gemini-desktop-bin

MEDIUM

maintainer AsukaMinato 0 votes scanned 2026-10-18 11:22:05.152284

View on AUR

Why flagged

The package downloads a prebuilt Chrome extension (.crx3) from a Google domain, which is then extracted and repackaged; while the source is from an official vendor, the binary nature of the .crx3 and lack of checksum verification on the remote file creates a supply-chain risk if the download URL were silently hijacked or swapped.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 85%): The package downloads a prebuilt Chrome extension (.crx3) from a Google domain, which is then extracted and repackaged; while the source is from an official vendor, the binary nature of the .crx3 and lack of checksum verification on the remote file creates a supply-chain risk if the download URL were silently hijacked or swapped.

PKGBUILD

      1# Maintainer: w
    
      2# Gemini uses the system Electron runtime. The upstream application stays proprietary.
    
      3pkgname=gemini-desktop-bin
    
      4pkgver=1.15.0
    
      5pkgrel=1
    
      6pkgdesc='Google Gemini desktop client with system Electron and Rust Linux integration'
    
      7arch=('x86_64')
    
      8url='https://gemini.google.com/'
    
      9license=('LicenseRef-proprietary' 'MIT')
    
      10depends=('electron44' 'at-spi2-core' 'glib2' 'glibc' 'libgcc' 'bash' 'xdg-utils' 'hicolor-icon-theme')
    
      11makedepends=('7zip' 'asar' 'ast-grep' 'cargo' 'nodejs')
    
      12optdepends=(
    
      13  'xdg-desktop-portal: global shortcuts and screen sharing on Wayland'
    
      14  'pipewire: screen sharing on Wayland'
    
      15  'libappindicator: tray icon support'
    
      16)
    
      17provides=('gemini-desktop')
    
      18conflicts=('gemini-desktop')
    
      19options=('!lto')
    
      20source=(
    
      21  "Gemini-${pkgver}.crx3::https://dl.google.com/release2/Google%20DeepMind/a3szjpb4hbjtiluhshjitvfqki_${pkgver}/-533dd80c-942a-4464-b6a9-2e59428d784e-_${pkgver}_all_hme4czbelpy4muj7tohqfskwym.crx3"
    
      22  'Cargo.toml'
    
      23  'Cargo.lock'
    
      24  'build.rs'
    
      25  'native.rs'
    
      26  'native-a11y.rs'
    
      27  'native-x11.rs'
    
      28  'prepare.cjs'
    
      29  'linux-patches.json'
    
      30  'linux.cjs'
    
      31  'gemini-desktop'
    
      32  'com.google.Gemini.desktop'
    
      33  'README.md'
    
      34  'LICENSE'
    
      35  'UPSTREAM-NOTICE'
    
      36)
    
      37noextract=("Gemini-${pkgver}.crx3")
    
      38sha256sums=('098f21d68d3325eb2c09c15c6285d146caf04f3d7d99b99d8c9a20eb13983abe'
    
      39            'c35a6d50d39ec9a67d72b7c35acca38e833ca7dc519e1fcc105443d049fa65ff'
    
      40            '0523bc49cbe47e0c040c944f90481221c2c8e30692d272f40a17fe36b9d0ca9f'
    
      41            'b5db441f474cee3177158a8a2be239280f6410123111fde94ce2554933506b1c'
    
      42            '921cfadfcbc1d6f642e191ebbb03f0af46f2c7a05e10ef0b80450ff7d5315a02'
    
      43            '3127acea99660fc6b427b2167f03352735a828633b333c9078a9690a4b0a897d'
    
      44            'fcd3b2497016656548768f832d7dd5fcd62e5343eaa00b9a344eb434f8f67877'
    
      45            '5b5dae58234c0cc93c4eddff5d49a3192965507fe1b39455e894738aa53cdcb3'
    
      46            '40f2c9efb3f454873f68eb98cde6353f1da6002ceb20c6fcf1f61d84afcb4add'
    
      47            'e7cc85cce47bd15ca1ba87865521eeaf629165f2a8b4431111d3c25c5a7f12fd'
    
      48            '894d2d741607a2b38fb23cdb82acf8459c078cac92c851d8581de890cf7bccfe'
    
      49            '952f3ae8fb865b676a6dba397446e577ca90a8aedf7613fdbf4ffd314182f7a2'
    
      50            'af7628b60edcfc6b9c7760b2fd2a19f942e6503f73564bfe074aa17d35edb2bd'
    
      51            '2220ca143c96ec35458d49ab3df5a6fc19e97e2f5facfe2337fa3aeb46a32fed'
    
      52            '2a96b0453a6f0d8934d7f2c4a9b52c311e9543b4f387321f6876b0160bb607b6')
    
      53
    
      54prepare() {
    
      55  7z x -y "Gemini-${pkgver}.crx3" "-o${srcdir}/installer" \
    
      56    "GeminiSetup-${pkgver}_uncompressed.exe" >/dev/null
    
      57  7z x -y "installer/GeminiSetup-${pkgver}_uncompressed.exe" "-o${srcdir}/payload" \
    
      58    "app-${pkgver}/resources/*" >/dev/null
    
      59  asar extract "payload/app-${pkgver}/resources/app.asar" app
    
      60  rm -f app/src/gemini_native.node app/assets/icon.ico
    
      61  node prepare.cjs app linux-patches.json
    
      62  install -Dm644 linux.cjs app/src/linux.cjs
    
      63  cargo fetch --locked --target "${CARCH}-unknown-linux-gnu"
    
      64}
    
      65
    
      66build() {
    
      67  cargo build --release --locked --offline --target "${CARCH}-unknown-linux-gnu" --target-dir target
    
      68  install -Dm755 "target/${CARCH}-unknown-linux-gnu/release/libgemini_native.so" app/src/gemini_native.node
    
      69}
    
      70
    
      71check() {
    
      72  node --check app/src/main.js
    
      73  node --check app/src/linux.cjs
    
      74}
    
      75
    
      76package() {
    
      77  install -d "${pkgdir}/usr/lib/gemini-desktop"
    
      78  cp -a app/. "${pkgdir}/usr/lib/gemini-desktop/"
    
      79  install -Dm755 gemini-desktop "${pkgdir}/usr/bin/gemini-desktop"
    
      80  install -Dm644 com.google.Gemini.desktop "${pkgdir}/usr/share/applications/com.google.Gemini.desktop"
    
      81  install -Dm644 app/assets/icon.png "${pkgdir}/usr/share/icons/hicolor/256x256/apps/gemini-desktop.png"
    
      82  install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      83  install -Dm644 UPSTREAM-NOTICE "${pkgdir}/usr/share/licenses/${pkgname}/UPSTREAM-NOTICE"
    
      84  install -Dm644 README.md "${pkgdir}/usr/share/doc/${pkgname}/README.md"
    
      85}
    
      86

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-18 11:22:05	Medium	2