enpass-x11-bin

LOW

maintainer musdus 0 votes scanned 2026-09-18 15:30:43.058042

View on AUR

Why flagged

Downloads a prebuilt .deb from apt.enpass.io, which is Enpass's own official APT repository, with a pinned sha256 checksum; this is standard AUR packaging of a proprietary binary from the vendor's own infrastructure, not a swappable third-party host.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 85%): Downloads a prebuilt .deb from apt.enpass.io, which is Enpass's own official APT repository, with a pinned sha256 checksum; this is standard AUR packaging of a proprietary binary from the vendor's own infrastructure, not a swappable third-party host.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:23 source=("https://apt.enpass.io/pool/main/e/enpass/${_pkgname}_${pkgver}_amd64.deb")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: musqz <gummy-fang-deputy@duck.com>
    
      2# Based on enpass-bin from the AUR
    
      3
    
      4pkgname='enpass-x11-bin'
    
      5_pkgname='enpass'
    
      6pkgver=6.12.6.2255
    
      7pkgrel=1
    
      8pkgdesc='A multiplatform password manager (X11 build from the upstream x11 channel)'
    
      9arch=('x86_64')
    
      10url='https://www.enpass.io/'
    
      11# Full terms: https://www.enpass.io/terms-of-use/ (vendor prohibits redistributing the text,
    
      12# so no license file is shipped)
    
      13license=('custom')
    
      14depends=('libxss' 'lsof' 'curl' 'libxkbcommon-x11' 'libxcb' 'xcb-util-wm'
    
      15         'xcb-util-image' 'xcb-util-keysyms' 'xcb-util-renderutil' 'gtk3' 'glib2'
    
      16         'dbus' 'freetype2' 'fontconfig' 'pango' 'gdk-pixbuf2' 'xcb-util-cursor'
    
      17         'libsm' 'libice' 'libglvnd' 'hicolor-icon-theme')
    
      18optdepends=('libxdg-basedir: Open links in the default browser.'
    
      19            'libqtxdg: Open links in the default browser (Qt implementation)')
    
      20provides=("${_pkgname}")
    
      21conflicts=("${_pkgname}" 'enpass-bin')
    
      22install="${pkgname}.install"
    
      23source=("https://apt.enpass.io/pool/main/e/enpass/${_pkgname}_${pkgver}_amd64.deb")
    
      24sha256sums=('716fbae54d52ccd807a6bd53f4cf2d359f6c7f0892ad8491f3a1bf5d8d37b099')
    
      25
    
      26# Disable strip as otherwise the browser extension will not work
    
      27options=('!strip')
    
      28
    
      29# Upstream x11 channel index (for checking new versions):
    
      30# https://apt.enpass.io/dists/x11/main/binary-amd64/Packages
    
      31
    
      32package() {
    
      33    # Extract data (handles gz/xz/zst)
    
      34    tar xf "${srcdir}"/data.tar.* -C "${pkgdir}"
    
      35
    
      36    # Upstream .deb embeds non-root ownership on extracted files; correct it
    
      37    chown -R root:root "${pkgdir}"
    
      38
    
      39    # Match default system permissions
    
      40    chmod -R go-w "${pkgdir}/opt/"
    
      41    chmod 755 "${pkgdir}/opt/"
    
      42    find "${pkgdir}/usr/" -type d -exec chmod 755 {} \;
    
      43
    
      44    # CLI launcher
    
      45    mkdir -p "${pkgdir}/usr/bin"
    
      46    ln -s '/opt/enpass/Enpass' "${pkgdir}/usr/bin/enpass"
    
      47}
    
      48
    
      49# vim: set syntax=sh:
    
      50

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-18 15:30:43	Low	3
2026-09-18 15:28:46	Medium	2