equicord

maintainer ArjixWasTaken · 7 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt Discord binary from Discord's official domain, which is a normal part of the build process, but the static analyzer flagged the external download not listed in source=(); however, the host (dl.discordapp.net) is legitimate and the download is expected, making this a false positive with low risk.

Triggered rules

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:80 wget "https://dl.discordapp.net/apps/linux/$discord_ver/discord-$discord_ver.tar.gz" \

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt Discord binary from Discord's official domain, which is a normal part of the build process, but the static analyzer flagged the external download not listed in source=(); however, the host (dl.discordapp.net) is legitimate and the download is expected, making this a false positive with low risk.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer ArjixWasTaken <me@arjix.dev>
    
      2
    
      3# shellcheck shell=bash
    
      4# shellcheck disable=SC2034,SC2154,SC2155,SC2164
    
      5
    
      6pkgname=equicord
    
      7_pkgname=Equicord
    
      8pkgver=1.0.137.r7648g1e353f3bd
    
      9pkgrel=1
    
      10epoch=2
    
      11pkgdesc='The other cutest Discord client mod'
    
      12arch=('x86_64')
    
      13url='https://equicord.org/'
    
      14license=('custom')
    
      15options=('!debug' '!strip')
    
      16depends=('libnotify' 'libxss' 'nspr' 'nss' 'gtk3' 'hicolor-icon-theme')
    
      17optdepends=('libpulse: PulseAudio support'
    
      18            'libappindicator-gtk3: Systray indicator support'
    
      19            'xdg-utils: For opening URLs and files')
    
      20makedepends=('git' 'nvm' 'pnpm' 'wget' 'asar')
    
      21source=(
    
      22    'equicord-source::git+https://github.com/Equicord/Equicord.git'
    
      23    'discord-pkgbuild::https://gitlab.archlinux.org/archlinux/packaging/packages/discord/-/raw/main/PKGBUILD'
    
      24    'equicord.desktop'
    
      25    'equicord.png'
    
      26    'equicord.sh'
    
      27)
    
      28sha512sums=('SKIP'
    
      29            'SKIP'
    
      30            '25c3e3cbef8c981a42ba059f589ffc9ebe8c81406fa6cd6b000ed7b4e3c7b95ae96108df2a29096a8c527153b3becf98b1769b2af75d5f6cf0fe69edd2b3da3a'
    
      31            '94f091c05c365986d556616404e00344a1d8e4ba93ad1875c0d3d96b1d0a643a799343fe6b84dcf7013ea3f9d47a3380540d8212bbf3fb6f5ddf39840ffe38d5'
    
      32            '2b7885cc7cad6d10d5d503fa1f55bf418dbea4d96fe4f3f917bd20bd5d934c7342c794ea77bea11aca79cc04d6f386f6e91dd5bd3fbf8a206e206bf440cd4be3')
    
      33
    
      34pkgver() {
    
      35    local discord_ver=$(grep -oE '^pkgver=(.*?)$' discord-pkgbuild)
    
      36    local equicord_ver
    
      37    {
    
      38        local commits sha
    
      39        pushd equicord-source
    
      40            commits=$(git rev-list --count HEAD)
    
      41            sha=$(git rev-parse --short HEAD)
    
      42        popd
    
      43        equicord_ver="r${commits}g${sha}"
    
      44    } > /dev/null
    
      45
    
      46    echo "${discord_ver#pkgver=}.${equicord_ver}"
    
      47}
    
      48
    
      49_ensure_local_nvm() {
    
      50  # let's be sure we are starting clean
    
      51  which nvm >/dev/null 2>&1 && nvm deactivate && nvm unload
    
      52  export NVM_DIR="${srcdir}/.nvm"
    
      53
    
      54  # The init script returns 3 if version specified
    
      55  # in ./.nvmrc is not (yet) installed in $NVM_DIR
    
      56  # but nvm itself still gets loaded ok
    
      57  # shellcheck source=/dev/null
    
      58  source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
    
      59}
    
      60
    
      61prepare() {
    
      62    export PNPM_HOME="$srcdir/pnpm-home"
    
      63    pushd equicord-source
    
      64        _ensure_local_nvm
    
      65        nvm install --lts
    
      66        pnpm install --frozen-lockfile
    
      67
    
      68        sed -i \
    
      69            -e '#async function fetchUpdates\(\) {#a return false;' \
    
      70            -e '#async function applyUpdates\(\) {#a return false;' \
    
      71            src/main/updater/http.ts
    
      72    popd
    
      73}
    
      74
    
      75build() {
    
      76    export PNPM_HOME="$srcdir/pnpm-home"
    
      77    local discord_ver="${pkgver%%.r*}"
    
      78    
    
      79    echo "Downloading discord: v$discord_ver"
    
      80    wget "https://dl.discordapp.net/apps/linux/$discord_ver/discord-$discord_ver.tar.gz" \
    
      81        -O "discord-$discord_ver.tar.gz" \
    
      82        --continue
    
      83
    
      84    rm -rf "discord-$discord_ver"; mkdir "discord-$discord_ver"
    
      85    tar -xzvf "discord-$discord_ver.tar.gz" -C "discord-$discord_ver" --strip-components=1
    
      86
    
      87    pushd equicord-source
    
      88        _ensure_local_nvm
    
      89        EQUICORD_REMOTE="Equicord/Equicord" pnpm buildStandalone
    
      90
    
      91        pushd dist
    
      92            mkdir app
    
      93            echo '{"name": "discord", "main": "index.js"}' > app/package.json
    
      94            echo 'require(require("path").resolve(require("electron").app.getAppPath(), "..", "equicord.asar"));' > app/index.js
    
      95            asar pack app app.asar
    
      96            rm -rf app
    
      97        popd
    
      98    popd
    
      99
    
      100    local hash="$(sha256sum equicord-source/dist/app.asar | awk '{print $1}')"
    
      101    sed -i 's/INSERT_HASH_HERE/'"$hash"'/' equicord.sh
    
      102}
    
      103
    
      104package() {
    
      105  local discord="$(pwd)/discord-${pkgver%%.r*}"
    
      106  local equicord="$(pwd)/equicord-source"
    
      107
    
      108  install -Dm755 $pkgname.sh "$pkgdir"/usr/bin/$pkgname
    
      109  install -Dm644 $pkgname.desktop "$pkgdir"/usr/share/applications/$pkgname.desktop
    
      110  install -Dm644 $pkgname.png "$pkgdir"/usr/share/icons/hicolor/256x256/apps/$pkgname.png
    
      111
    
      112  cd "$discord"
    
      113  install -Dm755 updater_bootstrap "$pkgdir"/usr/share/$pkgname/updater_bootstrap
    
      114
    
      115  cd "$equicord"
    
      116  install -Dm644 dist/app.asar "$pkgdir"/usr/share/$pkgname/app.asar
    
      117  install -Dm644 dist/desktop.asar "$pkgdir"/usr/share/$pkgname/equicord.asar
    
      118}
    
      119

Changes since previous scan

--- PKGBUILD @ 2026-07-18 00:14
+++ PKGBUILD @ 2026-08-03 00:08
@@ -5,7 +5,7 @@
 
 pkgname=equicord
 _pkgname=Equicord
-pkgver=1.0.137.r7596gf06917ad8
+pkgver=1.0.137.r7648g1e353f3bd
 pkgrel=1
 epoch=2
 pkgdesc='The other cutest Discord client mod'

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 19:59:04	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 03:50:18	MEDIUM	2