clockify-desktop
MEDIUM
maintainer jankoh
18 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads a prebuilt .deb from the project's official domain but the source is a binary package that could be tampered with if the host is compromised, posing a supply-chain risk.
Triggered rules
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:16
source=("$pkgname-$pkgver.deb::https://clockify.me/downloads/Clockify_Setup_x64.deb")
Medium
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads a prebuilt .deb from the project's official domain but the source is a binary package that could be tampered with if the host is compromised, posing a supply-chain risk.
PKGBUILD
1 offending line(s) highlighted
1
# Generated by debtap
2
# Maintainer: Jan Kohnert <bughunter@jan-kohnert.de>
3
# Contributor: Matthew Sexton <wsdmatty@gmail.com>
4
# Contributor: Lorenz Wellmer
5
pkgname=clockify-desktop
6
pkgver=2.7.3
7
pkgrel=1
8
pkgdesc="Truly free time tracker for teams, Desktop App"
9
arch=("x86_64")
10
url="https://clockify.me"
11
license=("LicenseRef-custom")
12
depends=("alsa-lib" "at-spi2-core" "cairo" "dbus" "expat" "libgcc" "glib2"
13
"glibc" "gtk3" "hicolor-icon-theme" "java-runtime" "libcups"
14
"libx11" "libxcb" "libxcomposite" "libxdamage" "libxext" "libxfixes"
15
"libxkbcommon" "libxrandr" "mesa" "nspr" "nss" "pango" "systemd-libs")
16
source=("$pkgname-$pkgver.deb::https://clockify.me/downloads/Clockify_Setup_x64.deb")
17
sha512sums=("55edbea4ef7d73b89f4d75f2fac6140cf5e94da1c28b282181aabc6078fe870f45af94ee9f6f301bef5b1e542c9a80cbd889a532ce6f8d930ee4151605bc91b2")
18
19
package() {
20
# Extract package data
21
tar xf data.tar.xz -C "${pkgdir}"
22
23
# install license
24
install -D -m644 "${pkgdir}/opt/Clockify/LICENSES.chromium.html" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
25
26
# Fix permission issues
27
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/appicons/1024x1024.png"
28
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/appicons/32x32.png"
29
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/appicons/64x64.ico"
30
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/appicons/64x64.png"
31
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/appicons/blue.png"
32
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/appicons/tray-active-22.png"
33
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/appicons/tray-inactive-22.png"
34
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/appicons/white.png"
35
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/assets.d.ts"
36
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/assets.js"
37
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/audio/pomodoro-notification.ogg"
38
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/entitlements.mac.plist"
39
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/icon.icns"
40
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/1024x10240.png"
41
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/32x32.png"
42
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/64x64.ico"
43
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/64x64.png"
44
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/\$-selected.png"
45
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/\$.png"
46
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/approved.png"
47
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/arrow-dark-mode-up.png"
48
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/arrow-dark-mode.png"
49
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/arrow-light-mode-up.png"
50
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/arrow-light-mode.png"
51
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/at-checked.svg"
52
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/at-semichecked-dark-mode.svg"
53
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/at-unchecked.svg"
54
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/automatic-hover.png"
55
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/automatic.png"
56
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/autotracker-active-hover.png"
57
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/autotracker-active-newest.png"
58
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/autotracker-active.png"
59
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/autotracker-inactive-hover.png"
60
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/autotracker-inactive-newest.png"
61
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/autotracker-inactive.png"
62
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/billable.png"
63
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/billablenew.png"
64
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/bulk-add.svg"
65
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/bulk-delete.svg"
66
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/bulk-merge.svg"
67
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/calendar.png"
68
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/checkbox-checked.svg"
69
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/checked.png"
70
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/checkednew.png"
71
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/circle_1.svg"
72
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/circle_2.svg"
73
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/clockify.ico"
74
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/clockify_illustration.png"
75
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/clockify_logo.svg"
76
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/clockify_logo_dark.svg"
77
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/clockify_logo_selfhosted.svg"
78
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/close-light.png"
79
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/close-toolbar.png"
80
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/close.png"
81
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/closeX.png"
82
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/create.png"
83
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/edit-unsynced-hover.png"
84
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/edit-unsynced.png"
85
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/filter-arrow-down.png"
86
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/filter-arrow-right.png"
87
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/gear.png"
88
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/icon-cal.svg"
89
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/icon-check-circle.svg"
90
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/icon-chevron-left.svg"
91
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/icon-chevron-right.svg"
92
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/icon-lock.svg"
93
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/icon-plus-circle.svg"
94
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/icon-settings.svg"
95
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/icon.png"
96
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/loading.gif"
97
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/lock-indicator.png"
98
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/logo-128.png"
99
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/logo-16-gray.png"
100
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/logo-16.png"
101
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/logo-48.png"
102
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/logo.png"
103
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/logout-hover.png"
104
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/logout-normal.png"
105
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/logout.png"
106
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/manual-hover.png"
107
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/manual.png"
108
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/maximize-toolbar.png"
109
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/menu-dots-vertical.svg"
110
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/menu-hover.png"
111
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/menu.png"
112
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/minimize.png"
113
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/no-new-notifications.png"
114
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/notifications-hover.png"
115
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/notifications.png"
116
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/notifications/ws-lock.svg"
117
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/notifications/ws-shield.svg"
118
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/out-link.png"
119
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/play-hover.png"
120
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/play-normal.png"
121
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/reload-hover.png"
122
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/reload-normal.png"
123
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/semichecked.svg"
124
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/settings-hover.png"
125
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/settings-normal.png"
126
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/settings.png"
127
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/sync-hover.png"
128
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/sync.png"
129
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/tag.png"
130
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/tagnew.png"
131
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/time-hover.png"
132
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/time-off.png"
133
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/time.png"
134
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/workspace-checked.png"
135
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/images/x.png"
136
chmod a-w "${pkgdir}/opt/Clockify/resources/assets/no-user-image.png"
137
138
# Fix hardlinks
139
rm "${pkgdir}/usr/share/icons/hicolor/32x32/apps/clockify.png"
140
ln -s /opt/Clockify/resources/assets/appicons/32x32.png "${pkgdir}/usr/share/icons/hicolor/32x32/apps/clockify.png"
141
rm "${pkgdir}/usr/share/icons/hicolor/64x64/apps/clockify.png"
142
ln -s /opt/Clockify/resources/assets/appicons/64x64.png "${pkgdir}/usr/share/icons/hicolor/64x64/apps/clockify.png"
143
rm "${pkgdir}/usr/share/icons/hicolor/1024x1024/apps/clockify.png"
144
ln -s /opt/Clockify/resources/assets/appicons/1024x1024.png "${pkgdir}/usr/share/icons/hicolor/1024x1024/apps/clockify.png"
145
146
# Remove forgotten temporary build build pkgdir
147
rm -r "${pkgdir}/opt/Clockify/resources/app.asar.unpacked/node_modules/active-win/build-tmp-napi-v6"
148
rm -r "${pkgdir}/opt/Clockify/resources/app.asar.unpacked/node_modules/active-win/lib/binding/napi-6-linux-glibc-x64"
149
150
# generate link in PATH
151
install -dm755 "${pkgdir}/usr/bin"
152
ln -s "/opt/Clockify/clockify" "${pkgdir}/usr/bin/clockify"
153
}
154
Changes since previous scan
--- PKGBUILD @ 2026-09-05 00:16+++ PKGBUILD @ 2026-09-17 00:27@@ -3,7 +3,7 @@ # Contributor: Matthew Sexton <wsdmatty@gmail.com> # Contributor: Lorenz Wellmer pkgname=clockify-desktop-pkgver=2.7.2+pkgver=2.7.3 pkgrel=1 pkgdesc="Truly free time tracker for teams, Desktop App" arch=("x86_64")@@ -14,7 +14,7 @@ "libx11" "libxcb" "libxcomposite" "libxdamage" "libxext" "libxfixes" "libxkbcommon" "libxrandr" "mesa" "nspr" "nss" "pango" "systemd-libs") source=("$pkgname-$pkgver.deb::https://clockify.me/downloads/Clockify_Setup_x64.deb")-sha512sums=("c0497f50d3867ae9e641505db111b02a867bc897b9117ebf50c966bf27aad891f60e830471b68143dde85612ebfe0804f0f4dc39d88395777601be4d4e66ae4e")+sha512sums=("55edbea4ef7d73b89f4d75f2fac6140cf5e94da1c28b282181aabc6078fe870f45af94ee9f6f301bef5b1e542c9a80cbd889a532ce6f8d930ee4151605bc91b2") package() { # Extract package dataScan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Medium | 2 |
| 2026-09-16 00:03:17 | Medium | 2 |
| 2026-09-15 00:25:31 | Medium | 2 |
| 2026-09-14 00:27:57 | Medium | 2 |
| 2026-09-13 00:19:54 | Medium | 2 |
| 2026-09-12 00:25:17 | Medium | 2 |
| 2026-09-11 00:19:22 | Medium | 2 |
| 2026-09-10 00:22:44 | Medium | 2 |
| 2026-09-09 00:04:09 | Medium | 2 |
| 2026-09-08 00:18:08 | Medium | 2 |
| 2026-09-07 00:30:15 | Medium | 2 |
| 2026-09-06 00:17:06 | Medium | 2 |
| 2026-09-05 07:59:42 | Medium | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 07:52:31 | Medium | 1 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |