equicord-openasar

maintainer ArjixWasTaken · 2 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt Discord binary from an untrusted host (dl.discordapp.net) without checksum verification, creating a supply-chain risk if the source were compromised.

Triggered rules

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:106 wget "https://dl.discordapp.net/apps/linux/$discord_ver/discord-$discord_ver.tar.gz" \

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads a prebuilt Discord binary from an untrusted host (dl.discordapp.net) without checksum verification, creating a supply-chain risk if the source were compromised.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer ArjixWasTaken <me@arjix.dev>
    
      2
    
      3# shellcheck shell=bash
    
      4# shellcheck disable=SC2034,SC2154,SC2155,SC2164
    
      5
    
      6pkgname=equicord-openasar
    
      7_pkgname=equicord
    
      8pkgver=1.0.137.r7632g29921a58a.r863g5a05f49
    
      9pkgrel=1
    
      10pkgdesc='The other cutest Discord client mod (with OpenAsar)'
    
      11arch=('x86_64')
    
      12url='https://equicord.org/'
    
      13license=('custom')
    
      14options=('!debug' '!strip')
    
      15depends=('libnotify' 'libxss' 'nspr' 'nss' 'gtk3' 'hicolor-icon-theme')
    
      16optdepends=('libpulse: PulseAudio support'
    
      17            'libappindicator-gtk3: Systray indicator support'
    
      18            'xdg-utils: For opening URLs and files')
    
      19makedepends=('git' 'nvm' 'pnpm' 'wget' 'asar')
    
      20provides=("$_pkgname")
    
      21conflicts=("$_pkgname")
    
      22source=(
    
      23    'equicord-source::git+https://github.com/Equicord/Equicord.git'
    
      24    'openasar-source::git+https://github.com/GooseMod/OpenAsar.git'
    
      25    'discord-pkgbuild::https://gitlab.archlinux.org/archlinux/packaging/packages/discord/-/raw/main/PKGBUILD'
    
      26    'equicord.desktop'
    
      27    'equicord.png'
    
      28    'equicord.sh'
    
      29)
    
      30sha512sums=('SKIP'
    
      31            'SKIP'
    
      32            'SKIP'
    
      33            '25c3e3cbef8c981a42ba059f589ffc9ebe8c81406fa6cd6b000ed7b4e3c7b95ae96108df2a29096a8c527153b3becf98b1769b2af75d5f6cf0fe69edd2b3da3a'
    
      34            '94f091c05c365986d556616404e00344a1d8e4ba93ad1875c0d3d96b1d0a643a799343fe6b84dcf7013ea3f9d47a3380540d8212bbf3fb6f5ddf39840ffe38d5'
    
      35            '0fa583c0ea3645298afd34d598a9745095e44eac04ee4327d6e484ebeeeebb942cd6267ef7b706c40408419b560537bde6413c9b046c8d262028a79bef843d70')
    
      36
    
      37pkgver() {
    
      38    local discord_ver=$(grep -oE '^pkgver=(.*?)$' discord-pkgbuild)
    
      39    local equicord_ver
    
      40    {
    
      41        local commits sha
    
      42
    
      43        pushd equicord-source
    
      44            commits=$(git rev-list --count HEAD)
    
      45            sha=$(git rev-parse --short HEAD)
    
      46        popd
    
      47
    
      48        equicord_ver="r${commits}g${sha}"
    
      49    } > /dev/null
    
      50
    
      51    local openasar_ver
    
      52    {
    
      53        local commits sha
    
      54
    
      55        pushd openasar-source
    
      56            commits=$(git rev-list --count HEAD)
    
      57            sha=$(git rev-parse --short HEAD)
    
      58        popd
    
      59
    
      60        openasar_ver="r${commits}g${sha}"
    
      61    } > /dev/null
    
      62
    
      63    echo "${discord_ver#pkgver=}.${equicord_ver}.${openasar_ver}"
    
      64}
    
      65
    
      66_ensure_local_nvm() {
    
      67  # let's be sure we are starting clean
    
      68  which nvm >/dev/null 2>&1 && nvm deactivate && nvm unload
    
      69  export NVM_DIR="${srcdir}/.nvm"
    
      70
    
      71  # The init script returns 3 if version specified
    
      72  # in ./.nvmrc is not (yet) installed in $NVM_DIR
    
      73  # but nvm itself still gets loaded ok
    
      74  # shellcheck source=/dev/null
    
      75  source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
    
      76}
    
      77
    
      78prepare() {
    
      79    export PNPM_HOME="$srcdir/pnpm-home"
    
