discord-electron-openasar-git

maintainer z0w13 · 0 votes · scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged The package downloads the official Discord tarball and OpenAsar source from GitHub, both used to build the application locally; the untrusted host warnings are due to non-whitelisted domains, but the sources are legitimate and the build process is transparent and non-malicious.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads the official Discord tarball and OpenAsar source from GitHub, both used to build the application locally; the untrusted host warnings are due to non-whitelisted domains, but the sources are legitimate and the build process is transparent and non-malicious.

2 higher static findings superseded - not the current verdict (shown for transparency)
MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

  • PKGBUILD:53 curl https://discord.com/terms | html2text >"${srcdir}"/LICENSE.md
  • PKGBUILD:54 curl https://discord.com/licenses | html2text >"${srcdir}"/OSS-LICENSES.md
MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:30 source=("https://dl.discordapp.net/apps/linux/${_pkgver}/${_pkgname}-${_pkgver}.tar.gz"

PKGBUILD

3 offending line(s) highlighted
1# Maintainer: Zowie <git at zowie dot cx>
2
3# Based off the discord-electron-openasar PKGBUILD from Manuel Hüsers
4# Based off the discord_arch_electron_wayland PKGBUILD from Stick
5# Based off the discord_arch_electron PKGBUILD from johnnyapol, huyizheng, Thaodan and Zoddo
6# Based off the discord community repo PKGBUILD by Filipe Laíns (FFY00)
7
8pkgname=discord-electron-openasar-git
9_pkgname=discord
10_electron=34
11pkgver=0.0.81+832.ef44708
12_pkgver=${pkgver%%+*}
13pkgrel=1
14pkgdesc="Discord packaged with OpenAsar (git) using system provided electron (v${_electron}) for increased security and performance"
15arch=('x86_64')
16provides=("${_pkgname}")
17conflicts=("${_pkgname}")
18url='https://discord.com'
19license=('custom')
20options=('!strip')
21install="$pkgname.install"
22depends=("electron${_electron}" "libxss" "bash")
23makedepends=('git' 'asar' 'nodejs' 'curl' 'python-html2text')
24optdepends=(
25 'libpulse: Pulseaudio support'
26 'libappindicator-gtk3: Systray indicator support'
27 'xdg-utils: Open files'
28 'rizin: Allow patching Krisp support'
29)
30source=("https://dl.discordapp.net/apps/linux/${_pkgver}/${_pkgname}-${_pkgver}.tar.gz"
31 'discord-launcher.sh'
32 "git+https://github.com/goosemod/openasar.git")
33sha512sums=('ff8a8a252bbb60101a36f320202cfb7dcc5cebcb91dfccd92caf66090bb759d4508f8027fc926a67842a99fd6d459a968458264ab5bad4c6cf6cffeb2f1c80e7'
34 'f516b1dba10f423f1ebe69b14f70740232b19d343b603c3479ba1e1dd2b7bcf472e92d354fde3a9d553bfae78207ae0420be60372a4b38ba78c3421172230826'
35 'SKIP')
36
37_krisp_b2sum='56c8c5167e3c4b51720accf0acfe46e7e073b015600088b6bb4d2b7a259cd788c4facba2d7332b535cfa39b91ee94840d6ea905c5d0c9cca43fa0a26f5185cc9'
38
39# just in case I get the version wrong
40pkgver() {
41 cd "${srcdir}/openasar"
42 printf "%s+%s.%s" "$_pkgver" "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
43}
44
45prepare() {
46 # prepare launcher script
47 sed -i "s|@PKGNAME@|${_pkgname}|g;s|@PKGVER@|${_pkgver}|g;s|@ELECTRON@|${_electron}|g;s|@KRISPB2@|${_krisp_b2sum}|g" discord-launcher.sh
48
49 # fix the .desktop file
50 sed -i "s|Exec=.*|Exec=/usr/bin/${_pkgname}|" ${_pkgname^}/$_pkgname.desktop
51
52 # create the license files
53 curl https://discord.com/terms | html2text >"${srcdir}"/LICENSE.md
54 curl https://discord.com/licenses | html2text >"${srcdir}"/OSS-LICENSES.md
55}
56
57build() {
58 cd "${srcdir}"/openasar
59
60 # pack openasar
61 sed -i -e "s/nightly/nightly-$(git rev-parse HEAD | cut -c 1-7)/" src/index.js
62 sed -i -e "s|process.resourcesPath|'/usr/lib/${_pkgname}'|" src/utils/buildInfo.js
63 node scripts/strip.js
64 asar p src app.asar
65}
66
67package() {
68 # create necessary directories
69 install -d "${pkgdir}"/usr/{lib/$_pkgname,bin}
70 install -d "${pkgdir}"/usr/share/{pixmaps,applications,licenses/$_pkgname}
71
72 # copy relevant data
73 cp -r ${_pkgname^}/resources/* "${pkgdir}"/usr/lib/$_pkgname/
74 cp ${_pkgname^}/$_pkgname.png \
75 "${pkgdir}"/usr/share/pixmaps/$_pkgname.png
76 cp ${_pkgname^}/$_pkgname.desktop \
77 "${pkgdir}"/usr/share/applications/$_pkgname.desktop
78
79 # overwrite Discord asar
80 install -Dm 644 openasar/app.asar "${pkgdir}"/usr/lib/$_pkgname/
81
82 # install the launch script
83 install -Dm 755 discord-launcher.sh "${pkgdir}"/usr/bin/$_pkgname
84
85 # install licenses
86 install -Dm 644 LICENSE.md "${pkgdir}"/usr/share/licenses/$_pkgname/
87 install -Dm 644 OSS-LICENSES.md "${pkgdir}"/usr/share/licenses/$_pkgname/
88}
89

Scan history

Scanned at (UTC)SeverityRules
2026-08-03 00:08:14 LOW 3
2026-08-02 00:16:08 LOW 3
2026-08-01 00:11:18 LOW 3
2026-07-31 00:14:10 LOW 3
2026-07-30 00:17:23 LOW 3
2026-07-29 00:25:53 LOW 3
2026-07-28 00:07:28 LOW 3
2026-07-27 00:24:32 LOW 3
2026-07-26 00:07:32 LOW 3
2026-07-25 00:13:44 LOW 3
2026-07-24 00:02:28 LOW 3
2026-07-23 00:14:47 LOW 3
2026-07-22 00:29:32 LOW 3
2026-07-21 00:24:15 LOW 3
2026-07-20 00:19:49 LOW 3
2026-07-19 00:17:08 LOW 3
2026-07-18 00:14:48 LOW 3
2026-07-17 00:06:16 LOW 3
2026-07-16 00:05:41 LOW 3
2026-07-15 00:09:25 LOW 3

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion