chatgpt-desktop-app-bin

LOW

maintainer czyt 0 votes scanned 2026-10-02 00:00:32.890515

View on AUR

Why flagged

The package downloads prebuilt .deb binaries from OpenAI's official static domain, which is plausibly the project's own infrastructure; the binaries are verified with matching checksums, and only a launcher script is replaced, posing minimal supply-chain risk.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads prebuilt .deb binaries from OpenAI's official static domain, which is plausibly the project's own infrastructure; the binaries are verified with matching checksums, and only a launcher script is replaced, posing minimal supply-chain risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:62 "${_deb_x86_64}::https://persistent.oaistatic.com/codex-app-prod/linux/deb/latest/chatgpt_amd64.deb"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: czyt <czytcn@gmail.com>
    
      2# Official downloads: https://chatgpt.com/codex/
    
      3
    
      4pkgname=chatgpt-desktop-app-bin
    
      5pkgver=26.814.41407
    
      6pkgrel=1
    
      7pkgdesc="Official ChatGPT desktop app with Codex"
    
      8arch=('x86_64' 'aarch64')
    
      9url="https://chatgpt.com/codex/"
    
      10license=('custom')
    
      11
    
      12depends=(
    
      13  'alsa-lib'
    
      14  'at-spi2-core'
    
      15  'bash'
    
      16  'cairo'
    
      17  'dbus'
    
      18  'expat'
    
      19  'gcc-libs'
    
      20  'gdk-pixbuf2'
    
      21  'glib2'
    
      22  'glibc'
    
      23  'gtk3'
    
      24  'libcups'
    
      25  'libdrm'
    
      26  'libglvnd'
    
      27  'libnotify'
    
      28  'libusb'
    
      29  'libx11'
    
      30  'libxcb'
    
      31  'libxcomposite'
    
      32  'libxdamage'
    
      33  'libxext'
    
      34  'libxfixes'
    
      35  'libxkbcommon'
    
      36  'libxrandr'
    
      37  'mesa'
    
      38  'nspr'
    
      39  'nss'
    
      40  'openssl'
    
      41  'pango'
    
      42  'systemd-libs'
    
      43  'xdg-utils'
    
      44  'xz'
    
      45)
    
      46
    
      47optdepends=(
    
      48  'apparmor: load the bundled user-namespace profile on AppArmor systems'
    
      49  'git: version control integration'
    
      50)
    
      51
    
      52makedepends=('libarchive')
    
      53provides=('chatgpt' 'chatgpt-desktop-app' 'openai-codex-desktop')
    
      54conflicts=('chatgpt' 'chatgpt-desktop-app' 'codex-desktop-app' 'openai-codex-desktop')
    
      55replaces=('codex-desktop-app')
    
      56options=('!debug' '!strip')
    
      57
    
      58_deb_x86_64="chatgpt_${pkgver}_amd64.deb"
    
      59_deb_aarch64="chatgpt_${pkgver}_arm64.deb"
    
      60source=('chatgpt-launcher.sh')
    
      61source_x86_64=(
    
      62  "${_deb_x86_64}::https://persistent.oaistatic.com/codex-app-prod/linux/deb/latest/chatgpt_amd64.deb"
    
      63)
    
      64source_aarch64=(
    
      65  "${_deb_aarch64}::https://persistent.oaistatic.com/codex-app-prod/linux/deb/latest/chatgpt_arm64.deb"
    
      66)
    
      67noextract=("${_deb_x86_64}" "${_deb_aarch64}")
    
      68sha256sums=('56a14509725adb2ab66c6218295030f56470ecd4ca66fb47b6355809903b7382')
    
      69sha256sums_x86_64=('053d5ace91c48a17146aef02ca4abb00a2b1e94ffd15ca01891fd84a8227ca80')
    
      70sha256sums_aarch64=('223dfd7f72a515737a5065a780485f3d6a7a8df40fca4f86d028fb953f6749bf')
    
      71
    
      72package() {
    
      73  cd "${srcdir}"
    
      74
    
      75  local deb_var="_deb_${CARCH}"
    
      76  local deb="${!deb_var}"
    
      77
    
      78  bsdtar -xOf "${deb}" data.tar.xz |
    
      79    bsdtar --no-same-owner -xf - -C "${pkgdir}"
    
      80
    
      81  rm "${pkgdir}/usr/bin/chatgpt"
    
      82  install -Dm755 chatgpt-launcher.sh "${pkgdir}/usr/bin/chatgpt"
    
      83  ln -s chatgpt "${pkgdir}/usr/bin/codex-desktop"
    
      84
    
      85  install -Dm644 "${pkgdir}/usr/share/doc/chatgpt/copyright" \
    
      86    "${pkgdir}/usr/share/licenses/${pkgname}/copyright"
    
      87
    
      88  # Debian package-policy files are not used on Arch Linux.
    
      89  rm -rf "${pkgdir}/usr/share/doc" "${pkgdir}/usr/share/lintian"
    
      90}
    
      91

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-02 00:00:32	Low	2
2026-10-01 00:02:06	Low	2
2026-09-30 00:20:07	Low	2
2026-09-29 00:07:46	Low	2
2026-09-28 00:28:32	Low	2
2026-09-27 00:07:07	Low	2
2026-09-26 00:12:15	Low	2
2026-09-25 00:03:36	Low	2
2026-09-24 00:24:14	Low	2
2026-09-23 00:28:13	Low	2
2026-09-22 00:15:14	Low	2
2026-09-21 00:26:32	Low	2
2026-09-20 00:25:31	Low	2
2026-09-19 00:25:36	Low	2
2026-09-18 00:17:11	Low	2
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2