clockify-desktop
LOW
maintainer jankoh
19 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The package downloads a prebuilt .deb from the project's official domain (clockify.me), which is a normal distribution method for Electron apps; the source is not obfuscated, and the checksum is provided, making the risk low despite the non-whitelisted host.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt .deb from the project's official domain (clockify.me), which is a normal distribution method for Electron apps; the source is not obfuscated, and the checksum is provided, making the risk low despite the non-whitelisted host.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:16
source=("$pkgname-$pkgver.deb::https://clockify.me/downloads/Clockify_Setup_x64.deb")
PKGBUILD
1 offending line(s) highlighted
1
# Generated by debtap
2
# Maintainer: Jan Kohnert <bughunter@jan-kohnert.de>
3
# Contributor: Matthew Sexton <wsdmatty@gmail.com>
4
# Contributor: Lorenz Wellmer
5
pkgname=clockify-desktop
6
pkgver=2.8.0
7
pkgrel=1
8
pkgdesc="Truly free time tracker for teams, Desktop App"
9
arch=("x86_64")
10
url="https://clockify.me"
11
license=("LicenseRef-custom")
12
depends=("alsa-lib" "at-spi2-core" "cairo" "dbus" "expat" "libgcc" "glib2"
13
"glibc" "gtk3" "hicolor-icon-theme" "java-runtime" "libcups"
14
"libx11" "libxcb" "libxcomposite" "libxdamage" "libxext" "libxfixes"
15
"libxkbcommon" "libxrandr" "mesa" "nspr" "nss" "pango" "systemd-libs")
16
source=("$pkgname-$pkgver.deb::https://clockify.me/downloads/Clockify_Setup_x64.deb")
17
sha512sums=("cb0360d576be24502a494918895e707a648bbb060832af545421f58d758afc3a70678ff311b05f79a2712a725e9b45ffd22311df23fafdb5aeb171429f4b4912")
18
19
package() {
20
# Extract package data
21
tar xf data.tar.xz -C "${pkgdir}"
22
23
# install license
24
install -D -m644 "${pkgdir}/opt/Clockify/LICENSES.chromium.html" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
25
26
# Fix permission issues
27
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/appicons/1024x1024.png"
28
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/appicons/32x32.png"
29
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/appicons/64x64.ico"
30
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/appicons/64x64.png"
31
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/appicons/blue.png"
32
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/appicons/tray-active-22.png"
33
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/appicons/tray-inactive-22.png"
34
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/appicons/white.png"
35
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/assets.d.ts"
36
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/assets.js"
37
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/audio/pomodoro-notification.ogg"
38
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/entitlements.mac.plist"
39
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/icon.icns"
40
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/1024x10240.png"
41
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/32x32.png"
42
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/64x64.ico"
43
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/64x64.png"
44
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/\$-selected.png"
45
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/\$.png"
46
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/approved.png"
47
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/arrow-dark-mode-up.png"
48
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/arrow-dark-mode.png"
49
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/arrow-light-mode-up.png"
50
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/arrow-light-mode.png"
51
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/at-checked.svg"
52
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/at-semichecked-dark-mode.svg"
53
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/at-unchecked.svg"
54
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/automatic-hover.png"
55
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/automatic.png"
56
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/autotracker-active-hover.png"
57
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/autotracker-active-newest.png"
58
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/autotracker-active.png"
59
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/autotracker-inactive-hover.png"
60
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/autotracker-inactive-newest.png"
61
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/autotracker-inactive.png"
62
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/billable.png"
63
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/billablenew.png"
64
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/bulk-add.svg"
65
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/bulk-delete.svg"
66
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/bulk-merge.svg"
67
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/calendar.png"
68
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/checkbox-checked.svg"
69
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/checked.png"
70
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/checkednew.png"
71
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/circle_1.svg"
72
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/circle_2.svg"
73
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/clockify.ico"
74
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/clockify_illustration.png"
75
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/clockify_logo.svg"
76
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/clockify_logo_dark.svg"
77
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/clockify_logo_selfhosted.svg"
78
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/close-light.png"
79
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/close-toolbar.png"
80
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/close.png"
81
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/closeX.png"
82
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/create.png"
83
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/edit-unsynced-hover.png"
84
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/edit-unsynced.png"
