codex-desktop-app

maintainer orphaned · 0 votes · scanned 2026-08-18 00:03:42.021799

LOW

Why flagged Downloads a prebuilt .deb from persistent.oaistatic.com, which is plausibly OpenAI's own CDN infrastructure for the official ChatGPT desktop app; checksums are provided and pinned, so the binary is verifiable. The only concern is that oaistatic.com is not a well-known whitelisted domain, but it is consistent with OpenAI's static asset hosting, making this a low-risk official vendor binary rather than a swappable personal-host artifact.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 75%): Downloads a prebuilt .deb from persistent.oaistatic.com, which is plausibly OpenAI's own CDN infrastructure for the official ChatGPT desktop app; checksums are provided and pinned, so the binary is verifiable. The only concern is that oaistatic.com is not a well-known whitelisted domain, but it is consistent with OpenAI's static asset hosting, making this a low-risk official vendor binary rather than a swappable personal-host artifact.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:61 "${_deb_x86_64}::https://persistent.oaistatic.com/codex-app-prod/linux/deb/latest/chatgpt_amd64.deb"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: czyt <czytcn@gmail.com>
    
      2# Official downloads: https://chatgpt.com/codex/
    
      3
    
      4pkgname=codex-desktop-app
    
      5pkgver=26.803.81509
    
      6pkgrel=3
    
      7pkgdesc="Official ChatGPT desktop app with Codex"
    
      8arch=('x86_64' 'aarch64')
    
      9url="https://chatgpt.com/codex/"
    
      10license=('custom')
    
      11
    
      12depends=(
    
      13  'alsa-lib'
    
      14  'at-spi2-core'
    
      15  'bash'
    
      16  'cairo'
    
      17  'dbus'
    
      18  'expat'
    
      19  'gcc-libs'
    
      20  'gdk-pixbuf2'
    
      21  'glib2'
    
      22  'glibc'
    
      23  'gtk3'
    
      24  'libcups'
    
      25  'libdrm'
    
      26  'libglvnd'
    
      27  'libnotify'
    
      28  'libusb'
    
      29  'libx11'
    
      30  'libxcb'
    
      31  'libxcomposite'
    
      32  'libxdamage'
    
      33  'libxext'
    
      34  'libxfixes'
    
      35  'libxkbcommon'
    
      36  'libxrandr'
    
      37  'mesa'
    
      38  'nspr'
    
      39  'nss'
    
      40  'openssl'
    
      41  'pango'
    
      42  'systemd-libs'
    
      43  'xdg-utils'
    
      44  'xz'
    
      45)
    
      46
    
      47optdepends=(
    
      48  'apparmor: load the bundled user-namespace profile on AppArmor systems'
    
      49  'git: version control integration'
    
      50)
    
      51
    
      52makedepends=('libarchive')
    
      53provides=('chatgpt' 'openai-codex-desktop')
    
      54conflicts=('chatgpt' 'openai-codex-desktop')
    
      55options=('!debug' '!strip')
    
      56
    
      57_deb_x86_64="chatgpt_${pkgver}_amd64.deb"
    
      58_deb_aarch64="chatgpt_${pkgver}_arm64.deb"
    
      59source=('chatgpt-launcher.sh')
    
      60source_x86_64=(
    
      61  "${_deb_x86_64}::https://persistent.oaistatic.com/codex-app-prod/linux/deb/latest/chatgpt_amd64.deb"
    
      62)
    
      63source_aarch64=(
    
      64  "${_deb_aarch64}::https://persistent.oaistatic.com/codex-app-prod/linux/deb/latest/chatgpt_arm64.deb"
    
      65)
    
      66noextract=("${_deb_x86_64}" "${_deb_aarch64}")
    
      67sha256sums=('56a14509725adb2ab66c6218295030f56470ecd4ca66fb47b6355809903b7382')
    
      68sha256sums_x86_64=('a9bf91a368f9f7c4eea38082a9fb8fb46b8d005b719a6d7715d2e5a1982c38eb')
    
      69sha256sums_aarch64=('f38fcc194eca9ab0327dc10c92340681eae77c5d75164df700384ce2adaccbc1')
    
      70
    
      71package() {
    
      72  cd "${srcdir}"
    
      73
    
      74  local deb_var="_deb_${CARCH}"
    
      75  local deb="${!deb_var}"
    
      76
    
      77  bsdtar -xOf "${deb}" data.tar.xz |
    
      78    bsdtar --no-same-owner -xf - -C "${pkgdir}"
    
      79
    
      80  rm "${pkgdir}/usr/bin/chatgpt"
    
      81  install -Dm755 chatgpt-launcher.sh "${pkgdir}/usr/bin/chatgpt"
    
      82  ln -s chatgpt "${pkgdir}/usr/bin/codex-desktop"
    
      83
    
      84  install -Dm644 "${pkgdir}/usr/share/doc/chatgpt/copyright" \
    
      85    "${pkgdir}/usr/share/licenses/${pkgname}/copyright"
    
      86
    
      87  # Debian package-policy files are not used on Arch Linux.
    
      88  rm -rf "${pkgdir}/usr/share/doc" "${pkgdir}/usr/share/lintian"
    
      89}
    
      90

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	LOW	3
2026-08-17 00:18:29	LOW	3
2026-08-16 00:03:42	LOW	3
2026-08-15 00:26:13	LOW	3
2026-08-14 00:03:41	LOW	3
2026-08-13 00:17:07	LOW	3
2026-08-12 05:26:53	LOW	3
2026-08-12 05:22:53	MEDIUM	3