desktop-dimmer

maintainer jgwak · 4 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads a prebuilt binary package (.pacman) from GitHub Releases of the official upstream repository (github.com/sidneys/desktop-dimmer). While GitHub Releases is not an 'unofficial personal host,' it is still a prebuilt Electron binary being installed directly rather than compiled from source. The integrity check uses only MD5 (weak, but present). The real concern is that a prebuilt Electron app bundle is being installed system-wide under /opt and executed — if the upstream release asset were ever compromised or swapped, there is no strong verification. However, this is the official upstream project's own GitHub Releases page, which is standard practice for Electron apps in the AUR. The cheaper model's MEDIUM rating is arguably a false positive for 'non-standard host' since GitHub Releases of the official repo is the canonical distribution channel for this project. The actual risk is the inherent trust placed in a prebuilt binary, which is a common and accepted AUR pattern for closed/prebuilt software. Downgrading to low rather than clean because MD5-only checksums on an executed binary are weak, and the package is abandoned (last release 2019).

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 "LICENSE::https://creativecommons.org/publicdomain/zero/1.0/legalcode.txt")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads a prebuilt binary package (.pacman) from GitHub Releases of the official upstream repository (github.com/sidneys/desktop-dimmer). While GitHub Releases is not an 'unofficial personal host,' it is still a prebuilt Electron binary being installed directly rather than compiled from source. The integrity check uses only MD5 (weak, but present). The real concern is that a prebuilt Electron app bundle is being installed system-wide under /opt and executed — if the upstream release asset were ever compromised or swapped, there is no strong verification. However, this is the official upstream project's own GitHub Releases page, which is standard practice for Electron apps in the AUR. The cheaper model's MEDIUM rating is arguably a false positive for 'non-standard host' since GitHub Releases of the official repo is the canonical distribution channel for this project. The actual risk is the inherent trust placed in a prebuilt binary, which is a common and accepted AUR pattern for closed/prebuilt software. Downgrading to low rather than clean because MD5-only checksums on an executed binary are weak, and the package is abandoned (last release 2019).

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: JunYoung Gwak <aur@jgwak.com>
    
      2# Contributor: Augustin deMayo <gus.demayo@gmail.com>
    
      3
    
      4pkgname="desktop-dimmer"
    
      5fullpkgname="Desktop Dimmer"
    
      6pkgver=4.0.4
    
      7pkgrel=2
    
      8pkgdesc="Enables darker-than-dark Desktop dimming for your displays."
    
      9arch=("x86_64")
    
      10url="https://github.com/sidneys/${pkgname}"
    
      11license=('Custom:CC0-1.0')
    
      12source=("https://github.com/sidneys/${pkgname}/releases/download/v${pkgver}/${pkgname}-${pkgver}.pacman"
    
      13        "LICENSE::https://creativecommons.org/publicdomain/zero/1.0/legalcode.txt")
    
      14md5sums=('bd4370ee7d3e11ba8c5114481f8ddb7b'
    
      15         '65d3616852dbf7b1a6d4b53b00626032')
    
      16depends=('libxtst' 'gtk2' 'gconf' 'libxss' 'alsa-lib')
    
      17replace_str="\/opt\/${fullpkgname}\/${pkgname}"
    
      18
    
      19package() {
    
      20    cd "${srcdir}/"
    
      21    install -dm755 "${pkgdir}/opt/"
    
      22    install -dm755 "${pkgdir}/usr/share/applications/"
    
      23    install -dm755 "${pkgdir}/usr/share/icons/"
    
      24    cp -r "${srcdir}/opt/${fullpkgname}" "${pkgdir}/opt/"
    
      25    cp -r "${srcdir}/usr/share/applications/${pkgname}.desktop" "${pkgdir}/usr/share/applications/"
    
      26    cp -r "${srcdir}/usr/share/icons" "${pkgdir}/usr/share/"
    
      27    mkdir -p "${pkgdir}/usr/bin"
    
      28    ln -s "/opt/${fullpkgname}/${pkgname}" "${pkgdir}/usr/bin/${pkgname}"
    
      29    sed -i "s/${replace_str}/${pkgname}/g" "${pkgdir}/usr/share/applications/${pkgname}.desktop"
    
      30    install -Dm 644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      31}
    
      32

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2