comfy-desktop-bin
MEDIUM
maintainer lapsus
1 votes
scanned 2026-08-27 00:08:17.237226
Why flagged
The package downloads a prebuilt .deb from an untrusted host (dl.todesktop.com) which is not in the official source array and could be silently swapped, posing a supply-chain risk.
Triggered rules
Medium
External download from an untrusted host, not in source=()
external_download_not_in_source
curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.
-
PKGBUILD:53
curl -sL "https://download.todesktop.com/241130tqe9q3y/latest-linux.yml" |
Medium
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt .deb from an untrusted host (dl.todesktop.com) which is not in the official source array and could be silently swapped, posing a supply-chain risk.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Yakov Till <yakov.till@gmail.com>
2
pkgname=comfy-desktop-bin
3
pkgver=1.0.44
4
pkgrel=1
5
pkgdesc='Official desktop application for ComfyUI — install, run, and manage ComfyUI with GPU-ready environments'
6
arch=('x86_64' 'aarch64')
7
url='https://www.comfy.org/'
8
license=('MIT')
9
depends=(
10
'alsa-lib'
11
'at-spi2-core'
12
'cairo'
13
'dbus'
14
'expat'
15
'gtk3'
16
'libcups'
17
'libdrm'
18
'libnotify'
19
'libsecret'
20
'libx11'
21
'libxcb'
22
'libxcomposite'
23
'libxdamage'
24
'libxext'
25
'libxfixes'
26
'libxkbcommon'
27
'libxrandr'
28
'libxss'
29
'libxtst'
30
'mesa'
31
'nss'
32
'pango'
33
'systemd-libs'
34
'xdg-utils'
35
)
36
optdepends=('git: fallback for git operations if bundled pygit2 fails')
37
provides=('comfy-desktop')
38
conflicts=('comfy-desktop' 'comfyui-desktop-2-beta')
39
replaces=('comfyui-desktop-2-beta')
40
options=('!strip' '!debug')
41
42
_dl_base='https://dl.todesktop.com/241130tqe9q3y'
43
source=("LICENSE-${pkgver}::https://raw.githubusercontent.com/Comfy-Org/Comfy-Desktop/v${pkgver}/LICENSE")
44
source_x86_64=("${pkgname}-${pkgver}-x86_64.deb::${_dl_base}/versions/${pkgver}/linux/deb/x64")
45
source_aarch64=("${pkgname}-${pkgver}-aarch64.deb::${_dl_base}/versions/${pkgver}/linux/deb/arm64")
46
sha256sums=('0cea5d109b4d245ea1110c205df0f825a1088c9e45e257514c1661c7c14f7bc3')
47
sha256sums_x86_64=('1ee3c10d39a6bd2172afde52e527c0a1c0b3b09b79ca4c09316c2e64ac622cd4')
48
sha256sums_aarch64=('e20a91a9d97473237c17fb800b8250038e409398fc61e1ec9d1b3d69c8cee664')
49
50
latestver() {
51
# electron-builder update feed — the authoritative published Linux version.
52
# Small YAML, instant response, no large download.
53
curl -sL "https://download.todesktop.com/241130tqe9q3y/latest-linux.yml" |
54
sed -nE 's/^version: *//p'
55
}
56
57
package() {
58
bsdtar -xf data.tar.xz -C "$pkgdir/"
59
60
# Prune non-target 7zip binaries
61
local _7z="$pkgdir/opt/Comfy Desktop/resources/app.asar.unpacked/node_modules/7zip-bin"
62
rm -rf "$_7z/mac"
63
case "$CARCH" in
64
x86_64) find "$_7z/linux" -mindepth 1 -maxdepth 1 -type d ! -name x64 -exec rm -rf {} + ;;
65
aarch64) find "$_7z/linux" -mindepth 1 -maxdepth 1 -type d ! -name arm64 -exec rm -rf {} + ;;
66
esac
67
68
# Remove deb-specific changelog
69
rm -rf "$pkgdir/usr/share/doc"
70
71
install -d "$pkgdir/usr/bin"
72
ln -s '/opt/Comfy Desktop/comfyui-desktop-2' "$pkgdir/usr/bin/comfy-desktop"
73
74
# License
75
install -Dm644 "$srcdir/LICENSE-${pkgver}" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
76
}
77
Changes since previous scan
--- PKGBUILD @ 2026-08-15 19:31+++ PKGBUILD @ 2026-08-27 00:08@@ -1,6 +1,6 @@ # Maintainer: Yakov Till <yakov.till@gmail.com> pkgname=comfy-desktop-bin-pkgver=1.0.39+pkgver=1.0.44 pkgrel=1 pkgdesc='Official desktop application for ComfyUI — install, run, and manage ComfyUI with GPU-ready environments' arch=('x86_64' 'aarch64')@@ -44,15 +44,14 @@ source_x86_64=("${pkgname}-${pkgver}-x86_64.deb::${_dl_base}/versions/${pkgver}/linux/deb/x64") source_aarch64=("${pkgname}-${pkgver}-aarch64.deb::${_dl_base}/versions/${pkgver}/linux/deb/arm64") sha256sums=('0cea5d109b4d245ea1110c205df0f825a1088c9e45e257514c1661c7c14f7bc3')-sha256sums_x86_64=('d4788db90f2188ac543896535812bcac4259813692dd5446c5f316fb7490103d')-sha256sums_aarch64=('366231b0a07b17c8ff82d60a8950f868a1f94c828ad66ef7084314e865cc08ce')+sha256sums_x86_64=('1ee3c10d39a6bd2172afde52e527c0a1c0b3b09b79ca4c09316c2e64ac622cd4')+sha256sums_aarch64=('e20a91a9d97473237c17fb800b8250038e409398fc61e1ec9d1b3d69c8cee664') latestver() {- # HEAD 404s on this CDN and GitHub releases run ahead of the Linux build,- # so read the actually-published version from the unversioned endpoint's- # Content-Disposition filename. --max-filesize 1 aborts after the headers.- curl -sL --max-filesize 1 -D - -o /dev/null "${_dl_base}/linux/deb/x64" 2>/dev/null |- sed -nE 's/.*filename="comfyui-desktop-2-([0-9]+(\.[0-9]+)*).*/\1/p' | head -1+ # electron-builder update feed — the authoritative published Linux version.+ # Small YAML, instant response, no large download.+ curl -sL "https://download.todesktop.com/241130tqe9q3y/latest-linux.yml" |+ sed -nE 's/^version: *//p' } package() {Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-27 00:08:17 | Medium | 2 |
| 2026-08-26 23:31:22 | Medium | 2 |
| 2026-08-15 19:31:13 | Clean | 0 |
| 2026-08-11 17:21:34 | Clean | 0 |
| 2026-07-31 13:18:10 | Clean | 0 |
| 2026-07-29 13:11:48 | Clean | 0 |
| 2026-07-15 09:48:24 | Clean | 0 |
| 2026-06-29 16:35:56 | Clean | 0 |
| 2026-06-27 22:30:23 | Clean | 0 |
| 2026-06-22 22:15:16 | Clean | 0 |
| 2026-06-20 14:37:07 | Clean | 0 |
| 2026-06-20 00:18:46 | Clean | 0 |
| 2026-06-19 23:51:18 | Clean | 0 |
| 2026-06-19 19:07:35 | Low | 2 |
| 2026-06-18 18:55:24 | Low | 2 |
| 2026-06-18 16:11:54 | Low | 1 |