gitkraken

maintainer Azd325 · 312 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads prebuilt binaries from the official GitKraken API domain, which is plausibly the project's own release infrastructure; despite the non-whitelisted host, the source is verifiable via checksums and the binaries are from an official vendor, reducing supply-chain risk.

Triggered rules

LOW AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package downloads prebuilt binaries from the official GitKraken API domain, which is plausibly the project's own release infrastructure; despite the non-whitelisted host, the source is verifiable via checksums and the binaries are from an official vendor, reducing supply-chain risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:33 source_x86_64=("${pkgname}-${pkgver}-x86_64.tar.gz::https://api.gitkraken.dev/releases/production/linux/x64/${pkgver}/gitkraken-amd64.tar.gz")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Tim Kleinschmidt <tim.kleinschmidt@gmail.com>
    
      2# Contributor: Marcin Wieczorek <marcin@marcin.co>
    
      3# Contributor: Jean-Pier Brochu <jeanpier.brochu@gmail.com>
    
      4# Contributor: Samuel Littley <samuel@samuellittley.me>
    
      5# Contributor: KillWolfVlad <github.com/KillWolfVlad>
    
      6# Contributor: Victor Hugo Souza <vhbsouza@gmail.com>
    
      7# Contributor: William Penton <william@nexxuz.co>
    
      8# Contributor: Jeff Moody <jeff@fifthecho.com>
    
      9# Contributor: KokaKiwi <kokakiwi+aur@kokakiwi.net>
    
      10# Contributor: iBernd81 <aur at gempel dot bayern>
    
      11# Contributor: mosi0815 <ralph.twentyone@gmail.com>
    
      12
    
      13pkgname=gitkraken
    
      14pkgrel=1
    
      15pkgver=12.3.1
    
      16pkgdesc="The intuitive, fast, and beautiful cross-platform Git client."
    
      17url="https://www.gitkraken.com/"
    
      18provides=('gitkraken')
    
      19arch=('x86_64' 'aarch64')
    
      20license=('custom')
    
      21depends=('nss' 'gtk3' 'libsecret' 'libxkbfile')
    
      22optdepends=('git-lfs: git-lfs support'
    
      23            'org.freedesktop.secrets: Provides ways to store passwords and encryption keys')
    
      24makedepends=()
    
      25backup=()
    
      26install=''
    
      27source=(
    
      28    "GitKraken.desktop"
    
      29    "gitkraken-url-handler.desktop"
    
      30    "gk-cli-url-handler.desktop"
    
      31    "eula.html"
    
      32)
    
      33source_x86_64=("${pkgname}-${pkgver}-x86_64.tar.gz::https://api.gitkraken.dev/releases/production/linux/x64/${pkgver}/gitkraken-amd64.tar.gz")
    
      34source_aarch64=("${pkgname}-${pkgver}-aarch64.tar.gz::https://api.gitkraken.dev/releases/production/linux/arm64/${pkgver}/gitkraken-aarch64.tar.gz")
    
      35sha256sums=('af2d2e5a44ec6e543c34f94cfb89fe34b6c05d2baf6ca9db5b6d332e4a5686e5'
    
      36            '4342596839114228740e5d61cdc49fbe9e98d05d1aabe2694ffe9d48ffd4082e'
    
      37            '4b3eaf932b79e8f1d6a6a6efd030e73cb544d3d0fbe6bf7b61b884f4c6042b0a'
    
      38            '5b7b39b331bc32a606e1e79c695df4519c9b220225be00fb34ef368c3af319a6')
    
      39sha256sums_x86_64=('377f3b94ff1df9225906bc8134d505b14c1e6be82dea07463e14a62439b3319d')
    
      40sha256sums_aarch64=('604cde7640a2375f47ad805d82e16ddbc67902517148bdd27892de09ffa78c05')
    
      41options=('!strip' '!debug')
    
      42
    
      43package() {
    
      44    install -d "$pkgdir"/opt
    
      45    cp -R "$srcdir"/gitkraken "$pkgdir"/opt/gitkraken
    
      46
    
      47    # chrome-sandbox must be setuid root for Electron's SUID sandbox; cp drops the
    
      48    # bit. Restore it to match upstream's deb. namcap will flag this as a setuid
    
      49    # binary -- that warning is expected and intentional, not a packaging mistake.
    
      50    chmod 4755 "$pkgdir"/opt/gitkraken/chrome-sandbox
    
      51
    
      52    install -d "$pkgdir"/usr/bin
    
      53    # CLI and URL entrypoint. Symlink to the launcher bundled in the tarball (as
    
      54    # the upstream deb does) instead of carrying our own wrapper; it resolves its
    
      55    # own real path, so it works unchanged from /opt. The URL-handler entries
    
      56    # invoke this via `--uri=`.
    
      57    ln -s /opt/gitkraken/resources/bin/gitkraken.sh "$pkgdir"/usr/bin/gitkraken
    
      58
    
      59    install -D -m644 "./eula.html" "${pkgdir}/usr/share/licenses/${pkgname}/eula.html"
    
      60
    
      61    # Desktop entries taken from upstream's deb: the visible launcher plus the two
    
      62    # scheme handlers that make gitkraken:// and gk:// links (e.g. OAuth callbacks)
    
      63    # register and open via `/usr/bin/gitkraken --uri=`. The launcher drops the
    
      64    # deb's MimeType=text/plain, which wrongly associated GitKraken with every
    
      65    # plaintext file (issue #260).
    
      66    install -D -m644 "./GitKraken.desktop" "${pkgdir}/usr/share/applications/GitKraken.desktop"
    
      67    install -D -m644 "./gitkraken-url-handler.desktop" "${pkgdir}/usr/share/applications/gitkraken-url-handler.desktop"
    
      68    install -D -m644 "./gk-cli-url-handler.desktop" "${pkgdir}/usr/share/applications/gk-cli-url-handler.desktop"
    
      69
    
      70    install -D -m644 "$pkgdir/opt/gitkraken/gitkraken.png" "$pkgdir/usr/share/pixmaps/gitkraken.png"
    
      71}
    
      72

Changes since previous scan

--- PKGBUILD @ 2026-07-22 00:29
+++ PKGBUILD @ 2026-08-03 00:08
@@ -12,7 +12,7 @@
 
 pkgname=gitkraken
 pkgrel=1
-pkgver=12.3.0
+pkgver=12.3.1
 pkgdesc="The intuitive, fast, and beautiful cross-platform Git client."
 url="https://www.gitkraken.com/"
 provides=('gitkraken')
@@ -36,8 +36,8 @@
             '4342596839114228740e5d61cdc49fbe9e98d05d1aabe2694ffe9d48ffd4082e'
             '4b3eaf932b79e8f1d6a6a6efd030e73cb544d3d0fbe6bf7b61b884f4c6042b0a'
             '5b7b39b331bc32a606e1e79c695df4519c9b220225be00fb34ef368c3af319a6')
-sha256sums_x86_64=('a0609c00fe7c7f25dba3574f6abc88bf41c14450f70d157be2bb645650af187d')
-sha256sums_aarch64=('9bf90aabf89982ebd3b782d8cee60cb8fecc7e95d89c266ed8dbf914ad2b9029')
+sha256sums_x86_64=('377f3b94ff1df9225906bc8134d505b14c1e6be82dea07463e14a62439b3319d')
+sha256sums_aarch64=('604cde7640a2375f47ad805d82e16ddbc67902517148bdd27892de09ffa78c05')
 options=('!strip' '!debug')
 
 package() {

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 09:20:02	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2