codex-desktop-linux

maintainer facet · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt macOS payload from a non-standard host (persistent.oaistatic.com) with a SKIP'd checksum, creating a supply-chain risk if the host or file is compromised.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:82 "Codex-$_appver.zip::https://persistent.oaistatic.com/codex-app-prod/ChatGPT-darwin-arm64-$_appver.zip"

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-07-25) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads a prebuilt macOS payload from a non-standard host (persistent.oaistatic.com) with a SKIP'd checksum, creating a supply-chain risk if the host or file is compromised.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: distsystem <dev@dist.systems>
    
      2
    
      3# Codex Desktop for Linux — distsystem soft-fork.
    
      4#
    
      5# Converts OpenAI's macOS Codex payload into a Linux Electron tree. Pinned to a
    
      6# patch-validated version (the appcast-versioned arm64 zip; _appver is kept in
    
      7# sync with flake.nix's codexVersion). Sourced from main (rolling): the
    
      8# distsystem fork stays rebased on upstream/main, and main is force-pushed only
    
      9# after CI validates the cross-combination, so main is always last-known-good
    
      10# — no separate tag needed.
    
      11#
    
      12# This is NOT the PKGBUILD.template path: that template is the updater-rebuild
    
      13# shell (rendered by build-pacman.sh, bundled into the update-builder and
    
      14# referenced by updater/src/builder.rs). This file is a standalone PKGBUILD
    
      15# for the no-updater pacman/AUR install path; updates come from pacman.
    
      16
    
      17pkgname=codex-desktop-linux
    
      18# _appver / pkgver must match repo-root CODEX_VERSION (the single source of
    
      19# truth that flake.nix and scripts/dev.sh also read). makepkg needs _appver
    
      20# at source=() eval time, before the git source is cloned, so the file
    
      21# cannot be read here — prepare() asserts equality and fails the build if
    
      22# this PKGBUILD drifts away from CODEX_VERSION.
    
      23_appver=26.707.31428
    
      24pkgver=26.707.31428
    
      25pkgrel=1
    
      26pkgdesc="Codex Desktop for Linux — distsystem soft-fork (versioned-zip pinned, no auto-updater)"
    
      27arch=('x86_64')
    
      28url="https://github.com/distsystem/codex-desktop-linux"
    
      29license=('MIT')
    
      30depends=(
    
      31    'python'
    
      32    # Electron runtime libraries
    
      33    'alsa-lib'
    
      34    'at-spi2-core'
    
      35    'atk'
    
      36    'cairo'
    
      37    'dbus'
    
      38    'glib2'
    
      39    'gtk3'
    
      40    'libcups'
    
      41    'libdrm'
    
      42    'libx11'
    
      43    'libxcb'
    
      44    'libxcomposite'
    
      45    'libxdamage'
    
      46    'libxext'
    
      47    'libxfixes'
    
      48    'libxkbcommon'
    
      49    'libxrandr'
    
      50    'mesa'
    
      51    'nspr'
    
      52    'nss'
    
      53    'pango'
    
      54)
    
      55makedepends=(
    
      56    'git'     # clone the distsystem fork (rolling main)
    
      57    '7zip'    # extract the macOS app payload
    
      58    'nodejs'  # asar patch, electron-rebuild, feature stage hooks, validate-patch-report
    
      59    'npm'     # native module install (better-sqlite3, node-pty)
    
      60    'rust'    # cargo: Computer Use + read-aloud-mcp backends
    
      61    'curl'    # Electron / managed Node downloads
    
      62    'unzip'   # Electron runtime extraction
    
      63)
    
      64optdepends=(
    
      65    'nodejs>=22.22.0: override the bundled managed Node.js runtime'
    
      66    'npm: Codex CLI install/update flows'
    
      67    'zenity: GTK dialog fallback when the Codex CLI is missing'
    
      68    'kdialog: KDE dialog fallback when the Codex CLI is missing'
    
      69    'ydotool: synthetic keyboard/pointer input for Computer Use on Wayland'
    
      70    'xdg-desktop-portal-wlr: screenshot/remote-desktop portal backend (niri/sway/wlroots)'
    
      71    'xdg-desktop-portal-gnome: screenshot/remote-desktop portal backend (GNOME/Mutter)'
    
      72    'alsa-utils: audio playback for Read Aloud'
    
      73    'speech-dispatcher: system TTS bridge for Read Aloud'
    
      74    'espeak-ng: offline TTS fallback for Read Aloud'
    
      75)
    
      76provides=('codex-desktop')
    
      77conflicts=('codex-desktop')
    
      78options=('!debug' '!strip')
    
      79install="$pkgname.install"
    
      80source=(
    
      81    "$pkgname::git+https://github.com/distsystem/codex-desktop-linux.git#branch=main"
    
      82    "Codex-$_appver.zip::https://persistent.oaistatic.com/codex-app-prod/ChatGPT-darwin-arm64-$_appver.zip"
    
      83)
    
      84sha256sums=('SKIP'
    
      85            'ffdc351a507105d55d7464e3340302c758b8a54b926711c4b15bf373ccb47d64')
    
      86# install.sh runs 7z on the payload itself; let it own the extraction.
    
      87noextract=("Codex-$_appver.zip")
    
      88
    
      89# Installed app identity stays "codex-desktop": matches the Electron WM_CLASS,
    
      90# the ~/.config/codex-desktop settings dir, and provides/conflicts.
    
      91_appname=codex-desktop
    
      92
    
      93pkgver() {
    
      94    cd "$srcdir/$pkgname"
    
      95    printf '%s.r%s.g%s' "$_appver" "$(git rev-list --count HEAD)" "$(git rev-parse --short=8 HEAD)"
    
      96}
    
      97
    
      98prepare() {
    
      99    cd "$srcdir/$pkgname"
    
      100
    
      101    local sot
    
      102    sot=$(<CODEX_VERSION)
    
      103    sot=${sot%$'\n'}
    
      104    if [ "$sot" != "$_appver" ]; then
    
      105        echo "error: PKGBUILD _appver=$_appver but repo CODEX_VERSION=$sot - update both" >&2
    
      106        return 1
    
      107    fi
    
      108
    
      109    # Enable every Linux feature; the in-app Computer Use UI is opened via the
    
      110    # env flag in build().
    
      111    cat > linux-features/features.json <<'JSON'
    
      112{"enabled":["open-target-discovery","zed-opener","copilot-reasoning-effort","read-aloud","read-aloud-mcp","conversation-mode","remote-control-ui","remote-mobile-control","cli-model-visibility"]}
    
      113JSON
    
      114}
    
      115
    
      116build() {
    
      117    cd "$srcdir/$pkgname"
    
      118    # Let the upstream toolchain own its compile flags; makepkg defaults can
    
      119    # break the prebuilt-runtime ABI.
    
      120    unset CFLAGS CXXFLAGS LDFLAGS
    
      121
    
      122    export PACKAGE_WITH_UPDATER=0                 # updates come from pacman
    
      123    export CODEX_LINUX_ENABLE_COMPUTER_USE_UI=1   # expose the in-app Computer Use UI
    
      124    # Have install.sh write the patch report so check() can validate it.
    
      125    export CODEX_PATCH_REPORT_JSON="$srcdir/patch-report.json"
    
      126
    
      127    # Pin the payload via positional arg — install-helpers.sh resets the env
    
      128    # var to empty, so $PROVIDED_DMG_PATH does nothing. Without this the
    
      129    # script falls back to downloading the rolling Codex.dmg, defeating the
    
      130    # whole versioned-zip pin.
    
      131    # Patches app.asar, rebuilds native modules, builds the Rust backends,
    
      132    # runs feature stage hooks. --fresh is non-interactive.
    
      133    ./install.sh --fresh "$srcdir/Codex-$_appver.zip"
    
      134}
    
      135
    
      136check() {
    
      137    # Patch gate: every makepkg (CI + AUR users) validates that the
    
      138    # required-upstream patches actually applied against the pinned versioned
    
      139    # zip. Fails if a required patch was skipped or failed.
    
      140    cd "$srcdir/$pkgname"
    
      141    node scripts/ci/validate-patch-report.js "$srcdir/patch-report.json" --profile upstream-build
    
      142}
    
      143
    
      144package() {
    
      145    cd "$srcdir/$pkgname"
    
      146    export PACKAGE_WITH_UPDATER=0
    
      147
    
      148    # Variables the staging helpers expect; stage straight into $pkgdir. The
    
      149    # updater-off path skips polkit/systemd/update-builder.
    
      150    export REPO_DIR="$PWD"
    
      151    export APP_DIR="$PWD/codex-app"
    
      152    export PACKAGE_NAME="$_appname"
    
      153    export PACKAGE_DISPLAY_NAME="Codex Desktop"
    
      154    export PACKAGE_COMMENT="Run Codex Desktop on Linux"
    
      155    export ICON_SOURCE="$PWD/assets/codex.png"
    
      156    export DESKTOP_TEMPLATE="$PWD/packaging/linux/codex-desktop.desktop"
    
      157    export PACKAGED_RUNTIME_SOURCE="$PWD/packaging/linux/codex-packaged-runtime.sh"
    
      158
    
      159    . "$PWD/scripts/lib/package-common.sh"
    
      160
    
      161    ensure_app_layout
    
      162    stage_common_package_files "$pkgdir"
    
      163    write_launcher_stub "$pkgdir"
    
      164
    
      165    install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      166}
    
      167

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2