frenfoil-bin

maintainer josefandersson · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package installs a prebuilt Electron binary from the project's own release infrastructure, which is a normal practice for AUR binary packages; the source host is not whitelisted but is the official project repository, and there is no evidence of malicious behavior or unverifiable remote code execution.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package installs a prebuilt Electron binary from the project's own release infrastructure, which is a normal practice for AUR binary packages; the source host is not whitelisted but is the official project repository, and there is no evidence of malicious behavior or unverifiable remote code execution.

PKGBUILD

      1# Maintainer: Josef Andersson <josefandersson@tuta.io>
    
      2#
    
      3# Installs the prebuilt bundle from a published release, with no build step. The from-source
    
      4# package is the PKGBUILD at the repo root; this one exists so Arch users get updates
    
      5# through pacman without rebuilding electron.
    
      6#
    
      7# pkgver and both hashes are rewritten from the published assets by
    
      8# packaging/ci-aur-publish.sh, so all three stay placeholders here. This file is never built
    
      9# as committed, only after CI has filled it in. To build it by hand: set pkgver, run `updpkgsums`.
    
      10
    
      11pkgname=frenfoil-bin
    
      12_pkgname=frenfoil
    
      13pkgver=0.13.0
    
      14pkgrel=1
    
      15pkgdesc='Opinionated, e2e-only XMPP client, post-quantum by default'
    
      16arch=('x86_64')
    
      17url='https://git.josf.dev/josefandersson/frenfoil'
    
      18license=('AGPL-3.0-only')
    
      19depends=('gtk3' 'nss' 'alsa-lib' 'libxss')
    
      20provides=("$_pkgname")
    
      21conflicts=("$_pkgname")
    
      22# Prebuilt electron and prebuilt native modules, so there is nothing to strip or split out.
    
      23options=('!strip' '!debug')
    
      24
    
      25_relbase="${url}/releases/download/v${pkgver}"
    
      26_rawbase="${url}/raw/tag/v${pkgver}"
    
      27
    
      28# The .desktop file is fetched from the tag rather than embedded here so it stays a single
    
      29# source of truth with the root PKGBUILD's copy.
    
      30source=("${_pkgname}-${pkgver}-linux-x64.zip::${_relbase}/${_pkgname}-${pkgver}-linux-x64.zip"
    
      31        "${_pkgname}-${pkgver}.desktop::${_rawbase}/${_pkgname}.desktop")
    
      32# Placeholders, not SKIP: an unverified download is worse than a build that refuses to start.
    
      33# CI substitutes the real hashes; building this dir by hand fails until `updpkgsums` is run.
    
      34sha256sums=('9e860d5c8606724a4a066ab760e0979db7c65a318aec217b7d8e068813f8fe1b' 'd6d95f8388758754049ab11eb9d645969f8dd42476b1aa57a5488e1d6039b6f6')
    
      35
    
      36package() {
    
      37	install -dm755 "$pkgdir/opt/$_pkgname"
    
      38	cp -a "$srcdir/${_pkgname}-linux-x64/." "$pkgdir/opt/$_pkgname/"
    
      39	# cp -a applies the source directory's own mode to the destination, undoing the install
    
      40	# above. Releases up to 0.3.7 shipped that as 0700, which denied every non-root user.
    
      41	chmod 755 "$pkgdir/opt/$_pkgname"
    
      42
    
      43	install -dm755 "$pkgdir/usr/bin"
    
      44	ln -s "/opt/$_pkgname/$_pkgname" "$pkgdir/usr/bin/$_pkgname"
    
      45
    
      46	install -Dm644 "${_pkgname}-${pkgver}.desktop" \
    
      47		"$pkgdir/usr/share/applications/$_pkgname.desktop"
    
      48	install -Dm644 "$pkgdir/opt/$_pkgname/resources/app/LICENSE" \
    
      49		"$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      50
    
      51	# The bundle carries its own hicolor set, so the icons need no extra source.
    
      52	for icon in "$pkgdir/opt/$_pkgname/resources/icons/$_pkgname-"*.png; do
    
      53		size="${icon##*-}"
    
      54		install -Dm644 "$icon" \
    
      55			"$pkgdir/usr/share/icons/hicolor/${size%.png}x${size%.png}/apps/$_pkgname.png"
    
      56	done
    
      57}
    
      58

Changes since previous scan

--- PKGBUILD @ 2026-07-28 09:37
+++ PKGBUILD @ 2026-08-03 00:08
@@ -10,7 +10,7 @@
 
 pkgname=frenfoil-bin
 _pkgname=frenfoil
-pkgver=0.11.3
+pkgver=0.13.0
 pkgrel=1
 pkgdesc='Opinionated, e2e-only XMPP client, post-quantum by default'
 arch=('x86_64')
@@ -31,7 +31,7 @@
         "${_pkgname}-${pkgver}.desktop::${_rawbase}/${_pkgname}.desktop")
 # Placeholders, not SKIP: an unverified download is worse than a build that refuses to start.
 # CI substitutes the real hashes; building this dir by hand fails until `updpkgsums` is run.
-sha256sums=('ed3c2d0005fbbcc28bdf99f09c7e458bbec33d610584818bfdd13be87a001b87' 'd6d95f8388758754049ab11eb9d645969f8dd42476b1aa57a5488e1d6039b6f6')
+sha256sums=('9e860d5c8606724a4a066ab760e0979db7c65a318aec217b7d8e068813f8fe1b' 'd6d95f8388758754049ab11eb9d645969f8dd42476b1aa57a5488e1d6039b6f6')
 
 package() {
 	install -dm755 "$pkgdir/opt/$_pkgname"

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 23:39:52	LOW	2
2026-07-28 13:38:59	LOW	2
2026-07-28 09:37:42	LOW	2
2026-07-28 01:36:52	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 23:36:42	LOW	2
2026-07-27 21:35:42	LOW	2
2026-07-27 19:35:21	LOW	2
2026-07-27 13:35:00	LOW	2
2026-07-27 11:35:00	LOW	2
2026-07-27 03:34:02	LOW	2
2026-07-27 01:34:00	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 23:33:54	LOW	2