts
    
      115Terminal=false
    
      116StartupWMClass=$_wmclass
    
      117X-AppImage-Version=$pkgver
    
      118MimeType=x-scheme-handler/beeper;x-scheme-handler/matrix;x-scheme-handler/element;
    
      119Categories=Network;InstantMessaging;
    
      120END
    
      121
    
      122  # icon
    
      123  install -Dm644 \
    
      124    "$srcdir/squashfs-root/usr/share/icons/hicolor/512x512/apps/beepertexts.png" \
    
      125    -t "$pkgdir/usr/share/icons/hicolor/512x512/apps"
    
      126
    
      127  # license files
    
      128  install -Dm644 "$srcdir/squashfs-root/LICENSE.electron.txt" -t "$pkgdir/usr/share/licenses/$pkgname/"
    
      129  install -Dm644 "$srcdir/squashfs-root/LICENSES.chromium.html" -t "$pkgdir/usr/share/licenses/$pkgname/"
    
      130
    
      131  _package_beeper
    
      132
    
      133  # fix permissions
    
      134  chmod -R u+rwX,go+rX,go-w "$pkgdir"
    
      135}
    
      136
    
      137_update_version() {
    
      138  : ${_pkgver:=$pkgver}
    
      139
    
      140  if [[ "${_autoupdate::1}" != 't' ]]; then
    
      141    return
    
      142  fi
    
      143
    
      144  _dl_url="https://api.beeper.com/desktop/download/linux/x64/stable/com.automattic.beeper.desktop"
    
      145
    
      146  _filename=$(
    
      147    curl -v -L --no-progress-meter -r 0-1 "$_dl_url" 2>&1 > /dev/null \
    
      148      | grep "GET /builds/" \
    
      149      | sed -E 's@^.*GET /builds/([^ ]+) HTTP/2.*$@\1@'
    
      150  )
    
      151
    
      152  _pkgver_new=$(
    
      153    printf '%s' "$_filename" \
    
      154      | sed -E 's@^Beeper-([0-9]+\.[0-9]+\.[0-9]+)(.*)?.AppImage$@\1@'
    
      155  )
    
      156
    
      157  # update _pkgver
    
      158  if [ "$_pkgver" != "${_pkgver_new:?}" ]; then
    
      159    _pkgver="$_pkgver_new"
    
      160  fi
    
      161}
    
      162
    
      163_update_version
    
      164_source_main
    
      165

Changes since previous scan

--- PKGBUILD @ 2026-08-27 17:33
+++ PKGBUILD @ 2026-09-03 15:53
@@ -10,7 +10,7 @@
 # basic info
 _pkgname='beeper'
 pkgname="$_pkgname${_pkgtype:-}"
-pkgver=4.3.57
+pkgver=4.3.73
 pkgrel=1
 pkgdesc="The ultimate messaging app"
 depends=(libappindicator-gtk3 libnotify libsecret hicolor-icon-theme)

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-03 15:53:41	Medium	2
2026-08-27 17:33:13	Clean	0
2026-08-20 23:13:41	Clean	0
2026-08-20 15:11:35	Clean	0
2026-08-12 23:25:14	Clean	0
2026-07-30 23:17:02	Clean	0
2026-07-23 21:26:05	Clean	0
2026-07-23 17:25:21	Clean	0
2026-07-15 11:48:30	Clean	0
2026-07-08 23:29:23	Clean	0
2026-07-02 20:47:17	Clean	0
2026-07-01 18:42:17	Clean	0
2026-06-18 16:11:54	Clean	0