duniter-desktop-bin

MEDIUM

maintainer orphaned 2 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads a prebuilt binary tarball (containing an NW.js application with native .so libraries and a bundled 'nw' executable) directly from a GitLab CI/CD job artifact URL on git.duniter.org. While git.duniter.org is the project's own official GitLab instance (not a random personal host), the artifact is identified by a numeric job ID (_gitlab_job_id=21913) rather than a tagged release artifact. CI job artifacts can be overwritten or expire and be replaced, and there is no guarantee of immutability. However, a sha256sum is provided which pins the exact content at packaging time, mitigating silent substitution risk. The binary itself is an executed NW.js bundle with native shared libraries installed to /opt, which is the standard concern for any -bin package. The use of a CI job artifact URL rather than a stable release URL is non-standard and slightly increases supply-chain risk, but the sha256 checksum and the fact that this is the project's own infrastructure keeps this at medium rather than high. Overall this is a legitimate but non-ideal packaging pattern for a binary package.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source=("https://git.duniter.org/nodes/typescript/duniter/-/jobs/${_gitlab_job_id}/artifacts/raw/work/bin/duniter-desktop-v$pkgver-linux-x64.tar.gz")

Medium AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt binary tarball (containing an NW.js application with native .so libraries and a bundled 'nw' executable) directly from a GitLab CI/CD job artifact URL on git.duniter.org. While git.duniter.org is the project's own official GitLab instance (not a random personal host), the artifact is identified by a numeric job ID (_gitlab_job_id=21913) rather than a tagged release artifact. CI job artifacts can be overwritten or expire and be replaced, and there is no guarantee of immutability. However, a sha256sum is provided which pins the exact content at packaging time, mitigating silent substitution risk. The binary itself is an executed NW.js bundle with native shared libraries installed to /opt, which is the standard concern for any -bin package. The use of a CI job artifact URL rather than a stable release URL is non-standard and slightly increases supply-chain risk, but the sha256 checksum and the fact that this is the project's own infrastructure keeps this at medium rather than high. Overall this is a legitimate but non-ideal packaging pattern for a binary package.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Étienne Deparis <etienne@depar.is>
    
      2pkgname=duniter-desktop-bin
    
      3_pkgname=duniter-desktop
    
      4pkgver=1.7.18
    
      5pkgrel=1
    
      6_gitlab_job_id=21913
    
      7pkgdesc="Crypto-currency software to manage libre currency such as Ğ1"
    
      8arch=("x86_64")
    
      9url="https://duniter.org/fr/"
    
      10license=("AGPL3")
    
      11provides=("duniter-desktop")
    
      12conflicts=("duniter-desktop")
    
      13options=('!strip')
    
      14source=("https://git.duniter.org/nodes/typescript/duniter/-/jobs/${_gitlab_job_id}/artifacts/raw/work/bin/duniter-desktop-v$pkgver-linux-x64.tar.gz")
    
      15sha256sums=('7759b674fac29a874a9ee2e27ec3807f7195c07f0e8999cfb76f9801d5162dc4')
    
      16
    
      17prepare() {
    
      18  cd "$srcdir"
    
      19
    
      20  cat >> duniter-desktop.desktop <<EOF
    
      21[Desktop Entry]
    
      22Type=Application
    
      23Name=Duniter Desktop
    
      24Comment=Crypto-currency software to manage libre currency such as Ğ1
    
      25Icon=duniter-desktop
    
      26Exec=/opt/duniter-desktop/nw
    
      27Categories=Network;
    
      28EOF
    
      29
    
      30  chmod 644 credits.html icudtl.dat natives_blob.bin nw_100_percent.pak \
    
      31        nw_200_percent.pak resources.pak snapshot_blob.bin locales/*.pak
    
      32  chmod 755 nw lib lib/*.so locales
    
      33}
    
      34
    
      35package() {
    
      36  cd "$srcdir/"
    
      37
    
      38  install -d -m755 "$pkgdir/usr/share/icons/hicolor/scalable/apps"
    
      39  install -D -m644 images/duniter-logo.svg \
    
      40          "$pkgdir/usr/share/icons/hicolor/scalable/apps/duniter-desktop.svg"
    
      41  # weird utf8 error
    
      42  rm -r images
    
      43
    
      44  install -d -m755 "$pkgdir/usr/share/applications"
    
      45  install -D -m644 duniter-desktop.desktop \
    
      46          "$pkgdir/usr/share/applications/duniter-desktop.desktop"
    
      47  rm duniter-desktop.desktop
    
      48
    
      49  install -d -m755 "$pkgdir/usr/share/licenses/duniter-desktop"
    
      50  install -D -m644 LICENSE \
    
      51          "$pkgdir/usr/share/licenses/duniter-desktop/LICENSE"
    
      52
    
      53  install -d -m755 "$pkgdir/opt"
    
      54  rm "duniter-desktop-v$pkgver-linux-x64.tar.gz"
    
      55  cd ../
    
      56  cp -R src "$pkgdir/opt/duniter-desktop"
    
      57}
    
      58

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2
2026-08-29 00:29:17	Medium	2