comfy-desktop-bin
MEDIUM
maintainer lapsus
2 votes
scanned 2026-10-17 00:21:55.226236
Why flagged
The package downloads a prebuilt .deb binary from a third-party host (dl.todesktop.com) not controlled by the official project, which is an unverifiable executable with supply-chain risk.
Triggered rules
Medium
External download from an untrusted host, not in source=()
external_download_not_in_source
curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.
-
PKGBUILD:53
curl -sL "https://download.todesktop.com/241130tqe9q3y/latest-linux.yml" |
Medium
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt .deb binary from a third-party host (dl.todesktop.com) not controlled by the official project, which is an unverifiable executable with supply-chain risk.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Yakov Till <yakov.till@gmail.com>
2
pkgname=comfy-desktop-bin
3
pkgver=1.1.7
4
pkgrel=1
5
pkgdesc='Official desktop application for ComfyUI — install, run, and manage ComfyUI with GPU-ready environments'
6
arch=('x86_64' 'aarch64')
7
url='https://www.comfy.org/'
8
license=('MIT')
9
depends=(
10
'alsa-lib'
11
'at-spi2-core'
12
'cairo'
13
'dbus'
14
'expat'
15
'gtk3'
16
'libcups'
17
'libdrm'
18
'libnotify'
19
'libsecret'
20
'libx11'
21
'libxcb'
22
'libxcomposite'
23
'libxdamage'
24
'libxext'
25
'libxfixes'
26
'libxkbcommon'
27
'libxrandr'
28
'libxss'
29
'libxtst'
30
'mesa'
31
'nss'
32
'pango'
33
'systemd-libs'
34
'xdg-utils'
35
)
36
optdepends=('git: fallback for git operations if bundled pygit2 fails')
37
provides=('comfy-desktop')
38
conflicts=('comfy-desktop' 'comfyui-desktop-2-beta')
39
replaces=('comfyui-desktop-2-beta')
40
options=('!strip' '!debug')
41
42
_dl_base='https://dl.todesktop.com/241130tqe9q3y'
43
source=("LICENSE-${pkgver}::https://raw.githubusercontent.com/Comfy-Org/Comfy-Desktop/v${pkgver}/LICENSE")
44
source_x86_64=("${pkgname}-${pkgver}-x86_64.deb::${_dl_base}/versions/${pkgver}/linux/deb/x64")
45
source_aarch64=("${pkgname}-${pkgver}-aarch64.deb::${_dl_base}/versions/${pkgver}/linux/deb/arm64")
46
sha256sums=('0cea5d109b4d245ea1110c205df0f825a1088c9e45e257514c1661c7c14f7bc3')
47
sha256sums_x86_64=('60c9b73e82a0a9ae996c8193ab72fbc99aae9f41ebeff90233ac8b8147a5f25b')
48
sha256sums_aarch64=('32a2e9f2aa0196a40a50034eaba07fbbf5b2aeb149b02a3b41759b6b910c822c')
49
50
latestver() {
51
# electron-builder update feed — the authoritative published Linux version.
52
# Small YAML, instant response, no large download.
53
curl -sL "https://download.todesktop.com/241130tqe9q3y/latest-linux.yml" |
54
sed -nE 's/^version: *//p'
55
}
56
57
package() {
58
bsdtar -xf data.tar.xz -C "$pkgdir/"
59
60
# Prune non-target 7zip binaries
61
local _7z="$pkgdir/opt/Comfy Desktop/resources/app.asar.unpacked/node_modules/7zip-bin"
62
rm -rf "$_7z/mac"
63
case "$CARCH" in
64
x86_64) find "$_7z/linux" -mindepth 1 -maxdepth 1 -type d ! -name x64 -exec rm -rf {} + ;;
65
aarch64) find "$_7z/linux" -mindepth 1 -maxdepth 1 -type d ! -name arm64 -exec rm -rf {} + ;;
66
esac
67
68
# Remove deb-specific changelog
69
rm -rf "$pkgdir/usr/share/doc"
70
71
install -d "$pkgdir/usr/bin"
72
ln -s '/opt/Comfy Desktop/comfyui-desktop-2' "$pkgdir/usr/bin/comfy-desktop"
73
74
# License
75
install -Dm644 "$srcdir/LICENSE-${pkgver}" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
76
}
77
Changes since previous scan
--- PKGBUILD @ 2026-10-14 00:06+++ PKGBUILD @ 2026-10-17 00:21@@ -1,6 +1,6 @@ # Maintainer: Yakov Till <yakov.till@gmail.com> pkgname=comfy-desktop-bin-pkgver=1.1.2+pkgver=1.1.7 pkgrel=1 pkgdesc='Official desktop application for ComfyUI — install, run, and manage ComfyUI with GPU-ready environments' arch=('x86_64' 'aarch64')@@ -44,8 +44,8 @@ source_x86_64=("${pkgname}-${pkgver}-x86_64.deb::${_dl_base}/versions/${pkgver}/linux/deb/x64") source_aarch64=("${pkgname}-${pkgver}-aarch64.deb::${_dl_base}/versions/${pkgver}/linux/deb/arm64") sha256sums=('0cea5d109b4d245ea1110c205df0f825a1088c9e45e257514c1661c7c14f7bc3')-sha256sums_x86_64=('cc495851fa8d40b315483cde6e3c4fb136a7edfcaf2edc89560256bf84f9ad6c')-sha256sums_aarch64=('e6da416cb0e9f8e391fddd89fb3dddbe15be5fe39bb9be6abffc715a4bbc0b70')+sha256sums_x86_64=('60c9b73e82a0a9ae996c8193ab72fbc99aae9f41ebeff90233ac8b8147a5f25b')+sha256sums_aarch64=('32a2e9f2aa0196a40a50034eaba07fbbf5b2aeb149b02a3b41759b6b910c822c') latestver() { # electron-builder update feed — the authoritative published Linux version.Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-17 00:21:55 | Medium | 2 |
| 2026-10-16 00:12:47 | Medium | 2 |
| 2026-10-15 00:28:05 | Medium | 2 |
| 2026-10-14 15:20:15 | Medium | 2 |
| 2026-10-14 00:06:47 | Low | 2 |
| 2026-10-13 00:23:45 | Low | 2 |
| 2026-10-12 00:18:51 | Low | 2 |
| 2026-10-11 00:26:05 | Low | 2 |
| 2026-10-10 00:11:52 | Low | 2 |
| 2026-10-09 00:05:33 | Low | 2 |
| 2026-10-08 00:28:03 | Low | 2 |
| 2026-10-07 00:21:34 | Low | 2 |
| 2026-10-06 00:13:36 | Low | 2 |
| 2026-10-05 23:40:58 | Medium | 1 |
| 2026-10-05 00:08:03 | Low | 2 |
| 2026-10-04 00:18:08 | Low | 2 |
| 2026-10-03 00:23:04 | Low | 2 |
| 2026-10-02 00:00:32 | Low | 2 |
| 2026-10-01 00:02:06 | Low | 2 |
| 2026-09-30 00:20:07 | Low | 2 |