equicord
MEDIUM
maintainer ArjixWasTaken
8 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads a prebuilt Discord binary from Discord's official domain, which is a normal part of the build process, but the static analyzer flagged the external download not listed in source=(); however, the host (dl.discordapp.net) is legitimate and the download is expected, making this a false positive with low risk.
Triggered rules
Medium
External download from an untrusted host, not in source=()
external_download_not_in_source
curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.
-
PKGBUILD:80
wget "https://dl.discordapp.net/apps/linux/$discord_ver/discord-$discord_ver.tar.gz" \
Medium
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt Discord binary from Discord's official domain, which is a normal part of the build process, but the static analyzer flagged the external download not listed in source=(); however, the host (dl.discordapp.net) is legitimate and the download is expected, making this a false positive with low risk.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer ArjixWasTaken <me@arjix.dev>
2
3
# shellcheck shell=bash
4
# shellcheck disable=SC2034,SC2154,SC2155,SC2164
5
6
pkgname=equicord
7
_pkgname=Equicord
8
pkgver=1.0.137.r7648g1e353f3bd
9
pkgrel=1
10
epoch=2
11
pkgdesc='The other cutest Discord client mod'
12
arch=('x86_64')
13
url='https://equicord.org/'
14
license=('custom')
15
options=('!debug' '!strip')
16
depends=('libnotify' 'libxss' 'nspr' 'nss' 'gtk3' 'hicolor-icon-theme')
17
optdepends=('libpulse: PulseAudio support'
18
'libappindicator-gtk3: Systray indicator support'
19
'xdg-utils: For opening URLs and files')
20
makedepends=('git' 'nvm' 'pnpm' 'wget' 'asar')
21
source=(
22
'equicord-source::git+https://github.com/Equicord/Equicord.git'
23
'discord-pkgbuild::https://gitlab.archlinux.org/archlinux/packaging/packages/discord/-/raw/main/PKGBUILD'
24
'equicord.desktop'
25
'equicord.png'
26
'equicord.sh'
27
)
28
sha512sums=('SKIP'
29
'SKIP'
30
'25c3e3cbef8c981a42ba059f589ffc9ebe8c81406fa6cd6b000ed7b4e3c7b95ae96108df2a29096a8c527153b3becf98b1769b2af75d5f6cf0fe69edd2b3da3a'
31
'94f091c05c365986d556616404e00344a1d8e4ba93ad1875c0d3d96b1d0a643a799343fe6b84dcf7013ea3f9d47a3380540d8212bbf3fb6f5ddf39840ffe38d5'
32
'2b7885cc7cad6d10d5d503fa1f55bf418dbea4d96fe4f3f917bd20bd5d934c7342c794ea77bea11aca79cc04d6f386f6e91dd5bd3fbf8a206e206bf440cd4be3')
33
34
pkgver() {
35
local discord_ver=$(grep -oE '^pkgver=(.*?)$' discord-pkgbuild)
36
local equicord_ver
37
{
38
local commits sha
39
pushd equicord-source
40
commits=$(git rev-list --count HEAD)
41
sha=$(git rev-parse --short HEAD)
42
popd
43
equicord_ver="r${commits}g${sha}"
44
} > /dev/null
45
46
echo "${discord_ver#pkgver=}.${equicord_ver}"
47
}
48
49
_ensure_local_nvm() {
50
# let's be sure we are starting clean
51
which nvm >/dev/null 2>&1 && nvm deactivate && nvm unload
52
export NVM_DIR="${srcdir}/.nvm"
53
54
# The init script returns 3 if version specified
55
# in ./.nvmrc is not (yet) installed in $NVM_DIR
56
# but nvm itself still gets loaded ok
57
# shellcheck source=/dev/null
58
source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
59
}
60
61
prepare() {
62
export PNPM_HOME="$srcdir/pnpm-home"
63
pushd equicord-source
64
_ensure_local_nvm
65
nvm install --lts
66
pnpm install --frozen-lockfile
67
68
sed -i \
69
-e '#async function fetchUpdates\(\) {#a return false;' \
70
-e '#async function applyUpdates\(\) {#a return false;' \
71
src/main/updater/http.ts
72
popd
73
}
74
75
build() {
76
export PNPM_HOME="$srcdir/pnpm-home"
77
local discord_ver="${pkgver%%.r*}"
78
79
echo "Downloading discord: v$discord_ver"
80
wget "https://dl.discordapp.net/apps/linux/$discord_ver/discord-$discord_ver.tar.gz" \
81
-O "discord-$discord_ver.tar.gz" \
82
--continue
83
84
rm -rf "discord-$discord_ver"; mkdir "discord-$discord_ver"
85
tar -xzvf "discord-$discord_ver.tar.gz" -C "discord-$discord_ver" --strip-components=1
86
87
pushd equicord-source
88
_ensure_local_nvm
89
EQUICORD_REMOTE="Equicord/Equicord" pnpm buildStandalone
90
91
pushd dist
92
mkdir app
93
echo '{"name": "discord", "main": "index.js"}' > app/package.json
94
echo 'require(require("path").resolve(require("electron").app.getAppPath(), "..", "equicord.asar"));' > app/index.js
95
asar pack app app.asar
96
rm -rf app
97
popd
98
popd
99
100
local hash="$(sha256sum equicord-source/dist/app.asar | awk '{print $1}')"
101
sed -i 's/INSERT_HASH_HERE/'"$hash"'/' equicord.sh
102
}
103
104
package() {
105
local discord="$(pwd)/discord-${pkgver%%.r*}"
106
local equicord="$(pwd)/equicord-source"
107
108
install -Dm755 $pkgname.sh "$pkgdir"/usr/bin/$pkgname
109
install -Dm644 $pkgname.desktop "$pkgdir"/usr/share/applications/$pkgname.desktop
110
install -Dm644 $pkgname.png "$pkgdir"/usr/share/icons/hicolor/256x256/apps/$pkgname.png
111
112
cd "$discord"
113
install -Dm755 updater_bootstrap "$pkgdir"/usr/share/$pkgname/updater_bootstrap
114
115
cd "$equicord"
116
install -Dm644 dist/app.asar "$pkgdir"/usr/share/$pkgname/app.asar
117
install -Dm644 dist/desktop.asar "$pkgdir"/usr/share/$pkgname/equicord.asar
118
}
119
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Medium | 2 |
| 2026-09-16 00:03:17 | Medium | 2 |
| 2026-09-15 00:25:31 | Medium | 2 |
| 2026-09-14 00:27:57 | Medium | 2 |
| 2026-09-13 00:19:54 | Medium | 2 |
| 2026-09-12 00:25:17 | Medium | 2 |
| 2026-09-11 00:19:22 | Medium | 2 |
| 2026-09-10 00:22:44 | Medium | 2 |
| 2026-09-09 00:04:09 | Medium | 2 |
| 2026-09-08 00:18:08 | Medium | 2 |
| 2026-09-07 00:30:15 | Medium | 2 |
| 2026-09-06 00:17:06 | Medium | 2 |
| 2026-09-05 00:16:27 | Medium | 2 |
| 2026-09-04 00:03:13 | Medium | 2 |
| 2026-09-03 00:15:47 | Medium | 2 |
| 2026-09-02 00:02:31 | Medium | 2 |
| 2026-09-01 00:11:19 | Medium | 2 |
| 2026-08-31 00:19:57 | Medium | 2 |
| 2026-08-30 00:04:14 | Medium | 2 |
| 2026-08-29 00:29:17 | Medium | 2 |