claude

maintainer RyanTheTide · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged Downloads official Debian packages directly from downloads.claude.ai (Anthropic's own distribution infrastructure) with pinned SHA256 checksums; the non-standard host is the project's own official APT repository, not a personal or file-sharing service, so the supply-chain risk is low.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 85%): Downloads official Debian packages directly from downloads.claude.ai (Anthropic's own distribution infrastructure) with pinned SHA256 checksums; the non-standard host is the project's own official APT repository, not a personal or file-sharing service, so the supply-chain risk is low.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:62 source_x86_64=("${_pkgname}-${pkgver}-x86_64.deb::https://downloads.claude.ai/claude-desktop/apt/stable/pool/main/c/claude-desktop/claude-desktop_${pkgver}_amd64.deb")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: RyanTheTide <ryanthetide@gmail.com>
    
      2
    
      3pkgname=claude
    
      4_pkgname=claude-desktop
    
      5pkgver=1.17377.1
    
      6pkgrel=1
    
      7pkgdesc='Desktop application for Claude.ai, repackaged from the official Debian package'
    
      8arch=('x86_64' 'aarch64')
    
      9url='https://claude.ai'
    
      10license=('custom')
    
      11depends=(
    
      12  'at-spi2-core'
    
      13  'ca-certificates'
    
      14  'glib2'
    
      15  'glibc'
    
      16  'gtk3'
    
      17  'libdrm'
    
      18  'libnotify'
    
      19  'libsecret'
    
      20  'libx11'
    
      21  'libxcb'
    
      22  'libxtst'
    
      23  'mesa'
    
      24  'nss'
    
      25  'util-linux-libs'
    
      26  'xdg-desktop-portal'
    
      27  'xdg-utils'
    
      28)
    
      29depends_x86_64=(
    
      30  'edk2-ovmf'
    
      31  'qemu-system-x86'
    
      32)
    
      33depends_aarch64=(
    
      34  'edk2-aarch64'
    
      35  'qemu-system-aarch64'
    
      36)
    
      37optdepends=(
    
      38  'gnome-keyring: credential storage on GNOME and compatible desktops'
    
      39  'kwallet: credential storage on KDE Plasma'
    
      40  'libappindicator-gtk3: tray/status indicator support'
    
      41  'pipewire-pulse: audio support through PulseAudio-compatible PipeWire'
    
      42  'pulseaudio: audio support'
    
      43  'trash-cli: freedesktop trash support when desktop helpers are unavailable'
    
      44  'xdg-desktop-portal-gnome: portal backend for GNOME'
    
      45  'xdg-desktop-portal-gtk: portal backend for GTK desktops'
    
      46  'xdg-desktop-portal-kde: portal backend for KDE Plasma'
    
      47)
    
      48provides=("${_pkgname}")
    
      49conflicts=(
    
      50  "${_pkgname}"
    
      51  'claude-desktop-bin'
    
      52  'claude-desktop-official-bin'
    
      53  'claude-desktop-deb-bin'
    
      54)
    
      55install="${pkgname}.install"
    
      56options=('!strip' '!debug')
    
      57noextract=(
    
      58  "${_pkgname}-${pkgver}-x86_64.deb"
    
      59  "${_pkgname}-${pkgver}-aarch64.deb"
    
      60)
    
      61
    
      62source_x86_64=("${_pkgname}-${pkgver}-x86_64.deb::https://downloads.claude.ai/claude-desktop/apt/stable/pool/main/c/claude-desktop/claude-desktop_${pkgver}_amd64.deb")
    
      63source_aarch64=("${_pkgname}-${pkgver}-aarch64.deb::https://downloads.claude.ai/claude-desktop/apt/stable/pool/main/c/claude-desktop/claude-desktop_${pkgver}_arm64.deb")
    
      64sha256sums_x86_64=('f4bd78545200877b591179838de7ad7a577df6ed2e845969dd25690efc5c85c7')
    
      65sha256sums_aarch64=('658acbff14bd9c35d795ede46f097fca79d433ac4af792cdd6486acd3adc6f2e')
    
      66
    
      67package() {
    
      68  local deb="${srcdir}/${_pkgname}-${pkgver}-${CARCH}.deb"
    
      69  local data_tar
    
      70
    
      71  bsdtar --no-same-owner -xf "${deb}" -C "${srcdir}"
    
      72  data_tar="$(find "${srcdir}" -maxdepth 1 -type f -name 'data.tar*' -print -quit)"
    
      73  bsdtar --no-same-owner -xf "${data_tar}" -C "${pkgdir}"
    
      74
    
      75  install -dm755 "${pkgdir}/usr/share/licenses/${pkgname}"
    
      76  if [[ -f "${pkgdir}/usr/share/doc/${_pkgname}/copyright" ]]; then
    
      77    ln -sf "/usr/share/doc/${_pkgname}/copyright" "${pkgdir}/usr/share/licenses/${pkgname}/copyright"
    
      78  else
    
      79    printf 'See %s for upstream license terms.\n' "${url}" > "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      80  fi
    
      81
    
      82  install -dm755 "${pkgdir}/usr/libexec"
    
      83  ln -sf "/usr/lib/${_pkgname}/resources/virtiofsd" "${pkgdir}/usr/libexec/virtiofsd"
    
      84
    
      85  if [[ "${CARCH}" == "x86_64" ]]; then
    
      86    install -dm755 "${pkgdir}/usr/share/edk2"
    
      87    ln -sf "/usr/share/edk2/x64/OVMF_CODE.4m.fd" "${pkgdir}/usr/share/edk2/OVMF_CODE_4M.fd"
    
      88    ln -sf "/usr/share/edk2/x64/OVMF_VARS.4m.fd" "${pkgdir}/usr/share/edk2/OVMF_VARS_4M.fd"
    
      89  fi
    
      90
    
      91  rm -rf \
    
      92    "${pkgdir}/etc/apt" \
    
      93    "${pkgdir}/usr/share/keyrings" \
    
      94    "${pkgdir}/usr/share/lintian" \
    
      95    "${pkgdir}/usr/src"
    
      96}
    
      97

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	3