codex-native-git
maintainer redminote11tech
· 0 votes
· scanned 2026-08-03 00:08:14.047287
Why flagged
The package downloads a prebuilt frontend artifact (app.asar) from a non-whitelisted, non-standard host (persistent.oaistatic.com) which is not the project's primary repository; while the checksum is verified, the source is an opaque binary blob that could contain unreviewed code, posing a supply-chain risk if the host were compromised or the artifact tampered with.
Triggered rules
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:17
"${_codex_frontend_artifact}-${_codex_frontend_version}.zip::https://persistent.oaistatic.com/codex-app-prod/${_codex_frontend_artifact}-${_codex_frontend_version}.zip"
MEDIUM
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 85%): The package downloads a prebuilt frontend artifact (app.asar) from a non-whitelisted, non-standard host (persistent.oaistatic.com) which is not the project's primary repository; while the checksum is verified, the source is an opaque binary blob that could contain unreviewed code, posing a supply-chain risk if the host were compromised or the artifact tampered with.
PKGBUILD
1 offending line(s) highlighted
1
pkgname=codex-native-git
2
pkgver=r1.31e84b3
3
pkgrel=1
4
pkgdesc="Native Linux Codex desktop shell built with Rust, GTK, WebKitGTK, and Codex CLI"
5
arch=('x86_64')
6
url="https://github.com/Redminote11tech/Codex-Native"
7
license=('MIT')
8
depends=('gtk3' 'webkit2gtk-4.1' 'libsoup3' 'openssl')
9
optdepends=('codex: Codex CLI backend bridge for chat, auth, and runtime integration')
10
makedepends=('cargo' 'git' 'rust' 'unzip')
11
provides=('codex-native')
12
conflicts=('codex-native')
13
_codex_frontend_version=26.727.40816
14
_codex_frontend_artifact=ChatGPT-darwin-arm64
15
source=(
16
"codex-native::git+${url}.git"
17
"${_codex_frontend_artifact}-${_codex_frontend_version}.zip::https://persistent.oaistatic.com/codex-app-prod/${_codex_frontend_artifact}-${_codex_frontend_version}.zip"
18
)
19
sha256sums=(
20
'SKIP'
21
'fdbede9b8a28b5bf3bbf1213fa04291724faa6ed2d1d61bb04853bbdfebce219'
22
)
23
24
pkgver() {
25
cd "$srcdir/codex-native"
26
printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
27
}
28
29
build() {
30
cd "$srcdir/codex-native"
31
cargo build --release -p codex-native
32
}
33
34
package() {
35
local extracted_root="$srcdir/codex-frontend"
36
local asar_path
37
local icon_path
38
39
cd "$srcdir/codex-native"
40
41
rm -rf "$extracted_root"
42
asar_path="$(find "$srcdir" -path '*/Contents/Resources/app.asar' -type f | sort | head -n 1)"
43
if [[ -z "$asar_path" ]]; then
44
echo "failed to locate app.asar in upstream frontend bundle" >&2
45
return 1
46
fi
47
48
./target/release/codex-native extract-asar "$asar_path" "$extracted_root"
49
50
install -Dm755 ./target/release/codex-native "$pkgdir/usr/bin/codex-native"
51
install -Dm755 ./packaging/aur/codex-native-launcher "$pkgdir/usr/bin/codex-native-launcher"
52
install -Dm644 ./packaging/aur/codex-native.desktop \
53
"$pkgdir/usr/share/applications/codex-native.desktop"
54
install -Dm644 ./LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
55
56
install -d "$pkgdir/usr/share/codex-native"
57
cp -a "$extracted_root/webview" "$pkgdir/usr/share/codex-native/"
58
59
icon_path="$(find "$extracted_root/webview/assets" -maxdepth 1 -type f -name 'app-*.png' | sort | head -n 1)"
60
if [[ -z "$icon_path" ]]; then
61
echo "failed to locate Codex icon asset in extracted webview" >&2
62
return 1
63
fi
64
65
install -Dm644 "$icon_path" "$pkgdir/usr/share/pixmaps/codex-native.png"
66
}
67
Changes since previous scan
--- PKGBUILD @ 2026-07-31 00:14+++ PKGBUILD @ 2026-08-03 00:08@@ -1,5 +1,5 @@ pkgname=codex-native-git-pkgver=r1.5f83185+pkgver=r1.31e84b3 pkgrel=1 pkgdesc="Native Linux Codex desktop shell built with Rust, GTK, WebKitGTK, and Codex CLI" arch=('x86_64')@@ -11,9 +11,10 @@ provides=('codex-native') conflicts=('codex-native') _codex_frontend_version=26.727.40816+_codex_frontend_artifact=ChatGPT-darwin-arm64 source=( "codex-native::git+${url}.git"- "Codex-darwin-arm64-${_codex_frontend_version}.zip::https://persistent.oaistatic.com/codex-app-prod/Codex-darwin-arm64-${_codex_frontend_version}.zip"+ "${_codex_frontend_artifact}-${_codex_frontend_version}.zip::https://persistent.oaistatic.com/codex-app-prod/${_codex_frontend_artifact}-${_codex_frontend_version}.zip" ) sha256sums=( 'SKIP'@@ -32,14 +33,19 @@ package() { local extracted_root="$srcdir/codex-frontend"+ local asar_path local icon_path cd "$srcdir/codex-native" rm -rf "$extracted_root"- ./target/release/codex-native extract-asar \- "$srcdir/Codex.app/Contents/Resources/app.asar" \- "$extracted_root"+ asar_path="$(find "$srcdir" -path '*/Contents/Resources/app.asar' -type f | sort | head -n 1)"+ if [[ -z "$asar_path" ]]; then+ echo "failed to locate app.asar in upstream frontend bundle" >&2+ return 1+ fi++ ./target/release/codex-native extract-asar "$asar_path" "$extracted_root" install -Dm755 ./target/release/codex-native "$pkgdir/usr/bin/codex-native" install -Dm755 ./packaging/aur/codex-native-launcher "$pkgdir/usr/bin/codex-native-launcher"Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | MEDIUM | 2 |
| 2026-08-02 00:16:08 | MEDIUM | 2 |
| 2026-08-01 05:20:08 | MEDIUM | 2 |
| 2026-08-01 00:11:18 | MEDIUM | 2 |
| 2026-07-31 15:18:17 | MEDIUM | 2 |
| 2026-07-31 00:14:10 | MEDIUM | 2 |
| 2026-07-30 21:16:48 | MEDIUM | 2 |
| 2026-07-30 00:17:23 | MEDIUM | 2 |
| 2026-07-29 11:11:22 | MEDIUM | 2 |
| 2026-07-29 00:25:53 | MEDIUM | 2 |
| 2026-07-28 00:07:28 | MEDIUM | 2 |
| 2026-07-27 00:24:32 | MEDIUM | 2 |
| 2026-07-26 00:07:32 | MEDIUM | 2 |
| 2026-07-25 05:29:17 | MEDIUM | 2 |
| 2026-07-25 00:13:44 | MEDIUM | 2 |
| 2026-07-24 09:27:42 | MEDIUM | 2 |
| 2026-07-24 05:27:22 | MEDIUM | 2 |
| 2026-07-24 00:02:28 | MEDIUM | 2 |
| 2026-07-23 00:14:47 | MEDIUM | 2 |
| 2026-07-22 15:20:42 | MEDIUM | 2 |