      80    pushd equicord-source
    
      81        _ensure_local_nvm
    
      82        nvm install --lts
    
      83        pnpm install --frozen-lockfile
    
      84
    
      85        sed -i \
    
      86            -e '#async function fetchUpdates\(\) {#a return false;' \
    
      87            -e '#async function applyUpdates\(\) {#a return false;' \
    
      88            src/main/updater/http.ts
    
      89    popd
    
      90
    
      91    pushd openasar-source
    
      92        sed -i -e "s|nightly|nightly-$(git rev-parse HEAD | cut -c 1-7)|" src/index.js
    
      93        sed -i -e "/config.setup = true/a\  config.autoupdate = false;" src/config/index.js
    
      94        sed -i -e "s|^Exec=\${exec}$|Exec=/usr/bin/${_pkgname}|" \
    
      95        		-e "s|^Name=\${basename(exec)}$|Name=${_pkgname^}|" src/autoStart.js
    
      96        node scripts/strip.js
    
      97        asar pack src openasar.asar
    
      98    popd
    
      99}
    
      100
    
      101build() {
    
      102    export PNPM_HOME="$srcdir/pnpm-home"
    
      103    local discord_ver="${pkgver%%.r*}"
    
      104    
    
      105    echo "Downloading discord: v$discord_ver"
    
      106    wget "https://dl.discordapp.net/apps/linux/$discord_ver/discord-$discord_ver.tar.gz" \
    
      107        -O "discord-$discord_ver.tar.gz" \
    
      108        --continue
    
      109
    
      110    rm -rf "discord-$discord_ver"; mkdir "discord-$discord_ver"
    
      111    tar -xzvf "discord-$discord_ver.tar.gz" -C "discord-$discord_ver" --strip-components=1
    
      112
    
      113    pushd equicord-source
    
      114        _ensure_local_nvm
    
      115        EQUICORD_REMOTE="Equicord/Equicord" pnpm buildStandalone
    
      116
    
      117        pushd dist
    
      118            mkdir app
    
      119            echo '{"name": "discord", "main": "index.js"}' > app/package.json
    
      120            echo 'require(require("path").resolve(require("electron").app.getAppPath(), "..", "equicord.asar"));' > app/index.js
    
      121            asar pack app app.asar
    
      122            rm -rf app
    
      123        popd
    
      124    popd
    
      125
    
      126    local entry_hash="$(sha256sum equicord-source/dist/app.asar | awk '{print $1}')"
    
      127    local openasar_hash="$(sha256sum openasar-source/openasar.asar | awk '{print $1}')"
    
      128    local equicord_hash="$(sha256sum equicord-source/dist/desktop.asar | awk '{print $1}')"
    
      129
    
      130    sed -i \
    
      131        -e 's/INSERT_ENTRYPOINT_HASH_HERE/'"$entry_hash"'/' \
    
      132        -e 's/INSERT_OPENASAR_HASH_HERE/'"$openasar_hash"'/' \
    
      133        -e 's/INSERT_EQUICORD_HASH_HERE/'"$equicord_hash"'/' \
    
      134        equicord.sh
    
      135}
    
      136
    
      137package() {
    
      138  local discord="$(pwd)/discord-${pkgver%%.r*}"
    
      139  local equicord="$(pwd)/equicord-source"
    
      140  local openasar="$(pwd)/openasar-source"
    
      141
    
      142  install -Dm755 $_pkgname.sh "$pkgdir"/usr/bin/$_pkgname
    
      143  install -Dm644 $_pkgname.desktop "$pkgdir"/usr/share/applications/$_pkgname.desktop
    
      144  install -Dm644 $_pkgname.png "$pkgdir"/usr/share/icons/hicolor/256x256/apps/$_pkgname.png
    
      145
    
      146  cd "$discord"
    
      147  install -Dm755 updater_bootstrap "$pkgdir"/usr/share/$_pkgname/updater_bootstrap
    
      148
    
      149
    
      150  cd "$equicord"
    
      151  install -Dm644 dist/app.asar "$pkgdir"/usr/share/$_pkgname/app.asar
    
      152  install -Dm644 dist/desktop.asar "$pkgdir"/usr/share/$_pkgname/equicord.asar
    
      153
    
      154  cd "$openasar"
    
      155  install -Dm644 openasar.asar "$pkgdir"/usr/share/$_pkgname/openasar.asar
    
      156}
    
      157

Changes since previous scan

--- PKGBUILD @ 2026-07-18 00:14
+++ PKGBUILD @ 2026-08-03 00:08
@@ -5,7 +5,7 @@
 
 pkgname=equicord-openasar
 _pkgname=equicord
-pkgver=1.0.137.r7596gf06917ad8.r863g5a05f49
+pkgver=1.0.137.r7632g29921a58a.r863g5a05f49
 pkgrel=1
 pkgdesc='The other cutest Discord client mod (with OpenAsar)'
 arch=('x86_64')

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 19:59:04	MEDIUM	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 03:50:18	MEDIUM	1