chatgpt-desktop
MEDIUM
maintainer Akira-Amatsume
39 votes
scanned 2026-10-02 00:00:32.890515
Why flagged
The package downloads prebuilt .deb binaries from a non-whitelisted host (persistent.oaistatic.com), which is not a standard or widely recognized distribution domain, creating a supply-chain risk if the host is compromised or the binaries are swapped.
Triggered rules
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:72
"chatgpt_${pkgver}_amd64.deb::https://persistent.oaistatic.com/codex-app-prod/linux/deb/pool/main/c/chatgpt/chatgpt_${pkgver}_amd64.deb"
Medium
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads prebuilt .deb binaries from a non-whitelisted host (persistent.oaistatic.com), which is not a standard or widely recognized distribution domain, creating a supply-chain risk if the host is compromised or the binaries are swapped.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Akira <akira.uestc at gmail dot com>
2
# Releases (x86_64): https://persistent.oaistatic.com/codex-app-prod/linux/deb/dists/stable/main/binary-amd64/Packages
3
# Releases (aarch64): https://persistent.oaistatic.com/codex-app-prod/linux/deb/dists/stable/main/binary-arm64/Packages
4
5
pkgname=chatgpt-desktop
6
pkgver=26.917.71314
7
pkgrel=1
8
pkgdesc="ChatGPT desktop application for Linux (repackaged from the official binary)"
9
arch=('x86_64' 'aarch64')
10
url="https://chatgpt.com/download"
11
license=('LicenseRef-custom')
12
options=('!strip' '!debug')
13
provides=(
14
"chatgpt=${pkgver}"
15
)
16
conflicts=(
17
'chatgpt'
18
)
19
20
depends=(
21
'alsa-lib'
22
'at-spi2-core'
23
'cairo'
24
'dbus'
25
'expat'
26
'gdk-pixbuf2'
27
'glib2'
28
'glibc'
29
'gtk3'
30
'libcanberra'
31
'libcups'
32
'libdrm'
33
'libgcc'
34
'libglvnd'
35
'libnotify'
36
'libpulse'
37
'libstdc++'
38
'libusb'
39
'libx11'
40
'libxcb'
41
'libxcomposite'
42
'libxdamage'
43
'libxext'
44
'libxfixes'
45
'libxkbcommon'
46
'libxrandr'
47
'mesa'
48
'nspr'
49
'nss'
50
'openssl'
51
'pango'
52
'systemd-libs'
53
'sh'
54
'tpm2-tss'
55
'vulkan-driver'
56
'xdg-utils'
57
)
58
59
optdepends=(
60
'apparmor: automatically load the bundled profile for Chromium user namespaces'
61
'git: enable Git repository integration'
62
'gtk4: use the GTK 4 backend with --gtk-version=4'
63
'kde-cli-tools: move deleted files to the Plasma trash through kioclient'
64
'org.freedesktop.secrets: securely store credentials with a Secret Service backend'
65
'pipewire: enable WebRTC screen sharing under Wayland'
66
)
67
68
backup=('etc/apparmor.d/chatgpt')
69
install="${pkgname}.install"
70
71
source_x86_64=(
72
"chatgpt_${pkgver}_amd64.deb::https://persistent.oaistatic.com/codex-app-prod/linux/deb/pool/main/c/chatgpt/chatgpt_${pkgver}_amd64.deb"
73
)
74
source_aarch64=(
75
"chatgpt_${pkgver}_arm64.deb::https://persistent.oaistatic.com/codex-app-prod/linux/deb/pool/main/c/chatgpt/chatgpt_${pkgver}_arm64.deb"
