frame0

MEDIUM

maintainer PanNNN 1 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads a prebuilt .deb from a non-standard host (files.frame0.app), which is not a common code forge or vendor domain, and installs it without verifying the origin or integrity beyond the checksum; this creates a supply-chain risk if the host is compromised or the package is tampered with in transit.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:44 source=("https://files.frame0.app/releases/linux/x64/frame0_${pkgver}_amd64.deb")

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads a prebuilt .deb from a non-standard host (files.frame0.app), which is not a common code forge or vendor domain, and installs it without verifying the origin or integrity beyond the checksum; this creates a supply-chain risk if the host is compromised or the package is tampered with in transit.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: PanNNN <cool.panjianhao@gmail.com>
    
      2pkgname=frame0
    
      3pkgver=1.7.0
    
      4pkgrel=1
    
      5pkgdesc="A sleek Balsamiq-alternative wireframing tool for modern apps"
    
      6arch=('x86_64')
    
      7url="https://frame0.app"
    
      8license=('LicenseRef-Frame0-EULA' 'MIT')
    
      9options=('!strip' '!debug')
    
      10depends=(
    
      11  'alsa-lib'
    
      12  'at-spi2-core'
    
      13  'cairo'
    
      14  'dbus'
    
      15  'expat'
    
      16  'fontconfig'
    
      17  'glib2'
    
      18  'glibc'
    
      19  'gtk3'
    
      20  'libcups'
    
      21  'libdrm'
    
      22  'libgcc'
    
      23  'libnotify'
    
      24  'libstdc++'
    
      25  'libx11'
    
      26  'libxcb'
    
      27  'libxcomposite'
    
      28  'libxdamage'
    
      29  'libxext'
    
      30  'libxfixes'
    
      31  'libxkbcommon'
    
      32  'libxrandr'
    
      33  'mesa'
    
      34  'nspr'
    
      35  'nss'
    
      36  'pango'
    
      37  'systemd-libs'
    
      38  'xdg-utils'
    
      39)
    
      40optdepends=(
    
      41  'libpulse: PulseAudio/PipeWire audio output'
    
      42  'libsecret: store credentials in the system keyring'
    
      43)
    
      44source=("https://files.frame0.app/releases/linux/x64/frame0_${pkgver}_amd64.deb")
    
      45sha256sums=('637e311783d906f05363087f2805ba6b93d443f66f3175b02582dee5b3085c89')
    
      46
    
      47package() {
    
      48  # makepkg already extracts the .deb; data.tar may be .xz or .zst depending on upstream
    
      49  bsdtar -xf "${srcdir}"/data.tar.* -C "${pkgdir}"
    
      50
    
      51  # Debian-only metadata
    
      52  rm -rf "${pkgdir}/usr/share/lintian"
    
      53
    
      54  # Licenses (Frame0 itself is under its EULA: https://frame0.app/legals/license)
    
      55  install -Dm644 "${pkgdir}/usr/share/doc/${pkgname}/copyright" \
    
      56    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.electron"
    
      57  install -Dm644 "${pkgdir}/usr/lib/${pkgname}/LICENSES.chromium.html" \
    
      58    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSES.chromium.html"
    
      59}
    
      60

Changes since previous scan

--- PKGBUILD @ 2026-10-26 00:12
+++ PKGBUILD @ 2026-11-01 00:21
@@ -1,34 +1,60 @@
 # Maintainer: PanNNN <cool.panjianhao@gmail.com>
 pkgname=frame0
-pkgver=1.2.0
+pkgver=1.7.0
 pkgrel=1
-pkgdesc="A Balsamiq-alternative wireframming tool for modern apps"
+pkgdesc="A sleek Balsamiq-alternative wireframing tool for modern apps"
 arch=('x86_64')
 url="https://frame0.app"
-license=('custom')
+license=('LicenseRef-Frame0-EULA' 'MIT')
+options=('!strip' '!debug')
 depends=(
-  "gtk3"
-  "nss"
-  "libnotify"
-  "libxtst"
-  "xdg-utils"
-  "at-spi2-core"
-  "libdrm"
-  "mesa"
-  "libxcb"
-  "glib2"
+  'alsa-lib'
+  'at-spi2-core'
+  'cairo'
+  'dbus'
+  'expat'
+  'fontconfig'
+  'glib2'
+  'glibc'
+  'gtk3'
+  'libcups'
+  'libdrm'
+  'libgcc'
+  'libnotify'
+  'libstdc++'
+  'libx11'
+  'libxcb'
+  'libxcomposite'
+  'libxdamage'
+  'libxext'
+  'libxfixes'
+  'libxkbcommon'
+  'libxrandr'
+  'mesa'
+  'nspr'
+  'nss'
+  'pango'
+  'systemd-libs'
+  'xdg-utils'
 )
 optdepends=(
-  'pulseaudio'
+  'libpulse: PulseAudio/PipeWire audio output'
+  'libsecret: store credentials in the system keyring'
 )
 source=("https://files.frame0.app/releases/linux/x64/frame0_${pkgver}_amd64.deb")
-sha256sums=('1fd9cbad0ccecfb0bd839dd15408a6343e0ad01168f983cca57d9d74b14896ce')
+sha256sums=('637e311783d906f05363087f2805ba6b93d443f66f3175b02582dee5b3085c89')
 
 package() {
-  cd "${srcdir}"
-  # Extract the .deb file
-  ar x frame0_${pkgver}_amd64.deb
-  # Extract the data.tar.xz file
-  bsdtar -xf data.tar.xz -C "${pkgdir}"
+  # makepkg already extracts the .deb; data.tar may be .xz or .zst depending on upstream
+  bsdtar -xf "${srcdir}"/data.tar.* -C "${pkgdir}"
+
+  # Debian-only metadata
+  rm -rf "${pkgdir}/usr/share/lintian"
+
+  # Licenses (Frame0 itself is under its EULA: https://frame0.app/legals/license)
+  install -Dm644 "${pkgdir}/usr/share/doc/${pkgname}/copyright" \
+    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.electron"
+  install -Dm644 "${pkgdir}/usr/lib/${pkgname}/LICENSES.chromium.html" \
+    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSES.chromium.html"
 }
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Medium	2
2026-10-31 00:07:41	Medium	2
2026-10-30 00:29:30	Medium	2
2026-10-29 00:13:55	Medium	2
2026-10-28 00:06:54	Medium	2
2026-10-27 00:23:28	Medium	2
2026-10-26 15:45:54	Medium	2
2026-10-26 00:12:40	Medium	2
2026-10-25 00:20:48	Medium	2
2026-10-24 00:14:55	Medium	2
2026-10-23 00:02:19	Medium	2
2026-10-22 00:13:10	Medium	2
2026-10-21 00:12:50	Medium	2
2026-10-20 00:10:31	Medium	2
2026-10-19 00:03:55	Medium	2
2026-10-18 00:06:55	Medium	2
2026-10-17 00:21:55	Medium	2
2026-10-16 00:12:47	Medium	2
2026-10-15 00:28:05	Medium	2
2026-10-14 00:06:47	Medium	2