bluebubbles-beta-bin
LOW
maintainer nertwork
0 votes
scanned 2026-10-17 00:21:55.226236
Why flagged
The flagged pattern involves a Python script modifying a binary library, but this is a legitimate build-time patch for input handling in a Flutter app; no obfuscated payload or remote code execution is present.
Triggered rules
Low
AI review of an ambiguous pattern
llm_review
The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it LOW (confidence 95%): The flagged pattern involves a Python script modifying a binary library, but this is a legitimate build-time patch for input handling in a Flutter app; no obfuscated payload or remote code execution is present.
-
PKGBUILD:43
sha256sums_x86_64=('a9ed17847b7f068b1b79610d2fa39a986a1bf452fda3ffea97572a516986b668')
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Nertwork <admin@nertwork.com>
2
# Contributor: Topaz <topazRN@protonmail.com>
3
# Contributor: Josh <joshring@gmail.com>
4
pkgname=bluebubbles-beta-bin
5
_pkgname=BlueBubbles
6
pkgver=2.1.3+desktop.93
7
_tagver="2.1.3%2Bdesktop.93"
8
pkgrel=2
9
pkgdesc="A cross-platform app ecosystem, bringing iMessage to Linux, Android, and Windows (Beta Prebuilt Release)"
10
arch=('x86_64' 'aarch64')
11
url="https://bluebubbles.app/"
12
_ghurl="https://github.com/BlueBubblesApp/bluebubbles-app"
13
license=('Apache-2.0')
14
provides=("bluebubbles-beta=${pkgver}" "bluebubbles")
15
conflicts=("bluebubbles" "bluebubbles-bin" "bluebubbles-git")
16
depends=(
17
'webkit2gtk-4.1'
18
'gdk-pixbuf2'
19
'mpv'
20
'libdbusmenu-glib'
21
'libnotify'
22
'libappindicator-gtk3'
23
'libayatana-indicator'
24
'libayatana-appindicator'
25
'libepoxy'
26
'fontconfig'
27
'noto-fonts-emoji'
28
'gtk3'
29
)
30
makedepends=(
31
'gendesk'
32
'patchelf'
33
'python'
34
)
35
options=(
36
'!emptydirs'
37
'!strip'
38
)
39
source_x86_64=("bluebubbles-beta-${pkgver}-x86_64.tar.gz::${_ghurl}/releases/download/v${_tagver}/bluebubbles-linux-x86_64.tar.gz")
40
source_aarch64=("bluebubbles-beta-${pkgver}-aarch64.tar.gz::${_ghurl}/releases/download/v${_tagver}/bluebubbles-linux-aarch64.tar.gz")
41
source=("bluebubbles-beta.sh")
42
sha256sums=('efe4503308a1e4e44b892065b6fb8f582bd2f7d01e3f0232e4d86539101ebbb5')
43
sha256sums_x86_64=('a9ed17847b7f068b1b79610d2fa39a986a1bf452fda3ffea97572a516986b668')
44
sha256sums_aarch64=('190c223a77db0404d76d4a189e5bdee36475d4988ea9c5fb1bf36b66844a2491')
45
46
prepare() {
47
sed -i -e "
48
s/@appname@/bluebubbles-beta/g
49
s/@runname@/bluebubbles-beta/g
50
" "${srcdir}/bluebubbles-beta.sh"
51
gendesk -f -n -q \
52
--pkgname="bluebubbles-beta" \
53
--pkgdesc="${pkgdesc}" \
54
--categories="Network" \
55
--name="${_pkgname} Beta" \
56
--custom="StartupWMClass=bluebubbles" \
57
--exec="bluebubbles-beta %U"
58
}
59
60
package() {
61
install -Dm755 "${srcdir}/bluebubbles-beta.sh" "${pkgdir}/usr/bin/bluebubbles-beta"
62
ln -sf "/usr/bin/bluebubbles-beta" "${pkgdir}/usr/bin/bluebubbles"
63
install -Dm755 "${srcdir}/bluebubbles" "${pkgdir}/usr/lib/bluebubbles-beta/bluebubbles-beta.real"
64
cat <<'EOF' > "${pkgdir}/usr/lib/bluebubbles-beta/bluebubbles-beta"
65
#!/usr/bin/env bash
66
export GDK_BACKEND=x11
67
export GDK_SCALE="${GDK_SCALE:-2}"
68
export GTK_IM_MODULE=simple
69
70
# Populate NotoColorEmoji.ttf as apple.ttf for Skia color emoji rendering
71
_BB_FONT_DIR="${XDG_DATA_HOME:-$HOME/.local/share}/app.bluebubbles.BlueBubbles/font"
72
mkdir -p "${_BB_FONT_DIR}" 2>/dev/null || true
73
chmod 0755 "${_BB_FONT_DIR}" 2>/dev/null || true
74
if [ ! -s "${_BB_FONT_DIR}/apple.ttf" ] && [ -f /usr/share/fonts/noto/NotoColorEmoji.ttf ]; then
75
cp -f /usr/share/fonts/noto/NotoColorEmoji.ttf "${_BB_FONT_DIR}/apple.ttf" 2>/dev/null || true
76
fi
77
78
if command -v prime-run >/dev/null 2>&1; then
79
exec prime-run "/usr/lib/bluebubbles-beta/bluebubbles-beta.real" --class=bluebubbles "$@"
80
else
81
exec -a bluebubbles "/usr/lib/bluebubbles-beta/bluebubbles-beta.real" --class=bluebubbles "$@"
82
fi
83
EOF
84
chmod 755 "${pkgdir}/usr/lib/bluebubbles-beta/bluebubbles-beta"
85
cp -r --no-preserve=ownership "${srcdir}/"{data,lib} "${pkgdir}/usr/lib/bluebubbles-beta"
86
87
# Fix bundled objectbox RPATH leaking CI runner build directory
88
if [ -f "${pkgdir}/usr/lib/bluebubbles-beta/lib/libobjectbox.so" ]; then
89
patchelf --set-rpath '$ORIGIN' "${pkgdir}/usr/lib/bluebubbles-beta/lib/libobjectbox.so"
