◎ AURWatch - AUR Security Monitor
scan coverage …
Last scan …
Next scan -

chatgpt-desktop-bin

maintainer Akira-Amatsume · 4 votes · scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged The package repackages a legitimate upstream macOS release from OpenAI's own static domain (oaistatic.com), builds native modules from source using pinned npm dependencies, and applies transparent patches; the non-whitelisted host is actually OpenAI's official infrastructure, posing no supply-chain risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package repackages a legitimate upstream macOS release from OpenAI's own static domain (oaistatic.com), builds native modules from source using pinned npm dependencies, and applies transparent patches; the non-whitelisted host is actually OpenAI's official infrastructure, posing no supply-chain risk.

1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:32 "ChatGPT-${pkgver}.zip::https://persistent.oaistatic.com/codex-app-prod/ChatGPT-darwin-arm64-${pkgver}.zip"
  • PKGBUILD:35 'electron-v42.3.0-headers.tar.gz::https://electronjs.org/headers/v42.3.0/node-v42.3.0-headers.tar.gz'

PKGBUILD

2 offending line(s) highlighted
1# Maintainer: Akira <akira.uestc at gmail dot com>
2# Releases: https://persistent.oaistatic.com/codex-app-prod/appcast.xml
3
4pkgname=chatgpt-desktop-bin
5pkgver=26.727.40816
6pkgrel=1
7pkgdesc="ChatGPT desktop app repackaged from the upstream macOS release archive for Arch Linux"
8arch=('x86_64')
9url="https://chatgpt.com/download"
10license=('custom')
11options=('!strip' '!debug')
12provides=('openai-codex-desktop')
13conflicts=('openai-codex-desktop')
14replaces=('openai-codex-desktop')
15
16depends=(
17 'electron42'
18 'openai-codex'
19 'python'
20 'hicolor-icon-theme'
21 'xdg-utils'
22)
23
24makedepends=(
25 'imagemagick'
26 'libarchive'
27 'node-gyp'
28 'nodejs'
29)
30
31source=(
32 "ChatGPT-${pkgver}.zip::https://persistent.oaistatic.com/codex-app-prod/ChatGPT-darwin-arm64-${pkgver}.zip"
33 'better-sqlite3-12.11.1.tgz::https://registry.npmjs.org/better-sqlite3/-/better-sqlite3-12.11.1.tgz'
34 'node-pty-1.1.0.tgz::https://registry.npmjs.org/node-pty/-/node-pty-1.1.0.tgz'
35 'electron-v42.3.0-headers.tar.gz::https://electronjs.org/headers/v42.3.0/node-v42.3.0-headers.tar.gz'
36 'chatgpt-desktop.sh'
37 'ChatGPT.desktop'
38 'asar-tools.mjs'
39 'patch-linux-desktop-name.mjs'
40 'patch-linux-open-targets.mjs'
41 'patch-linux-opaque-bg.mjs'
42 'patch-linux-tooltip-placement.mjs'
43 'patch-linux-window-chrome.mjs'
44)
45
46noextract=(
47 "ChatGPT-${pkgver}.zip"
48 'better-sqlite3-12.11.1.tgz'
49 'node-pty-1.1.0.tgz'
50 'electron-v42.3.0-headers.tar.gz'
51)
52
53sha256sums=('fdbede9b8a28b5bf3bbf1213fa04291724faa6ed2d1d61bb04853bbdfebce219'
54 'ebf0ed75a7a59dbcb3b24bbd014ef49d9f15bc328e4adcbf516f2a8fadfa2835'
55 'c7517f19083ddcb05f276904680eb2b11a6b5ecab778b8e4e5685a6d645b3f60'
56 '821009f9c1830050d894aef9e61906cb0a537b2000b2d9bbed9985fff1d5e0d0'
57 '5f876f3ee21fd728dad487a79fc9c3e460b759515651a3ef16da1b18885b082c'
58 '5657944f83faffcb6051a7f8de00f1a10ff11fcdee382fd7c7a921119124124d'
59 '6b14d89c0a7907ce988bec8cb38a00d1df74833bec92961f585d41ac8e243c56'
60 'edb819fff34a05f0842f391c4cd72dbd8f2d58c18c2195eca856ca0463ef5d7c'
61 '5808061449ca8026cc387e8efc2c79f26ffba746c9f326c92162bb573c1f6e43'
62 '49ca13daf940980a03179d7d12d45f950df4f033da2089a39d8e3fc4aadc99c7'
63 '2ca5f140a91e340266ea663b31cbd197d094a55973b413cb56dcdb88115a07c5'
64 'ffedd607ffdcc2432a905cd7e803f6c16598e581b2c8a0211194e73e15c48ab8')
65
66prepare() {
67 cd "${srcdir}"
68
69 rm -rf dmg app-extracted app.asar app.asar.unpacked icon native-build
70 mkdir -p dmg icon native-build
71
72 bsdtar -xf "ChatGPT-${pkgver}.zip" -C "${srcdir}/dmg"
73
74 local appdir
75 appdir="$(find dmg -maxdepth 4 -type d -name '*.app' ! -path '*/__MACOSX/*' -print -quit)"
76 [[ -n "${appdir}" ]] || {
77 echo "Could not find .app bundle in ChatGPT archive"
78 return 1
79 }
80
81 local resources_dir="${appdir}/Contents/Resources"
82 [[ -f "${resources_dir}/app.asar" ]] || {
83 echo "Could not find app.asar in ChatGPT archive"
84 return 1
85 }
86
87 node "${srcdir}/asar-tools.mjs" extract \
88 "${resources_dir}/app.asar" \
89 app-extracted \
90 "${resources_dir}/app.asar.unpacked"
91
92 tar -xzf "${srcdir}/electron-v42.3.0-headers.tar.gz" -C native-build
93 mkdir -p native-build/node_modules
94
95 tar -xzf "${srcdir}/better-sqlite3-12.11.1.tgz" -C native-build/node_modules
96 mv native-build/node_modules/package native-build/node_modules/better-sqlite3
