enpass

LOW

maintainer swiftscythe 0 votes scanned 2026-09-16 13:24:46.488473

View on AUR

Why flagged

Downloads a prebuilt .deb from apt.enpass.io, which is Enpass's own official APT repository (the vendor's own distribution infrastructure), so this is a legitimate official binary with a verified SHA256 checksum; the only concern is that it is a closed-source prebuilt binary, but from the project's own official host.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 80%): Downloads a prebuilt .deb from apt.enpass.io, which is Enpass's own official APT repository (the vendor's own distribution infrastructure), so this is a legitimate official binary with a verified SHA256 checksum; the only concern is that it is a closed-source prebuilt binary, but from the project's own official host.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:20 source=("https://apt.enpass.io/pool/main/e/enpass/${pkgname}_${pkgver}_amd64.deb"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Adrià Arrufat <adria.arrufat@gmail.com>
    
      2#
    
      3# Check for a new release with:
    
      4#   curl -so- https://apt.enpass.io/dists/stable/main/binary-amd64/Packages.gz | zcat | egrep "Package|Version|SHA256" | head -n 3
    
      5
    
      6pkgname=enpass
    
      7pkgver=6.12.6.2258
    
      8pkgrel=1
    
      9pkgdesc='Cross-platform password manager'
    
      10arch=('x86_64')
    
      11url='https://www.enpass.io/'
    
      12license=('LicenseRef-Enpass-EULA')
    
      13depends=('brotli' 'curl' 'dbus' 'fontconfig' 'freetype2' 'gcc-libs' 'gdk-pixbuf2'
    
      14         'glib2' 'glibc' 'gtk3' 'hicolor-icon-theme' 'libcups' 'libglvnd'
    
      15         'libpsl' 'libx11' 'libxkbcommon' 'lsof' 'pango' 'util-linux-libs'
    
      16         'wayland' 'xz' 'zlib')
    
      17optdepends=('gnome-shell: keep the Enpass Assistant window on top (bundled extension)'
    
      18            'xdg-utils: open links in the default browser')
    
      19conflicts=('enpass-bin' 'enpass-beta')
    
      20source=("https://apt.enpass.io/pool/main/e/enpass/${pkgname}_${pkgver}_amd64.deb"
    
      21        'LICENSE')
    
      22sha256sums=('a98d2ff0d6ad392311022453598e59dcc2b9042cf9a001f0bf35e95aed5c3457'
    
      23            '8780f525e9cda983443286ed4be35d152a1ca062e09ec69977e52fd6227e3ce4')
    
      24# Upstream ships stripped binaries; stripping again breaks the browser extension's
    
      25# native messaging host.
    
      26options=('!strip')
    
      27
    
      28package() {
    
      29    # The .deb was built as uid 1000, so drop its ownership or the installed
    
      30    # files end up owned by whatever local user has that uid.
    
      31    bsdtar -xf data.tar.* -C "$pkgdir" --no-same-owner
    
      32    chmod -R u+rwX,go+rX,go-w "$pkgdir"
    
      33
    
      34    install -d "$pkgdir/usr/bin"
    
      35    ln -s /opt/enpass/Enpass "$pkgdir/usr/bin/enpass"
    
      36
    
      37    # GNOME Shell extension. Upstream's postinst copies the variant matching the
    
      38    # running shell; the "legacy" one targets GNOME 40-44, which Arch no longer
    
      39    # ships, so only the ES-module variant is installed. Enable it with:
    
      40    #   gnome-extensions enable enpass-assistant@enpass.io
    
      41    local uuid='enpass-assistant@enpass.io'
    
      42    install -Dm644 -t "$pkgdir/usr/share/gnome-shell/extensions/$uuid" \
    
      43        "$pkgdir/usr/share/enpass/gnome-extension/modern/"{extension.js,metadata.json}
    
      44    rm -r "$pkgdir/usr/share/enpass"
    
      45
    
      46    install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      47}
    
      48

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-16 13:24:46	Low	3
2026-09-16 13:22:46	Medium	3