codex-native-git

MEDIUM

maintainer redminote11tech 0 votes scanned 2026-09-17 00:27:14.276658

piracy

View on AUR

Why flagged

The package downloads a prebuilt frontend artifact from a non-standard, unverifiable host (persistent.oaistatic.com) with a fixed checksum, posing a supply-chain risk if the source were compromised, though it is used as static data and not directly executed.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:18 "${_codex_frontend_artifact}-${_codex_frontend_version}.zip::https://persistent.oaistatic.com/codex-app-prod/${_codex_frontend_artifact}-${_codex_frontend_version}.zip"

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 85%): The package downloads a prebuilt frontend artifact from a non-standard, unverifiable host (persistent.oaistatic.com) with a fixed checksum, posing a supply-chain risk if the source were compromised, though it is used as static data and not directly executed.

PKGBUILD

1 offending line(s) highlighted

      1pkgname=codex-native-git
    
      2pkgver=r1.8f36d66
    
      3pkgrel=1
    
      4pkgdesc="Native Linux Codex desktop shell built with Rust, GTK, WebKitGTK, and Codex CLI"
    
      5arch=('x86_64')
    
      6url="https://github.com/Redminote11tech/Codex-Native"
    
      7license=('MIT')
    
      8depends=('gtk3' 'webkit2gtk-4.1' 'libsoup3' 'openssl')
    
      9optdepends=('codex: Codex CLI backend bridge for chat, auth, and runtime integration')
    
      10makedepends=('cargo' 'git' 'rust' 'unzip')
    
      11provides=('codex-native')
    
      12conflicts=('codex-native' 'codex-native-bin')
    
      13_codex_frontend_version=26.908.70816
    
      14_codex_frontend_artifact=ChatGPT-darwin-arm64
    
      15_codex_frontend_sha256='95e8867bffda4da9cc3a61886a57f0c90c69dd92eb91efeef86afc80e24d62a1'
    
      16source=(
    
      17  "codex-native::git+${url}.git"
    
      18  "${_codex_frontend_artifact}-${_codex_frontend_version}.zip::https://persistent.oaistatic.com/codex-app-prod/${_codex_frontend_artifact}-${_codex_frontend_version}.zip"
    
      19)
    
      20sha256sums=(
    
      21  'SKIP'
    
      22  "${_codex_frontend_sha256}"
    
      23)
    
      24
    
      25pkgver() {
    
      26  cd "$srcdir/codex-native"
    
      27  printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
    
      28}
    
      29
    
      30build() {
    
      31  cd "$srcdir/codex-native"
    
      32  cargo build --release -p codex-native
    
      33}
    
      34
    
      35package() {
    
      36  local extracted_root="$srcdir/codex-frontend"
    
      37  local asar_path
    
      38  local icon_path
    
      39
    
      40  cd "$srcdir/codex-native"
    
      41
    
      42  rm -rf "$extracted_root"
    
      43  asar_path="$(find "$srcdir" -path '*/Contents/Resources/app.asar' -type f | sort | head -n 1)"
    
      44  if [[ -z "$asar_path" ]]; then
    
      45    echo "failed to locate app.asar in upstream frontend bundle" >&2
    
      46    return 1
    
      47  fi
    
      48
    
      49  ./target/release/codex-native extract-asar "$asar_path" "$extracted_root"
    
      50
    
      51  install -Dm755 ./target/release/codex-native "$pkgdir/usr/bin/codex-native"
    
      52  install -Dm755 ./packaging/aur/codex-native-launcher "$pkgdir/usr/bin/codex-native-launcher"
    
      53  install -Dm644 ./packaging/aur/codex-native.desktop \
    
      54    "$pkgdir/usr/share/applications/codex-native.desktop"
    
      55  install -Dm644 ./LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      56
    
      57  install -d "$pkgdir/usr/share/codex-native"
    
      58  cp -a "$extracted_root/webview" "$pkgdir/usr/share/codex-native/"
    
      59
    
      60  icon_path="$(find "$extracted_root/webview/assets" -maxdepth 1 -type f -name 'app-*.png' | sort | head -n 1)"
    
      61  if [[ -z "$icon_path" ]]; then
    
      62    echo "failed to locate Codex icon asset in extracted webview" >&2
    
      63    return 1
    
      64  fi
    
      65
    
      66  install -Dm644 "$icon_path" "$pkgdir/usr/share/pixmaps/codex-native.png"
    
      67}
    
      68

Changes since previous scan

--- PKGBUILD @ 2026-09-14 00:27
+++ PKGBUILD @ 2026-09-17 00:27
@@ -1,5 +1,5 @@
 pkgname=codex-native-git
-pkgver=r1.fab590b
+pkgver=r1.8f36d66
 pkgrel=1
 pkgdesc="Native Linux Codex desktop shell built with Rust, GTK, WebKitGTK, and Codex CLI"
 arch=('x86_64')
@@ -10,9 +10,9 @@
 makedepends=('cargo' 'git' 'rust' 'unzip')
 provides=('codex-native')
 conflicts=('codex-native' 'codex-native-bin')
-_codex_frontend_version=26.908.40401
+_codex_frontend_version=26.908.70816
 _codex_frontend_artifact=ChatGPT-darwin-arm64
-_codex_frontend_sha256='491670fc43c1f2c713961e18b6a0b5de19f114d41484ce2e264da1d9b7086fdf'
+_codex_frontend_sha256='95e8867bffda4da9cc3a61886a57f0c90c69dd92eb91efeef86afc80e24d62a1'
 source=(
   "codex-native::git+${url}.git"
   "${_codex_frontend_artifact}-${_codex_frontend_version}.zip::https://persistent.oaistatic.com/codex-app-prod/${_codex_frontend_artifact}-${_codex_frontend_version}.zip"

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 23:18:17	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 21:24:02	Medium	2
2026-09-11 17:22:59	Medium	2
2026-09-11 05:22:12	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 13:20:36	Medium	2
2026-09-10 00:22:44	Low	2
2026-09-09 05:18:57	Medium	1
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 05:10:24	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 05:59:21	Medium	2