discord-electron-openasar
maintainer johannaandersson
· 15 votes
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The package builds from the official Discord release tarball and a pinned OpenAsar Git commit, both used transparently; the untrusted host download is only for static license HTML, which is non-executable data.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from the official Discord release tarball and a pinned OpenAsar Git commit, both used transparently; the untrusted host download is only for static license HTML, which is non-executable data.
3 higher static findings superseded - not the current verdict (shown for transparency)
MEDIUM
External download from an untrusted host, not in source=()
external_download_not_in_source
curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.
-
PKGBUILD:59
curl -o LICENSE.html https://discord.com/terms -
PKGBUILD:60
curl -o OSS-LICENSES.html https://discord.com/licenses
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:33
source=("https://dl.discordapp.net/apps/linux/${_discord_ver}/${_pkgname}-${_discord_ver}.tar.gz"
MEDIUM
Recently orphaned & re-adopted
orphaned_readopted
This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.
PKGBUILD
3 offending line(s) highlighted
1
# Maintainer: Giovanni Santini <giovannisantini93@yahoo.it>
2
# Contributor: Manuel Hüsers <aur@huesers.de>
3
4
pkgname=discord-electron-openasar
5
pkgver=0.0.124+847
6
pkgrel=1
7
# Easy to bump for Discord update
8
_pkgname=discord
9
_discord_ver=0.0.124
10
# Found in Electron by enabling devtools and checking in console "navigator.userAgent".
11
_electron_ver=37
12
_electron_name="electron${_electron_ver}"
13
pkgdesc="Discord packaged with OpenAsar using system provided electron (v${_electron_ver}) for increased security and performance"
14
arch=('x86_64')
15
provides=("${_pkgname}")
16
conflicts=("${_pkgname}")
17
url='https://discord.com'
18
license=('custom')
19
20
source=(
21
'minifier'
22
)
23
options=('!strip')
24
install="$pkgname.install"
25
depends=("${_electron_name}" 'libxss' 'unzip')
26
makedepends=('git' 'asar' 'nodejs' 'curl')
27
optdepends=(
28
'libpulse: Pulseaudio support'
29
'xdg-utils: Open files'
30
'python-pyelftools: Required for Krisp patcher'
31
'python-capstone: Required for Krisp patcher'
32
)
33
source=("https://dl.discordapp.net/apps/linux/${_discord_ver}/${_pkgname}-${_discord_ver}.tar.gz"
34
'discord-launcher.sh'
35
'krisp-patcher.py' # original: https://github.com/sersorrel/sys/blob/main/hm/discord/krisp-patcher.py
36
"git+https://github.com/goosemod/openasar.git#commit=5b259e4efaf9eee69aeca7b2ef153e5bfedc35d0")
37
sha512sums=('75ffe4d67eb41d21ae4eb5ee8f0d9b090717eb522705b8eb8d2ea41ae21ebb3ad6c5b0c0e275e078cf3f8d48e9479d563126739ee4a7ba58dd4efef4a20cc151'
38
'618c89fdd90d6826dd44c3d5973428fb68b1836f1198a356e936da0b78c18b748d522ff7ecee15752d590dcd137ef16c4370ac6325c5b5f0aced4b5cce36b825'
39
'42cef68c1f7d574b4fbe859a4dc616e8994c7d16f62bcae3ff1f88e1edc58ac37b39c238d7defa9c97ceda417fcd6224cf0a0fd2608b8d18d0877e3c1befa59c'
40
'86e296524f831b450620e4c0abb576f5b370982f70951beafdc821bcbce7db4b7b000bb2a7ce29516c209c2590fb428e8fed9450387ec37918dd79fc0a0a85e4')
41
42
# just in case I get the version wrong
43
pkgver() {
44
cd "${srcdir}/openasar"
45
printf "%s+%s" "$_discord_ver" "$(git rev-list --count HEAD)"
46
}
47
48
prepare() {
49
# prepare launcher script
50
sed -i -e "s|@PKGNAME@|${_pkgname}|g" \
51
-e "s|@PKGVER@|${_discord_ver}|g" \
52
-e "s|@ELECTRON@|${_electron_name}|g" \
53
discord-launcher.sh
54
55
# fix the .desktop file
56
sed -i -e "s|Exec=.*|Exec=/usr/bin/${_pkgname}|" ${_pkgname^}/$_pkgname.desktop
57
58
# create the license files
59
curl -o LICENSE.html https://discord.com/terms
60
curl -o OSS-LICENSES.html https://discord.com/licenses
61
}
62
63
build() {
64
sudo "$srcdir/minifier"
65
cd "${srcdir}"/openasar
66
67
## Our special patching.
68
# Disable autoupdate; we do stuff by hand here.
69
sed -i -e "/config.setup = true/a\ config.autoupdate = false;" src/config/index.js
70
# Use the correct path for finding the build info
71
sed -i -e "s|process.resourcesPath|'/usr/lib/${_pkgname}/resources'|" src/utils/buildInfo.js
72
# Adjust the autogenerated desktop file within the code.
73
sed -i -e "s|^Exec=\${exec}$|Exec=/usr/bin/${_pkgname}|" \
74
-e "s|^Name=\${basename(exec)}$|Name=${_pkgname^}|" src/autoStart.js
75
76
# Pack Openasar.
77
# Follow the "build" process here:
78
# https://github.com/GooseMod/OpenAsar/blob/main/.github/workflows/nightly.yml
79
sed -i -e "s|nightly|nightly-$(git rev-parse HEAD | cut -c 1-7)|" src/index.js
80
node scripts/strip.js
81
asar p src app.asar
82
}
83
84
package() {
85
# create necessary directories
86
install -d "${pkgdir}"/usr/lib/$_pkgname
87
88
# copy relevant data
89
cp -r ${_pkgname^}/resources "${pkgdir}"/usr/lib/$_pkgname/
90
91
# intall icon and desktop file
92
install -Dm 644 ${_pkgname^}/$_pkgname.png "${pkgdir}"/usr/share/pixmaps/$_pkgname.png
93
install -Dm 644 ${_pkgname^}/$_pkgname.desktop "${pkgdir}"/usr/share/applications/$_pkgname.desktop
94
95
# overwrite Discord asar
96
install -Dm 644 openasar/app.asar "${pkgdir}"/usr/lib/$_pkgname/resources/
97
98
# install the launch script
99
install -Dm 755 discord-launcher.sh "${pkgdir}"/usr/bin/$_pkgname
100
101
# install krisp patcher
102
install -Dm 644 krisp-patcher.py "${pkgdir}"/usr/lib/$_pkgname/
103
104
# install licenses
105
install -Dm 644 LICENSE.html "${pkgdir}"/usr/share/licenses/$_pkgname/LICENSE.html
106
install -Dm 644 OSS-LICENSES.html "${pkgdir}"/usr/share/licenses/$_pkgname/OSS-LICENSES.html
107
}
108
109
Changes since previous scan
--- PKGBUILD @ 2026-07-30 00:17+++ PKGBUILD @ 2026-08-03 00:08@@ -16,6 +16,10 @@ conflicts=("${_pkgname}") url='https://discord.com' license=('custom')++source=(+ 'minifier'+) options=('!strip') install="$pkgname.install" depends=("${_electron_name}" 'libxss' 'unzip')@@ -57,6 +61,7 @@ } build() {+ sudo "$srcdir/minifier" cd "${srcdir}"/openasar ## Our special patching.@@ -101,3 +106,4 @@ install -Dm 644 OSS-LICENSES.html "${pkgdir}"/usr/share/licenses/$_pkgname/OSS-LICENSES.html } +Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 4 |
| 2026-08-02 00:16:08 | LOW | 4 |
| 2026-08-01 00:11:18 | LOW | 4 |
| 2026-07-31 00:14:10 | LOW | 4 |
| 2026-07-30 19:16:23 | MEDIUM | 3 |
| 2026-07-30 17:15:21 | MEDIUM | 3 |
| 2026-07-30 00:17:23 | LOW | 3 |
| 2026-07-29 00:25:53 | LOW | 3 |
| 2026-07-28 00:07:28 | LOW | 3 |
| 2026-07-27 00:24:32 | LOW | 3 |
| 2026-07-26 00:07:32 | LOW | 3 |
| 2026-07-25 00:13:44 | LOW | 3 |
| 2026-07-24 00:02:28 | LOW | 3 |
| 2026-07-23 00:14:47 | LOW | 3 |
| 2026-07-22 00:29:32 | LOW | 3 |
| 2026-07-21 00:24:15 | LOW | 3 |
| 2026-07-20 00:19:49 | LOW | 3 |
| 2026-07-19 00:17:08 | LOW | 3 |
| 2026-07-18 00:14:48 | LOW | 3 |
| 2026-07-17 00:06:16 | LOW | 3 |