90
fi
91
92
# Patch FlKeyEmbedderResponder in libflutter_linux_gtk.so (aarch64 & x86_64):
93
# 1. Disable init_lock_bit_table (ret) so NumLock/CapsLock never get stuck in pressing_records.
94
# 2. Map Meta modifier entry in init_modifier_bit_table to X11 Mod4Mask (0x40) and
95
# LogicalKeyboardKey.superKey (0x10000010e) so Super_L (0x700e3) is automatically
96
# released by synchronize_pressed_states after WM workspace/window switches.
97
if [ -f "${pkgdir}/usr/lib/bluebubbles-beta/lib/libflutter_linux_gtk.so" ]; then
98
python3 -c '
99
import re, sys
100
p = sys.argv[1]
101
with open(p, "rb") as f:
102
d = bytearray(f.read())
103
104
# aarch64: 1. init_lock_bit_table -> ret (c0035fd6)
105
m = re.search(bytes.fromhex("fd7bbea9f44f01a9fd030091f30300aa00048052") + b"...." + bytes.fromhex("f40300aae00313aa41008052"), d, re.DOTALL)
106
if m:
107
d[m.start():m.start()+4] = bytes.fromhex("c0035fd6")
108
109
# aarch64: 2. init_modifier_bit_table Meta mask -> 0x40 (Mod4Mask)
110
m = re.search(bytes.fromhex("0100a252e20314aa"), d, re.DOTALL)
111
if m:
112
d[m.start():m.start()+4] = bytes.fromhex("01088052")
113
114
# aarch64: 3. rodata Meta primary_logical_key -> 0x10000010e (superKey)
115
m = re.search(bytes.fromhex("e3000700000000000601000002000000"), d, re.DOTALL)
116
if m:
117
d[m.start()+8:m.start()+16] = bytes.fromhex("0e01000001000000")
118
119
# x86_64: 1. init_lock_bit_table -> retq (c3)
120
m = re.search(bytes.fromhex("41574156534889fbbf20000000e8") + b"...." + bytes.fromhex("4989c6be02000000"), d, re.DOTALL)
121
if m:
122
d[m.start():m.start()+1] = bytes.fromhex("c3")
123
124
# x86_64: 2. init_modifier_bit_table Meta mask (0x40) and superKey (0x10000010e)
125
m = re.search(bytes.fromhex("be000000104889df4889c2e8") + b"...." + bytes.fromhex("41c646180049c706e3000700498d4706498946084983cf074d897e10"), d, re.DOTALL)
126
if m:
127
d[m.start():m.start()+5] = bytes.fromhex("be40000000")
128
d[m.end()-16:m.end()] = bytes.fromhex("b8870000804801c04989460849894610")
129
130
with open(p, "wb") as f:
131
f.write(d)
132
' "${pkgdir}/usr/lib/bluebubbles-beta/lib/libflutter_linux_gtk.so"
133
fi
134
135
install -Dm644 "${srcdir}/data/flutter_assets/assets/icon/icon.png" "${pkgdir}/usr/share/pixmaps/bluebubbles-beta.png"
136
ln -sf "bluebubbles-beta.png" "${pkgdir}/usr/share/pixmaps/bluebubbles.png"
137
ln -sf "/usr/lib/libmpv.so" "${pkgdir}/usr/lib/bluebubbles-beta/libmpv.so.1"
138
install -Dm644 "${srcdir}/bluebubbles-beta.desktop" -t "${pkgdir}/usr/share/applications"
139
}
140
Changes since previous scan
--- PKGBUILD @ 2026-10-13 23:18+++ PKGBUILD @ 2026-10-17 00:21@@ -1,8 +1,10 @@-# Maintainer: Custom Beta Builder <custom at aur dot archlinux dot org>+# Maintainer: Nertwork <admin@nertwork.com>+# Contributor: Topaz <topazRN@protonmail.com>+# Contributor: Josh <joshring@gmail.com> pkgname=bluebubbles-beta-bin _pkgname=BlueBubbles-pkgver=2.1.2+92-_tagver="2.1.2%2B92"+pkgver=2.1.3+desktop.93+_tagver="2.1.3%2Bdesktop.93" pkgrel=2 pkgdesc="A cross-platform app ecosystem, bringing iMessage to Linux, Android, and Windows (Beta Prebuilt Release)" arch=('x86_64' 'aarch64')@@ -10,7 +12,7 @@ _ghurl="https://github.com/BlueBubblesApp/bluebubbles-app" license=('Apache-2.0') provides=("bluebubbles-beta=${pkgver}" "bluebubbles")-conflicts=("bluebubbles" "bluebubbles-bin")+conflicts=("bluebubbles" "bluebubbles-bin" "bluebubbles-git") depends=( 'webkit2gtk-4.1' 'gdk-pixbuf2'@@ -19,20 +21,27 @@ 'libnotify' 'libappindicator-gtk3' 'libayatana-indicator'+ 'libayatana-appindicator'+ 'libepoxy'+ 'fontconfig'+ 'noto-fonts-emoji' 'gtk3' ) makedepends=( 'gendesk'+ 'patchelf'+ 'python' ) options=( '!emptydirs'+ '!strip' ) source_x86_64=("bluebubbles-beta-${pkgver}-x86_64.tar.gz::${_ghurl}/releases/download/v${_tagver}/bluebubbles-linux-x86_64.tar.gz") source_aarch64=("bluebubbles-beta-${pkgver}-aarch64.tar.gz::${_ghurl}/releases/download/v${_tagver}/bluebubbles-linux-aarch64.tar.gz") source=("bluebubbles-beta.sh") sha256sums=('efe4503308a1e4e44b892065b6fb8f582bd2f7d01e3f0232e4d86539101ebbb5')-sha256sums_x86_64=('833a5fe56dfe93a1644878bdc894832e62fca6840c6e0588b9d35e19bd04d667')-sha256sums_aarch64=('2535bb4b23484a74f5d66a94b9a5f3bd6177f5a525bf82f2dd824934e9df0089')+sha256sums_x86_64=('a9ed17847b7f068b1b79610d2fa39a986a1bf452fda3ffea97572a516986b668')+sha256sums_aarch64=('190c223a77db0404d76d4a189e5bdee36475d4988ea9c5fb1bf36b66844a2491') prepare() { sed -i -e "@@ -44,35 +53,87 @@ --pkgdesc="${pkgdesc}" \ --categories="Network" \ --name="${_pkgname} Beta" \+ --custom="StartupWMClass=bluebubbles" \ --exec="bluebubbles-beta %U" } package() { install -Dm755 "${srcdir}/bluebubbles-beta.sh" "${pkgdir}/usr/bin/bluebubbles-beta"+ ln -sf "/usr/bin/bluebubbles-beta" "${pkgdir}/usr/bin/bluebubbles" install -Dm755 "${srcdir}/bluebubbles" "${pkgdir}/usr/lib/bluebubbles-beta/bluebubbles-beta.real" cat <<'EOF' > "${pkgdir}/usr/lib/bluebubbles-beta/bluebubbles-beta"-#!/bin/bash+#!/usr/bin/env bash export GDK_BACKEND=x11+export GDK_SCALE="${GDK_SCALE:-2}" export GTK_IM_MODULE=simple -# Disable 45MB Apple Color Emoji font to prevent per-keystroke regex & font-shaping stalls on Linux+# Populate NotoColorEmoji.ttf as apple.ttf for Skia color emoji rendering _BB_FONT_DIR="${XDG_DATA_HOME:-$HOME/.local/share}/app.bluebubbles.BlueBubbles/font"-if [ -f "${_BB_FONT_DIR}/apple.ttf" ] || [ -w "${_BB_FONT_DIR}" ] || [ ! -d "${_BB_FONT_DIR}" ]; then- chmod u+w "${_BB_FONT_DIR}" 2>/dev/null || true- rm -rf "${_BB_FONT_DIR}/apple.ttf"- mkdir -p "${_BB_FONT_DIR}" 2>/dev/null || true- chmod 0555 "${_BB_FONT_DIR}" 2>/dev/null || true+mkdir -p "${_BB_FONT_DIR}" 2>/dev/null || true+chmod 0755 "${_BB_FONT_DIR}" 2>/dev/null || true+if [ ! -s "${_BB_FONT_DIR}/apple.ttf" ] && [ -f /usr/share/fonts/noto/NotoColorEmoji.ttf ]; then+ cp -f /usr/share/fonts/noto/NotoColorEmoji.ttf "${_BB_FONT_DIR}/apple.ttf" 2>/dev/null || true fi if command -v prime-run >/dev/null 2>&1; then- exec prime-run "/usr/lib/bluebubbles-beta/bluebubbles-beta.real" "$@"+ exec prime-run "/usr/lib/bluebubbles-beta/bluebubbles-beta.real" --class=bluebubbles "$@" else- exec "/usr/lib/bluebubbles-beta/bluebubbles-beta.real" "$@"+ exec -a bluebubbles "/usr/lib/bluebubbles-beta/bluebubbles-beta.real" --class=bluebubbles "$@" fi EOF chmod 755 "${pkgdir}/usr/lib/bluebubbles-beta/bluebubbles-beta" cp -r --no-preserve=ownership "${srcdir}/"{data,lib} "${pkgdir}/usr/lib/bluebubbles-beta"++ # Fix bundled objectbox RPATH leaking CI runner build directory+ if [ -f "${pkgdir}/usr/lib/bluebubbles-beta/lib/libobjectbox.so" ]; then+ patchelf --set-rpath '$ORIGIN' "${pkgdir}/usr/lib/bluebubbles-beta/lib/libobjectbox.so"+ fi++ # Patch FlKeyEmbedderResponder in libflutter_linux_gtk.so (aarch64 & x86_64):+ # 1. Disable init_lock_bit_table (ret) so NumLock/CapsLock never get stuck in pressing_records.+ # 2. Map Meta modifier entry in init_modifier_bit_table to X11 Mod4Mask (0x40) and+ # LogicalKeyboardKey.superKey (0x10000010e) so Super_L (0x700e3) is automatically+ # released by synchronize_pressed_states after WM workspace/window switches.+ if [ -f "${pkgdir}/usr/lib/bluebubbles-beta/lib/libflutter_linux_gtk.so" ]; then+ python3 -c '+import re, sys+p = sys.argv[1]+with open(p, "rb") as f:+ d = bytearray(f.read())++# aarch64: 1. init_lock_bit_table -> ret (c0035fd6)+m = re.search(bytes.fromhex("fd7bbea9f44f01a9fd030091f30300aa00048052") + b"...." + bytes.fromhex("f40300aae00313aa41008052"), d, re.DOTALL)+if m:+ d[m.start():m.start()+4] = bytes.fromhex("c0035fd6")++# aarch64: 2. init_modifier_bit_table Meta mask -> 0x40 (Mod4Mask)+m = re.search(bytes.fromhex("0100a252e20314aa"), d, re.DOTALL)+if m:+ d[m.start():m.start()+4] = bytes.fromhex("01088052")++# aarch64: 3. rodata Meta primary_logical_key -> 0x10000010e (superKey)+m = re.search(bytes.fromhex("e3000700000000000601000002000000"), d, re.DOTALL)+if m:+ d[m.start()+8:m.start()+16] = bytes.fromhex("0e01000001000000")++# x86_64: 1. init_lock_bit_table -> retq (c3)+m = re.search(bytes.fromhex("41574156534889fbbf20000000e8") + b"...." + bytes.fromhex("4989c6be02000000"), d, re.DOTALL)+if m:+ d[m.start():m.start()+1] = bytes.fromhex("c3")++# x86_64: 2. init_modifier_bit_table Meta mask (0x40) and superKey (0x10000010e)+m = re.search(bytes.fromhex("be000000104889df4889c2e8") + b"...." + bytes.fromhex("41c646180049c706e3000700498d4706498946084983cf074d897e10"), d, re.DOTALL)+if m:+ d[m.start():m.start()+5] = bytes.fromhex("be40000000")+ d[m.end()-16:m.end()] = bytes.fromhex("b8870000804801c04989460849894610")++with open(p, "wb") as f:+ f.write(d)+' "${pkgdir}/usr/lib/bluebubbles-beta/lib/libflutter_linux_gtk.so"+ fi+ install -Dm644 "${srcdir}/data/flutter_assets/assets/icon/icon.png" "${pkgdir}/usr/share/pixmaps/bluebubbles-beta.png"+ ln -sf "bluebubbles-beta.png" "${pkgdir}/usr/share/pixmaps/bluebubbles.png" ln -sf "/usr/lib/libmpv.so" "${pkgdir}/usr/lib/bluebubbles-beta/libmpv.so.1" install -Dm644 "${srcdir}/bluebubbles-beta.desktop" -t "${pkgdir}/usr/share/applications" }Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-17 00:21:55 | Low | 1 |
| 2026-10-16 21:16:13 | Low | 1 |
| 2026-10-16 07:15:06 | Low | 1 |
| 2026-10-13 23:18:21 | Clean | 0 |
| 2026-10-11 11:10:32 | Clean | 0 |
| 2026-07-15 00:09:25 | Clean | 2 |
| 2026-07-14 23:46:33 | Low | 1 |