97
98 tar -xzf "${srcdir}/node-pty-1.1.0.tgz" -C native-build/node_modules
99 mv native-build/node_modules/package native-build/node_modules/node-pty
100
101 cp -a --no-preserve=ownership app-extracted/node_modules/node-addon-api \
102 native-build/node_modules/
103
104 (
105 cd native-build/node_modules/better-sqlite3
106 node-gyp configure --release --nodedir="${srcdir}/native-build/node_headers"
107 mkdir -p \
108 build/Release/.deps/Release/obj.target/sqlite3/gen/sqlite3 \
109 build/Release/.deps/Release/obj.target/better_sqlite3/src \
110 build/Release/.deps/Release/obj.target/better_sqlite3/src/objects \
111 build/Release/.deps/Release/obj.target/better_sqlite3/src/util \
112 build/Release/.deps/Release/obj.target/test_extension/deps
113 node-gyp build --release
114 )
115
116 (
117 cd native-build/node_modules/node-pty
118 node-gyp configure --release --nodedir="${srcdir}/native-build/node_headers"
119 mkdir -p build/Release/.deps/Release/obj.target/pty/src/unix
120 node-gyp build --release
121 )
122
123 rm -rf app-extracted/node_modules/better-sqlite3/build
124 cp -a --no-preserve=ownership \
125 native-build/node_modules/better-sqlite3/LICENSE \
126 native-build/node_modules/better-sqlite3/README.md \
127 native-build/node_modules/better-sqlite3/binding.gyp \
128 native-build/node_modules/better-sqlite3/lib \
129 native-build/node_modules/better-sqlite3/package.json \
130 app-extracted/node_modules/better-sqlite3/
131 mkdir -p app-extracted/node_modules/better-sqlite3/build/Release
132 cp -a --no-preserve=ownership \
133 native-build/node_modules/better-sqlite3/build/Release/better_sqlite3.node \
134 native-build/node_modules/better-sqlite3/build/Release/test_extension.node \
135 app-extracted/node_modules/better-sqlite3/build/Release/
136
137 rm -rf app-extracted/node_modules/node-pty/build
138 mkdir -p app-extracted/node_modules/node-pty/build/Release
139 cp -a --no-preserve=ownership \
140 native-build/node_modules/node-pty/build/Release/pty.node \
141 app-extracted/node_modules/node-pty/build/Release/
142
143 rm -f app-extracted/node_modules/better-sqlite3/.codex-native-module-build.json
144 rm -f app-extracted/node_modules/node-pty/.codex-native-module-build.json
145 rm -rf app-extracted/node_modules/node-mac-permissions
146 rm -rf app-extracted/node_modules/objc-js/prebuilds
147 find app-extracted -type f \( -name '*.dylib' -o -name 'sparkle.node' \) -delete
148 find app-extracted -type d -name '*.dSYM' -prune -exec rm -rf {} +
149 find app-extracted -path '*/prebuilds/*' -type f -name '*.node' \
150 ! \( -path '*/linux-x64/*' -o -path '*/HID-linux-x64/*' -o -path '*/HID_hidraw-linux-x64/*' \) \
151 -delete
152 find app-extracted -path '*/prebuilds/*' -type f -name '*musl*.node' -delete
153
154 node "${srcdir}/patch-linux-desktop-name.mjs" app-extracted
155 node "${srcdir}/patch-linux-open-targets.mjs" app-extracted
156 node "${srcdir}/patch-linux-opaque-bg.mjs" app-extracted
157 node "${srcdir}/patch-linux-tooltip-placement.mjs" app-extracted
158 node "${srcdir}/patch-linux-window-chrome.mjs" app-extracted
159
160 node "${srcdir}/asar-tools.mjs" pack app-extracted app.asar app.asar.unpacked
161
162 magick "${resources_dir}/icon-chatgpt.png" -resize 512x512 icon/chatgpt-desktop.png
163}
164
165package() {
166 cd "${srcdir}"
167
168 install -Dm644 app.asar \
169 "${pkgdir}/usr/lib/${pkgname}/resources/app.asar"
170
171 if [[ -d app.asar.unpacked ]]; then
172 cp -a --no-preserve=ownership app.asar.unpacked \
173 "${pkgdir}/usr/lib/${pkgname}/resources/"
174 fi
175
176 if [[ -d app-extracted/webview ]]; then
177 mkdir -p "${pkgdir}/usr/lib/${pkgname}/content"
178 cp -a --no-preserve=ownership app-extracted/webview \
179 "${pkgdir}/usr/lib/${pkgname}/content/"
180 fi
181
182 ln -s /usr/lib/electron42/electron \
183 "${pkgdir}/usr/lib/${pkgname}/chatgpt"
184
185 install -Dm755 chatgpt-desktop.sh \
186 "${pkgdir}/usr/bin/chatgpt-desktop"
187
188 install -Dm644 icon/chatgpt-desktop.png \
189 "${pkgdir}/usr/share/icons/hicolor/512x512/apps/chatgpt-desktop.png"
190
191 install -Dm644 ChatGPT.desktop \
192 "${pkgdir}/usr/share/applications/ChatGPT.desktop"
193
194 local notices
195 notices="$(find dmg -path '*/Contents/Resources/THIRD_PARTY_NOTICES.txt' ! -path '*/__MACOSX/*' -print -quit)"
196 [[ -n "${notices}" ]] || {
197 echo "Could not find THIRD_PARTY_NOTICES.txt"
198 return 1
199 }
200
201 install -Dm644 "${notices}" \
202 "${pkgdir}/usr/share/licenses/${pkgname}/THIRD_PARTY_NOTICES.txt"
203}
204

Changes since previous scan

--- PKGBUILD @ 2026-07-31 00:14
+++ PKGBUILD @ 2026-08-03 00:08
@@ -2,7 +2,7 @@
# Releases: https://persistent.oaistatic.com/codex-app-prod/appcast.xml
pkgname=chatgpt-desktop-bin
-pkgver=26.721.81911
+pkgver=26.727.40816
pkgrel=1
pkgdesc="ChatGPT desktop app repackaged from the upstream macOS release archive for Arch Linux"
arch=('x86_64')
@@ -50,7 +50,7 @@
'electron-v42.3.0-headers.tar.gz'
)
-sha256sums=('a373727d40d9efe8cc762df444a07b5233071ff1cd6307465a73f025b1d69344'
+sha256sums=('fdbede9b8a28b5bf3bbf1213fa04291724faa6ed2d1d61bb04853bbdfebce219'
'ebf0ed75a7a59dbcb3b24bbd014ef49d9f15bc328e4adcbf516f2a8fadfa2835'
'c7517f19083ddcb05f276904680eb2b11a6b5ecab778b8e4e5685a6d645b3f60'
'821009f9c1830050d894aef9e61906cb0a537b2000b2d9bbed9985fff1d5e0d0'
@@ -61,7 +61,7 @@
'5808061449ca8026cc387e8efc2c79f26ffba746c9f326c92162bb573c1f6e43'
'49ca13daf940980a03179d7d12d45f950df4f033da2089a39d8e3fc4aadc99c7'
'2ca5f140a91e340266ea663b31cbd197d094a55973b413cb56dcdb88115a07c5'
- 'c39bd410e74539164ec157b38b2d2e8225033b6f630d27d5a97c1638a43b742d')
+ 'ffedd607ffdcc2432a905cd7e803f6c16598e581b2c8a0211194e73e15c48ab8')
prepare() {
cd "${srcdir}"

Scan history

Scanned at (UTC)SeverityRules
2026-08-03 00:08:14 LOW 2
2026-08-02 00:16:08 LOW 2
2026-08-01 09:20:18 MEDIUM 1
2026-08-01 00:11:18 LOW 2
2026-07-31 15:18:17 MEDIUM 1
2026-07-31 00:14:10 MEDIUM 2
2026-07-30 00:17:23 MEDIUM 2
2026-07-29 17:12:22 MEDIUM 2
2026-07-29 00:25:53 MEDIUM 2
2026-07-28 00:07:28 MEDIUM 2
2026-07-27 00:24:32 MEDIUM 2
2026-07-26 00:07:32 MEDIUM 2
2026-07-25 05:29:17 MEDIUM 2
2026-07-25 00:13:44 LOW 2
2026-07-24 11:27:50 MEDIUM 1
2026-07-24 00:02:28 LOW 2
2026-07-23 00:14:47 LOW 2
2026-07-22 00:29:32 LOW 2
2026-07-21 00:24:15 LOW 2
2026-07-20 00:19:49 LOW 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion