clickup-desktop
MEDIUM
maintainer edoaurahman
2 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads a prebuilt AppImage from a non-whitelisted host (desktop.clickup.com) with a SKIP'd checksum, representing a supply-chain risk if the host were compromised or subverted.
Triggered rules
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:12
"https://desktop.clickup.com/linux" \
Medium
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-07-25) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt AppImage from a non-whitelisted host (desktop.clickup.com) with a SKIP'd checksum, representing a supply-chain risk if the host were compromised or subverted.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: edoaurahman <edoaurahman@gmail.com>
2
3
pkgname=clickup-desktop
4
pkgver=3.5.230
5
pkgrel=1
6
7
pkgver() {
8
local response=$(curl -s -L -D - \
9
-m 5 \
10
--max-filesize 1M \
11
--range 0-1024 \
12
"https://desktop.clickup.com/linux" \
13
-o /dev/null)
14
15
if [[ $response =~ filename=\"desktop-([0-9]+\.[0-9]+\.[0-9]+) ]]; then
16
echo "${BASH_REMATCH[1]}"
17
else
18
echo "$pkgver"
19
fi
20
}
21
pkgdesc="Desktop app for clickup.com"
22
arch=('x86_64')
23
url="https://clickup.com"
24
license=('CustomLicense')
25
provides=('clickup')
26
conflicts=('clickup')
27
depends=(
28
'alsa-lib'
29
'dbus-glib'
30
'gtk3'
31
'libdbusmenu-gtk3'
32
'libindicator-gtk3'
33
'libsecret'
34
'libxkbfile'
35
'nss'
36
)
37
makedepends=('sed')
38
options=('!strip')
39
40
_filename="clickup-desktop.AppImage"
41
42
source=("${_filename}::https://desktop.clickup.com/linux")
43
44
sha256sums=('SKIP')
45
46
prepare() {
47
rm -rf squashfs-root
48
chmod +x $_filename
49
./$_filename --appimage-extract
50
51
find squashfs-root -type d -exec chmod a+rx {} \;
52
}
53
54
package() {
55
cd "${srcdir}/squashfs-root"
56
57
install -dm0755 "${pkgdir}/usr/bin"
58
ln -s /opt/clickup/desktop "${pkgdir}/usr/bin/clickup"
59
60
install -Dm0644 desktop.desktop -T "${pkgdir}/usr/share/applications/ClickUp.desktop"
61
sed -i \
62
-e "s|^Exec=.\+|Exec=/usr/bin/clickup %U|" \
63
-e "s|^Icon=.\+|Icon=ClickUp|" \
64
"${pkgdir}/usr/share/applications/ClickUp.desktop"
65
66
install -Dm0644 LICENSE.electron.txt -t "${pkgdir}/usr/share/licenses/${pkgname}/"
67
install -Dm0644 LICENSES.chromium.html -t "${pkgdir}/usr/share/licenses/${pkgname}/"
68
69
icons=(512x512 256x256 128x128 64x64 48x48 32x32 16x16)
70
71
for size in "${icons[@]}"; do
72
install -Dm0644 usr/share/icons/hicolor/${size}/apps/desktop.png -T "${pkgdir}/usr/share/icons/hicolor/${size}/apps/ClickUp.png"
73
done
74
75
cd "${srcdir}"
76
install -dm0755 "${pkgdir}/opt"
77
mv squashfs-root "${pkgdir}/opt/clickup"
78
chmod 755 "${pkgdir}/opt/clickup"
79
chmod a+rX "${pkgdir}/opt/clickup/"
80
81
rm -r "${pkgdir}/opt/clickup/usr/share/"
82
rm "${pkgdir}/opt/clickup/AppRun" "${pkgdir}/opt/clickup/desktop.desktop"
83
rm "${pkgdir}/opt/clickup/desktop.png" "${pkgdir}/opt/clickup/.DirIcon"
84
rm "${pkgdir}/opt/clickup/LICENSE.electron.txt" "${pkgdir}/opt/clickup/LICENSES.chromium.html"
85
}
86
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Medium | 2 |
| 2026-09-16 00:03:17 | Medium | 2 |
| 2026-09-15 00:25:31 | Medium | 2 |
| 2026-09-14 00:27:57 | Medium | 2 |
| 2026-09-13 00:19:54 | Medium | 2 |
| 2026-09-12 00:25:17 | Medium | 2 |
| 2026-09-11 00:19:22 | Medium | 2 |
| 2026-09-10 00:22:44 | Medium | 2 |
| 2026-09-09 00:04:09 | Medium | 2 |
| 2026-09-08 00:18:08 | Medium | 2 |
| 2026-09-07 00:30:15 | Medium | 2 |
| 2026-09-06 00:17:06 | Medium | 2 |
| 2026-09-05 00:16:27 | Medium | 2 |
| 2026-09-04 00:03:13 | Medium | 2 |
| 2026-09-03 00:15:47 | Medium | 2 |
| 2026-09-02 00:02:31 | Medium | 2 |
| 2026-09-01 00:11:19 | Medium | 2 |
| 2026-08-31 00:19:57 | Medium | 2 |
| 2026-08-30 00:04:14 | Medium | 2 |
| 2026-08-29 00:29:17 | Medium | 2 |