duniter-desktop-bin

maintainer orphaned · 2 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt binary tarball (containing an NW.js application with native .so libraries and a bundled 'nw' executable) directly from a GitLab CI/CD job artifact URL on git.duniter.org. While git.duniter.org is the project's own official GitLab instance (not a random personal host), the artifact is identified by a numeric job ID (_gitlab_job_id=21913) rather than a tagged release artifact. CI job artifacts can be overwritten or expire and be replaced, and there is no guarantee of immutability. However, a sha256sum is provided which pins the exact content at packaging time, mitigating silent substitution risk. The binary itself is an executed NW.js bundle with native shared libraries installed to /opt, which is the standard concern for any -bin package. The use of a CI job artifact URL rather than a stable release URL is non-standard and slightly increases supply-chain risk, but the sha256 checksum and the fact that this is the project's own infrastructure keeps this at medium rather than high. Overall this is a legitimate but non-ideal packaging pattern for a binary package.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source=("https://git.duniter.org/nodes/typescript/duniter/-/jobs/${_gitlab_job_id}/artifacts/raw/work/bin/duniter-desktop-v$pkgver-linux-x64.tar.gz")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt binary tarball (containing an NW.js application with native .so libraries and a bundled 'nw' executable) directly from a GitLab CI/CD job artifact URL on git.duniter.org. While git.duniter.org is the project's own official GitLab instance (not a random personal host), the artifact is identified by a numeric job ID (_gitlab_job_id=21913) rather than a tagged release artifact. CI job artifacts can be overwritten or expire and be replaced, and there is no guarantee of immutability. However, a sha256sum is provided which pins the exact content at packaging time, mitigating silent substitution risk. The binary itself is an executed NW.js bundle with native shared libraries installed to /opt, which is the standard concern for any -bin package. The use of a CI job artifact URL rather than a stable release URL is non-standard and slightly increases supply-chain risk, but the sha256 checksum and the fact that this is the project's own infrastructure keeps this at medium rather than high. Overall this is a legitimate but non-ideal packaging pattern for a binary package.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Étienne Deparis <etienne@depar.is>
    
      2pkgname=duniter-desktop-bin
    
      3_pkgname=duniter-desktop
    
      4pkgver=1.7.18
    
      5pkgrel=1
    
      6_gitlab_job_id=21913
    
      7pkgdesc="Crypto-currency software to manage libre currency such as Ğ1"
    
      8arch=("x86_64")
    
      9url="https://duniter.org/fr/"
    
      10license=("AGPL3")
    
      11provides=("duniter-desktop")
    
      12conflicts=("duniter-desktop")
    
      13options=('!strip')
    
      14source=("https://git.duniter.org/nodes/typescript/duniter/-/jobs/${_gitlab_job_id}/artifacts/raw/work/bin/duniter-desktop-v$pkgver-linux-x64.tar.gz")
    
      15sha256sums=('7759b674fac29a874a9ee2e27ec3807f7195c07f0e8999cfb76f9801d5162dc4')
    
      16
    
      17prepare() {
    
      18  cd "$srcdir"
    
      19
    
      20  cat >> duniter-desktop.desktop <<EOF
    
      21[Desktop Entry]
    
      22Type=Application
    
      23Name=Duniter Desktop
    
      24Comment=Crypto-currency software to manage libre currency such as Ğ1
    
      25Icon=duniter-desktop
    
      26Exec=/opt/duniter-desktop/nw
    
      27Categories=Network;
    
      28EOF
    
      29
    
      30  chmod 644 credits.html icudtl.dat natives_blob.bin nw_100_percent.pak \
    
      31        nw_200_percent.pak resources.pak snapshot_blob.bin locales/*.pak
    
      32  chmod 755 nw lib lib/*.so locales
    
      33}
    
      34
    
      35package() {
    
      36  cd "$srcdir/"
    
      37
    
      38  install -d -m755 "$pkgdir/usr/share/icons/hicolor/scalable/apps"
    
      39  install -D -m644 images/duniter-logo.svg \
    
      40          "$pkgdir/usr/share/icons/hicolor/scalable/apps/duniter-desktop.svg"
    
      41  # weird utf8 error
    
      42  rm -r images
    
      43
    
      44  install -d -m755 "$pkgdir/usr/share/applications"
    
      45  install -D -m644 duniter-desktop.desktop \
    
      46          "$pkgdir/usr/share/applications/duniter-desktop.desktop"
    
      47  rm duniter-desktop.desktop
    
      48
    
      49  install -d -m755 "$pkgdir/usr/share/licenses/duniter-desktop"
    
      50  install -D -m644 LICENSE \
    
      51          "$pkgdir/usr/share/licenses/duniter-desktop/LICENSE"
    
      52
    
      53  install -d -m755 "$pkgdir/opt"
    
      54  rm "duniter-desktop-v$pkgver-linux-x64.tar.gz"
    
      55  cd ../
    
      56  cp -R src "$pkgdir/opt/duniter-desktop"
    
      57}
    
      58

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2