76
)
77
source=('chatgpt-launcher.sh')
78
noextract=(
79
"chatgpt_${pkgver}_amd64.deb"
80
"chatgpt_${pkgver}_arm64.deb"
81
)
82
sha256sums_x86_64=('851ec28b65bde2ff1da9f37dcdf5b6e20a915c7568f8b2ce993c00428f018ae5')
83
sha256sums_aarch64=('2114883623dae34a4bc7a67faad3e6652dd9bfdc7a28f57c36ed03e350be1cf1')
84
sha256sums=('aab6b1105d7273443234e77412fbaa35ff9e04098ac63c2f73ae8e87afb43bd2')
85
86
package() {
87
local _deb_arch
88
89
case "${CARCH}" in
90
x86_64) _deb_arch='amd64' ;;
91
aarch64) _deb_arch='arm64' ;;
92
*)
93
printf 'Unsupported architecture: %s\n' "${CARCH}" >&2
94
return 1
95
;;
96
esac
97
98
bsdtar -xOf "${srcdir}/chatgpt_${pkgver}_${_deb_arch}.deb" data.tar.xz |
99
bsdtar --no-same-owner -xJf - -C "${pkgdir}"
100
101
install -Dm755 "${srcdir}/chatgpt-launcher.sh" \
102
"${pkgdir}/usr/lib/chatgpt/codex-launcher"
103
104
install -Dm644 "${pkgdir}/usr/share/doc/chatgpt/copyright" \
105
"${pkgdir}/usr/share/licenses/${pkgname}/copyright"
106
ln -s /usr/lib/chatgpt/LICENSES.chromium.html \
107
"${pkgdir}/usr/share/licenses/${pkgname}/LICENSES.chromium.html"
108
109
rm -rf "${pkgdir}/usr/share/doc" "${pkgdir}/usr/share/lintian"
110
}
111
Changes since previous scan
--- PKGBUILD @ 2026-09-26 09:14+++ PKGBUILD @ 2026-10-02 00:00@@ -3,7 +3,7 @@ # Releases (aarch64): https://persistent.oaistatic.com/codex-app-prod/linux/deb/dists/stable/main/binary-arm64/Packages pkgname=chatgpt-desktop-pkgver=26.924.22138+pkgver=26.917.71314 pkgrel=1 pkgdesc="ChatGPT desktop application for Linux (repackaged from the official binary)" arch=('x86_64' 'aarch64')@@ -79,8 +79,8 @@ "chatgpt_${pkgver}_amd64.deb" "chatgpt_${pkgver}_arm64.deb" )-sha256sums_x86_64=('ce3bb1aa82ccdfe3037ada2fd8d187796ea4a0d5ed031d0e4ec8adce8b7014e7')-sha256sums_aarch64=('6570f078c5ea25461ce103b2e31fa7dd6c5e717136fa9237c701d22db62b5e3f')+sha256sums_x86_64=('851ec28b65bde2ff1da9f37dcdf5b6e20a915c7568f8b2ce993c00428f018ae5')+sha256sums_aarch64=('2114883623dae34a4bc7a67faad3e6652dd9bfdc7a28f57c36ed03e350be1cf1') sha256sums=('aab6b1105d7273443234e77412fbaa35ff9e04098ac63c2f73ae8e87afb43bd2') package() {Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-02 00:00:32 | Medium | 2 |
| 2026-10-01 00:02:06 | Medium | 2 |
| 2026-09-30 00:20:07 | Medium | 2 |
| 2026-09-29 00:07:46 | Medium | 2 |
| 2026-09-28 00:28:32 | Medium | 2 |
| 2026-09-27 00:07:07 | Medium | 2 |
| 2026-09-26 11:15:02 | Medium | 2 |
| 2026-09-26 09:14:41 | Medium | 2 |
| 2026-09-26 00:12:15 | Medium | 2 |
| 2026-09-25 00:03:36 | Medium | 2 |
| 2026-09-24 05:42:19 | Medium | 2 |
| 2026-09-24 00:24:14 | Low | 2 |
| 2026-09-23 05:39:25 | Medium | 1 |
| 2026-09-23 00:28:13 | Medium | 2 |
| 2026-09-22 19:39:10 | Medium | 2 |
| 2026-09-22 00:15:14 | Medium | 2 |
| 2026-09-21 00:26:32 | Medium | 2 |
| 2026-09-20 00:25:31 | Medium | 2 |
| 2026-09-19 00:25:36 | Medium | 2 |
| 2026-09-18 05:27:27 | Medium | 2 |