cozy-desktop

maintainer piasalo · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt AppImage from GitHub releases and extracts it, which is a supply-chain risk if the AppImage is swapped, though it comes from the project's official repository.

Triggered rules

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-07-25) reviewed this and agrees it is MEDIUM (confidence 85%): The package downloads a prebuilt AppImage from GitHub releases and extracts it, which is a supply-chain risk if the AppImage is swapped, though it comes from the project's official repository.

PKGBUILD

      1# Maintainer: Bruno Pagani <archange@archlinux.org>
    
      2# Contributor: Caleb Maclennan <caleb@alerque.com>
    
      3# Contributor: loqs <bugs-archlinux@entropy-collector.net>
    
      4
    
      5pkgname=cozy-desktop
    
      6pkgver=3.43.1
    
      7pkgrel=1
    
      8pkgdesc="File synchronisation for Cozy Cloud on Desktop"
    
      9arch=(x86_64)
    
      10url="https://cozy-labs.github.io/cozy-desktop/"
    
      11license=(AGPL-3.0-only)
    
      12_electron=electron31
    
      13depends=(${_electron})
    
      14makedepends=(nodejs yarn git node-gyp python)
    
      15source=(https://github.com/cozy-labs/${pkgname}/archive/v${pkgver/b/-beta.}/${pkgname}-${pkgver/b/-beta.}.tar.gz
    
      16        Cozy-Drive-${pkgver/b/-beta.}-x86_64.AppImage::https://github.com/cozy-labs/${pkgname}/releases/download/v${pkgver/b/-beta.}/Cozy-Drive-x86_64.AppImage
    
      17        ${pkgname}.desktop
    
      18        ${pkgname}.sh)
    
      19sha256sums=('f4c3a233ea1ef71456e4038baac6f1400aae5d6dbca65863be1d6e483fa77b17'
    
      20            'f96f237de1fa795ad1973e219b1413c5e3407a3ea7a0c43aaae270a760043e43'
    
      21            '563edd5a43c7f06080e03bec5f4e46154227f7e163500950ea39ecad466b198a'
    
      22            'a8783d3f6ce2da344ffe403f8e1a4f9da8de3b59e8bfda10e15a4ff5643244cf')
    
      23
    
      24prepare() {
    
      25    # Specify electron version in launcher
    
      26    sed -i "s|@ELECTRON@|${_electron}|" ${pkgname}.sh
    
      27    cd ${pkgname}-${pkgver/b/-beta.}
    
      28    yarn install --no-fund
    
      29}
    
      30
    
      31build() {
    
      32    cd ${pkgname}-${pkgver/b/-beta.}
    
      33    yarn build --offline
    
      34}
    
      35
    
      36package() {
    
      37    cd ${pkgname}-${pkgver/b/-beta.}
    
      38    yarn dist --dir -c.electronDist=/usr/lib/${_electron} -c.electronVersion=$(tail -c +1 /usr/lib/${_electron}/version)
    
      39
    
      40    install -d "${pkgdir}"/usr/lib/${pkgname}
    
      41    cp -r dist/linux-unpacked/resources/* "${pkgdir}"/usr/lib/${pkgname}/
    
      42    rm -r "${pkgdir}"/usr/lib/cozy-desktop/regedit
    
      43
    
      44    cd "${srcdir}"
    
      45    chmod +x Cozy-Drive-${pkgver/b/-beta.}-x86_64.AppImage
    
      46    ./Cozy-Drive-${pkgver/b/-beta.}-x86_64.AppImage --appimage-extract
    
      47    cp -r squashfs-root/usr/share "${pkgdir}"/usr/
    
      48    chmod a+rX -R "${pkgdir}"/usr/share
    
      49
    
      50    install -Dm755 ${pkgname}.sh "${pkgdir}"/usr/bin/${pkgname}
    
      51    install -Dm644 ${pkgname}.desktop "${pkgdir}"/usr/share/applications/${pkgname}.desktop
    
      52}
    
      53

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 17:15:21	MEDIUM	2
2026-07-07 00:22:52	CLEAN	0
2026-07-06 00:10:58	MEDIUM	2
2026-07-05 00:27:08	MEDIUM	2
2026-07-04 00:27:25	MEDIUM	2
2026-07-03 00:17:07	MEDIUM	2
2026-07-02 00:22:12	MEDIUM	2
2026-07-01 00:30:02	MEDIUM	2
2026-06-30 00:15:06	MEDIUM	2
2026-06-29 00:20:06	MEDIUM	2
2026-06-28 00:09:41	MEDIUM	2
2026-06-27 00:00:51	MEDIUM	2
2026-06-26 00:27:06	MEDIUM	2
2026-06-25 00:08:41	MEDIUM	2
2026-06-24 00:08:06	MEDIUM	2
2026-06-23 00:13:55	MEDIUM	2