85
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/filter-arrow-down.png"
86
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/filter-arrow-right.png"
87
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/gear.png"
88
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/icon-cal.svg"
89
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/icon-check-circle.svg"
90
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/icon-chevron-left.svg"
91
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/icon-chevron-right.svg"
92
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/icon-lock.svg"
93
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/icon-plus-circle.svg"
94
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/icon-settings.svg"
95
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/icon.png"
96
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/loading.gif"
97
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/lock-indicator.png"
98
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/logo-128.png"
99
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/logo-16-gray.png"
100
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/logo-16.png"
101
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/logo-48.png"
102
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/logo.png"
103
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/logout-hover.png"
104
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/logout-normal.png"
105
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/logout.png"
106
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/manual-hover.png"
107
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/manual.png"
108
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/maximize-toolbar.png"
109
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/menu-dots-vertical.svg"
110
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/menu-hover.png"
111
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/menu.png"
112
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/minimize.png"
113
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/no-new-notifications.png"
114
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/notifications-hover.png"
115
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/notifications.png"
116
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/notifications/ws-lock.svg"
117
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/notifications/ws-shield.svg"
118
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/out-link.png"
119
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/play-hover.png"
120
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/play-normal.png"
121
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/reload-hover.png"
122
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/reload-normal.png"
123
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/semichecked.svg"
124
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/settings-hover.png"
125
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/settings-normal.png"
126
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/settings.png"
127
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/sync-hover.png"
128
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/sync.png"
129
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/tag.png"
130
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/tagnew.png"
131
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/time-hover.png"
132
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/time-off.png"
133
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/time.png"
134
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/ui-icons/favorite-star-active.png"
135
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/ui-icons/favorite-star-hover.png"
136
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/ui-icons/favorite-star-inactive.png"
137
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/workspace-checked.png"
138
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/x.png"
139
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/no-user-image.png"
140
141
# Fix hardlinks
142
rm "${pkgdir}/usr/share/icons/hicolor/32x32/apps/clockify.png"
143
ln -s /opt/Clockify/resources/assets/appicons/32x32.png "${pkgdir}/usr/share/icons/hicolor/32x32/apps/clockify.png"
144
rm "${pkgdir}/usr/share/icons/hicolor/64x64/apps/clockify.png"
145
ln -s /opt/Clockify/resources/assets/appicons/64x64.png "${pkgdir}/usr/share/icons/hicolor/64x64/apps/clockify.png"
146
rm "${pkgdir}/usr/share/icons/hicolor/1024x1024/apps/clockify.png"
147
ln -s /opt/Clockify/resources/assets/appicons/1024x1024.png "${pkgdir}/usr/share/icons/hicolor/1024x1024/apps/clockify.png"
148
149
# Remove forgotten temporary build build pkgdir
150
rm -r "${pkgdir}/opt/Clockify/resources/app.asar.unpacked/node_modules/active-win/build-tmp-napi-v6"
151
rm -r "${pkgdir}/opt/Clockify/resources/app.asar.unpacked/node_modules/active-win/lib/binding/napi-6-linux-glibc-x64"
152
153
# generate link in PATH
154
install -dm755 "${pkgdir}/usr/bin"
155
ln -s "/opt/Clockify/clockify" "${pkgdir}/usr/bin/clockify"
156
}
157
Changes since previous scan
--- PKGBUILD @ 2026-10-24 00:14+++ PKGBUILD @ 2026-11-01 00:21@@ -3,7 +3,7 @@ # Contributor: Matthew Sexton <wsdmatty@gmail.com> # Contributor: Lorenz Wellmer pkgname=clockify-desktop-pkgver=2.7.8+pkgver=2.8.0 pkgrel=1 pkgdesc="Truly free time tracker for teams, Desktop App" arch=("x86_64")@@ -14,7 +14,7 @@ "libx11" "libxcb" "libxcomposite" "libxdamage" "libxext" "libxfixes" "libxkbcommon" "libxrandr" "mesa" "nspr" "nss" "pango" "systemd-libs") source=("$pkgname-$pkgver.deb::https://clockify.me/downloads/Clockify_Setup_x64.deb")-sha512sums=("cdb8ca2d723e3122541efb84fb420ce6c011d646986bbbb24fa1ce532baf2c34504600029712b81a81e1589ae0a0176dc8c807fcbbc4ff88e0a54a0be9b65fa1")+sha512sums=("cb0360d576be24502a494918895e707a648bbb060832af545421f58d758afc3a70678ff311b05f79a2712a725e9b45ffd22311df23fafdb5aeb171429f4b4912") package() { # Extract package dataScan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 00:13:55 | Low | 2 |
| 2026-10-28 00:06:54 | Low | 2 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 13:40:12 | Medium | 1 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |
| 2026-10-14 00:06:47 | Low | 2 |