codex-native-git

MEDIUM

maintainer redminote11tech 0 votes scanned 2026-11-01 00:21:48.120785

piracy

View on AUR

Why flagged

The package downloads a prebuilt frontend artifact from a non-standard, unverifiable host (persistent.oaistatic.com) with a fixed checksum, posing a supply-chain risk if the source were compromised, though it is used as static data and not directly executed.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:18 "${_codex_frontend_artifact}-${_codex_frontend_version}.zip::https://persistent.oaistatic.com/codex-app-prod/${_codex_frontend_artifact}-${_codex_frontend_version}.zip"

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 85%): The package downloads a prebuilt frontend artifact from a non-standard, unverifiable host (persistent.oaistatic.com) with a fixed checksum, posing a supply-chain risk if the source were compromised, though it is used as static data and not directly executed.

PKGBUILD

1 offending line(s) highlighted

      1pkgname=codex-native-git
    
      2pkgver=r1.8f36d66
    
      3pkgrel=1
    
      4pkgdesc="Native Linux Codex desktop shell built with Rust, GTK, WebKitGTK, and Codex CLI"
    
      5arch=('x86_64')
    
      6url="https://github.com/Redminote11tech/Codex-Native"
    
      7license=('MIT')
    
      8depends=('gtk3' 'webkit2gtk-4.1' 'libsoup3' 'openssl')
    
      9optdepends=('codex: Codex CLI backend bridge for chat, auth, and runtime integration')
    
      10makedepends=('cargo' 'git' 'rust' 'unzip')
    
      11provides=('codex-native')
    
      12conflicts=('codex-native' 'codex-native-bin')
    
      13_codex_frontend_version=26.908.70816
    
      14_codex_frontend_artifact=ChatGPT-darwin-arm64
    
      15_codex_frontend_sha256='95e8867bffda4da9cc3a61886a57f0c90c69dd92eb91efeef86afc80e24d62a1'
    
      16source=(
    
      17  "codex-native::git+${url}.git"
    
      18  "${_codex_frontend_artifact}-${_codex_frontend_version}.zip::https://persistent.oaistatic.com/codex-app-prod/${_codex_frontend_artifact}-${_codex_frontend_version}.zip"
    
      19)
    
      20sha256sums=(
    
      21  'SKIP'
    
      22  "${_codex_frontend_sha256}"
    
      23)
    
      24
    
      25pkgver() {
    
      26  cd "$srcdir/codex-native"
    
      27  printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
    
      28}
    
      29
    
      30build() {
    
      31  cd "$srcdir/codex-native"
    
      32  cargo build --release -p codex-native
    
      33}
    
      34
    
      35package() {
    
      36  local extracted_root="$srcdir/codex-frontend"
    
      37  local asar_path
    
      38  local icon_path
    
      39
    
      40  cd "$srcdir/codex-native"
    
      41
    
      42  rm -rf "$extracted_root"
    
      43  asar_path="$(find "$srcdir" -path '*/Contents/Resources/app.asar' -type f | sort | head -n 1)"
    
      44  if [[ -z "$asar_path" ]]; then
    
      45    echo "failed to locate app.asar in upstream frontend bundle" >&2
    
      46    return 1
    
      47  fi
    
      48
    
      49  ./target/release/codex-native extract-asar "$asar_path" "$extracted_root"
    
      50
    
      51  install -Dm755 ./target/release/codex-native "$pkgdir/usr/bin/codex-native"
    
      52  install -Dm755 ./packaging/aur/codex-native-launcher "$pkgdir/usr/bin/codex-native-launcher"
    
      53  install -Dm644 ./packaging/aur/codex-native.desktop \
    
      54    "$pkgdir/usr/share/applications/codex-native.desktop"
    
      55  install -Dm644 ./LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      56
    
      57  install -d "$pkgdir/usr/share/codex-native"
    
      58  cp -a "$extracted_root/webview" "$pkgdir/usr/share/codex-native/"
    
      59
    
      60  icon_path="$(find "$extracted_root/webview/assets" -maxdepth 1 -type f -name 'app-*.png' | sort | head -n 1)"
    
      61  if [[ -z "$icon_path" ]]; then
    
      62    echo "failed to locate Codex icon asset in extracted webview" >&2
    
      63    return 1
    
      64  fi
    
      65
    
      66  install -Dm644 "$icon_path" "$pkgdir/usr/share/pixmaps/codex-native.png"
    
      67}
    
      68

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Medium	2
2026-10-31 00:07:41	Medium	2
2026-10-30 00:29:30	Medium	2
2026-10-29 00:13:55	Medium	2
2026-10-28 00:06:54	Medium	2
2026-10-27 00:23:28	Medium	2
2026-10-26 00:12:40	Medium	2
2026-10-25 00:20:48	Medium	2
2026-10-24 00:14:55	Medium	2
2026-10-23 00:02:19	Medium	2
2026-10-22 00:13:10	Medium	2
2026-10-21 00:12:50	Medium	2
2026-10-20 00:10:31	Medium	2
2026-10-19 00:03:55	Medium	2
2026-10-18 00:06:55	Medium	2
2026-10-17 00:21:55	Medium	2
2026-10-16 00:12:47	Medium	2
2026-10-15 00:28:05	Medium	2
2026-10-14 00:06:47	Medium	2
2026-10-13 00:23:45	Medium	2