gephgui-wry-bin

MEDIUM

maintainer icealtria 1 votes scanned 2026-10-29 00:13:55.229276

View on AUR

Why flagged

The package downloads a prebuilt Flatpak binary from a non-standard, untrusted host (Backblaze B2 storage), which is an unverifiable executable and represents a supply-chain risk if the host is compromised.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:21 "gephgui-wry-bin-$pkgver.flatpak::https://f001.backblazeb2.com/file/geph4-dl/geph-releases/linux-stable/$pkgver/Geph-x86_64.flatpak"

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads a prebuilt Flatpak binary from a non-standard, untrusted host (Backblaze B2 storage), which is an unverifiable executable and represents a supply-chain risk if the host is compromised.

PKGBUILD

1 offending line(s) highlighted

      1pkgname=gephgui-wry-bin
    
      2pkgver=5.9.1
    
      3pkgrel=3
    
      4pkgdesc="Geph desktop GUI"
    
      5arch=('x86_64')
    
      6url="https://github.com/geph-official/gephgui-wry"
    
      7license=('MPL-2.0')
    
      8install=gephgui-wry-bin.install
    
      9provides=('gephgui-wry' 'geph5-client' 'geph5')
    
      10conflicts=('gephgui-wry' 'geph5-client' 'geph5-client-git' 'geph5-app-git')
    
      11makedepends=('ostree' 'patchelf')
    
      12depends=(
    
      13  'webkit2gtk-4.1'
    
      14  'polkit'
    
      15  'nftables'
    
      16  'iproute2'
    
      17  'libayatana-appindicator'
    
      18)
    
      19options=('!strip' '!debug')
    
      20source=(
    
      21  "gephgui-wry-bin-$pkgver.flatpak::https://f001.backblazeb2.com/file/geph4-dl/geph-releases/linux-stable/$pkgver/Geph-x86_64.flatpak"
    
      22)
    
      23sha256sums=('26ecb44b550b3344fba528acc8d18fad113722300c8b7c844219293e0eeabb3a')
    
      24
    
      25prepare() {
    
      26  rm -rf geph-repo geph-app
    
      27  mkdir geph-repo
    
      28  ostree init --repo=geph-repo --mode=bare-user
    
      29  ostree static-delta apply-offline --repo=geph-repo gephgui-wry-bin-$pkgver.flatpak
    
      30  local commit
    
      31  commit=$(find geph-repo/objects -name '*.commit' | sed 's|.*/\([0-9a-f]\{2\}\)/\([0-9a-f]*\)\.commit|\1\2|')
    
      32  ostree checkout --repo=geph-repo --user-mode "$commit" geph-app
    
      33}
    
      34
    
      35package() {
    
      36  install -Dm755 "${srcdir}/geph-app/files/bin/geph5" "$pkgdir/usr/bin/geph5"
    
      37  install -Dm755 "${srcdir}/geph-app/files/bin/geph5-client" "$pkgdir/usr/bin/geph5-client"
    
      38  install -Dm755 "${srcdir}/geph-app/files/bin/gephgui-wry" "$pkgdir/usr/bin/gephgui-wry"
    
      39
    
      40  # Private copy of libxdo.so.3 (flatpak bundles xdotool 3.x; extra only ships
    
      41  # libxdo.so.4 via xdotool 4.x). Avoid polluting /usr/lib.
    
      42  install -Dm755 "${srcdir}/geph-app/files/lib/libxdo.so.3" \
    
      43    "$pkgdir/usr/lib/gephgui-wry/libxdo.so.3"
    
      44  patchelf --set-rpath '$ORIGIN/../lib/gephgui-wry' "$pkgdir/usr/bin/gephgui-wry"
    
      45
    
      46  install -Dm644 "${srcdir}/geph-app/export/share/applications/io.geph.GephGui.desktop" \
    
      47    "$pkgdir/usr/share/applications/io.geph.GephGui.desktop"
    
      48
    
      49  for size in 16 32 64 128 256; do
    
      50    install -Dm644 "${srcdir}/geph-app/export/share/icons/hicolor/${size}x${size}/apps/io.geph.GephGui.png" \
    
      51      "$pkgdir/usr/share/icons/hicolor/${size}x${size}/apps/io.geph.GephGui.png"
    
      52  done
    
      53}
    
      54

Changes since previous scan

--- PKGBUILD @ 2026-10-23 00:02
+++ PKGBUILD @ 2026-10-29 00:13
@@ -1,6 +1,6 @@
 pkgname=gephgui-wry-bin
 pkgver=5.9.1
-pkgrel=2
+pkgrel=3
 pkgdesc="Geph desktop GUI"
 arch=('x86_64')
 url="https://github.com/geph-official/gephgui-wry"
@@ -8,13 +8,12 @@
 install=gephgui-wry-bin.install
 provides=('gephgui-wry' 'geph5-client' 'geph5')
 conflicts=('gephgui-wry' 'geph5-client' 'geph5-client-git' 'geph5-app-git')
-makedepends=('ostree')
+makedepends=('ostree' 'patchelf')
 depends=(
   'webkit2gtk-4.1'
   'polkit'
   'nftables'
   'iproute2'
-  'libxdo3'
   'libayatana-appindicator'
 )
 options=('!strip' '!debug')
@@ -38,6 +37,12 @@
   install -Dm755 "${srcdir}/geph-app/files/bin/geph5-client" "$pkgdir/usr/bin/geph5-client"
   install -Dm755 "${srcdir}/geph-app/files/bin/gephgui-wry" "$pkgdir/usr/bin/gephgui-wry"
 
+  # Private copy of libxdo.so.3 (flatpak bundles xdotool 3.x; extra only ships
+  # libxdo.so.4 via xdotool 4.x). Avoid polluting /usr/lib.
+  install -Dm755 "${srcdir}/geph-app/files/lib/libxdo.so.3" \
+    "$pkgdir/usr/lib/gephgui-wry/libxdo.so.3"
+  patchelf --set-rpath '$ORIGIN/../lib/gephgui-wry' "$pkgdir/usr/bin/gephgui-wry"
+
   install -Dm644 "${srcdir}/geph-app/export/share/applications/io.geph.GephGui.desktop" \
     "$pkgdir/usr/share/applications/io.geph.GephGui.desktop"
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-29 00:13:55	Medium	2
2026-10-28 00:06:54	Medium	2
2026-10-27 00:23:28	Medium	2
2026-10-26 00:12:40	Medium	2
2026-10-25 00:20:48	Medium	2
2026-10-24 00:14:55	Medium	2
2026-10-23 13:37:25	Medium	2
2026-10-23 00:02:19	Medium	2
2026-10-22 00:13:10	Medium	2
2026-10-21 00:12:50	Medium	2
2026-10-20 00:10:31	Medium	2
2026-10-19 00:03:55	Medium	2
2026-10-18 00:06:55	Medium	2
2026-10-17 00:21:55	Medium	2
2026-10-16 00:12:47	Medium	2
2026-10-15 00:28:05	Medium	2
2026-10-14 00:06:47	Medium	2
2026-10-13 00:23:45	Medium	2
2026-10-12 00:18:51	Medium	2
2026-10-11 00:26:05	Medium	2