giganotes-bin

maintainer orphaned · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads a prebuilt binary .deb from the project's own official domain (giganotes.com/dist/linux/), which is the canonical upstream distribution channel for this application. The sha256sum is pinned, providing integrity verification. The pattern of repackaging upstream .deb binaries is common in AUR -bin packages. However, it is still a prebuilt binary blob (an Electron app based on the depends) from a third-party host rather than compiled from source, which constitutes a genuine supply-chain risk: if giganotes.com were compromised or the binary swapped, users would execute malicious code. The package() function is also slightly broken — it calls 'tar xvf data.tar.xz' without first extracting the .deb to obtain data.tar.xz, so the build would fail unless data.tar.xz happens to exist in the build directory already. Despite the official host and checksum, the executed-binary-from-non-distro-host pattern warrants medium severity, consistent with standard AUR -bin package risk classification.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source=("${pkgname}-${pkgver}.deb::https://giganotes.com/dist/linux/giganotes_${pkgver}_amd64.deb")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads a prebuilt binary .deb from the project's own official domain (giganotes.com/dist/linux/), which is the canonical upstream distribution channel for this application. The sha256sum is pinned, providing integrity verification. The pattern of repackaging upstream .deb binaries is common in AUR -bin packages. However, it is still a prebuilt binary blob (an Electron app based on the depends) from a third-party host rather than compiled from source, which constitutes a genuine supply-chain risk: if giganotes.com were compromised or the binary swapped, users would execute malicious code. The package() function is also slightly broken — it calls 'tar xvf data.tar.xz' without first extracting the .deb to obtain data.tar.xz, so the build would fail unless data.tar.xz happens to exist in the build directory already. Despite the official host and checksum, the executed-binary-from-non-distro-host pattern warrants medium severity, consistent with standard AUR -bin package risk classification.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Dimitris Kiziridis <ragouel at outlook dot com>
    
      2
    
      3pkgname=giganotes-bin
    
      4pkgver=2.0.2
    
      5pkgrel=1
    
      6pkgdesc="An open source data management and note taking app"
    
      7arch=('x86_64')
    
      8url='https://giganotes.com'
    
      9license=('Apache')
    
      10provides=('giganotes')
    
      11depends=('nss'
    
      12         'libxss'
    
      13         'gtk3')
    
      14source=("${pkgname}-${pkgver}.deb::https://giganotes.com/dist/linux/giganotes_${pkgver}_amd64.deb")
    
      15sha256sums=('6a3ac202a20e4807c02af70eec5ec31d762f3480b4c39653bb398d94a41c6094')
    
      16
    
      17package() {
    
      18  tar xvf data.tar.xz -C "${pkgdir}"
    
      19}
    
      20

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2