gitkraken

LOW

maintainer Azd325 311 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads prebuilt binaries from the official GitKraken API domain, which is plausibly the project's own release infrastructure; despite the static analyzer flag for a non-standard host, the source is verifiable and expected for this application, and no malicious behavior is present.

Triggered rules

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package downloads prebuilt binaries from the official GitKraken API domain, which is plausibly the project's own release infrastructure; despite the static analyzer flag for a non-standard host, the source is verifiable and expected for this application, and no malicious behavior is present.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:30 source_x86_64=("${pkgname}-${pkgver}-x86_64.tar.gz::https://api.gitkraken.dev/releases/production/linux/x64/${pkgver}/gitkraken-amd64.tar.gz")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Tim Kleinschmidt <tim.kleinschmidt@gmail.com>
    
      2# Contributor: Marcin Wieczorek <marcin@marcin.co>
    
      3# Contributor: Jean-Pier Brochu <jeanpier.brochu@gmail.com>
    
      4# Contributor: Samuel Littley <samuel@samuellittley.me>
    
      5# Contributor: KillWolfVlad <github.com/KillWolfVlad>
    
      6# Contributor: Victor Hugo Souza <vhbsouza@gmail.com>
    
      7# Contributor: William Penton <william@nexxuz.co>
    
      8# Contributor: Jeff Moody <jeff@fifthecho.com>
    
      9# Contributor: KokaKiwi <kokakiwi+aur@kokakiwi.net>
    
      10# Contributor: iBernd81 <aur at gempel dot bayern>
    
      11# Contributor: mosi0815 <ralph.twentyone@gmail.com>
    
      12
    
      13pkgname=gitkraken
    
      14pkgrel=1
    
      15pkgver=12.6.1
    
      16pkgdesc="The intuitive, fast, and beautiful cross-platform Git client."
    
      17url="https://www.gitkraken.com/"
    
      18arch=('x86_64' 'aarch64')
    
      19license=('LicenseRef-GitKraken-EULA')
    
      20depends=('alsa-lib' 'nss' 'gtk3' 'libsecret' 'libxkbfile')
    
      21optdepends=('git-lfs: git-lfs support'
    
      22            'xdg-utils: open links and files in the default application'
    
      23            'org.freedesktop.secrets: Provides ways to store passwords and encryption keys')
    
      24source=(
    
      25    "GitKraken.desktop"
    
      26    "gitkraken-url-handler.desktop"
    
      27    "gk-cli-url-handler.desktop"
    
      28    "eula.html"
    
      29)
    
      30source_x86_64=("${pkgname}-${pkgver}-x86_64.tar.gz::https://api.gitkraken.dev/releases/production/linux/x64/${pkgver}/gitkraken-amd64.tar.gz")
    
      31source_aarch64=("${pkgname}-${pkgver}-aarch64.tar.gz::https://api.gitkraken.dev/releases/production/linux/arm64/${pkgver}/gitkraken-aarch64.tar.gz")
    
      32sha256sums=('af2d2e5a44ec6e543c34f94cfb89fe34b6c05d2baf6ca9db5b6d332e4a5686e5'
    
      33            '4342596839114228740e5d61cdc49fbe9e98d05d1aabe2694ffe9d48ffd4082e'
    
      34            '4b3eaf932b79e8f1d6a6a6efd030e73cb544d3d0fbe6bf7b61b884f4c6042b0a'
    
      35            '22d30f568c6410f76f80412cd9665fbeb44a267828444df3203c37baabdf3335')
    
      36sha256sums_x86_64=('ee3190166d7277f17b4acce5906941beb90fcd5fc00635e36b6728ae10b4afb3')
    
      37sha256sums_aarch64=('8f1f53112409474de29fd0a414026712884824e5081dd6a7e008c83bfb0c184b')
    
      38options=('!strip' '!debug')
    
      39
    
      40package() {
    
      41    install -d "$pkgdir"/opt
    
      42    cp -R "$srcdir"/gitkraken "$pkgdir"/opt/gitkraken
    
      43
    
      44    # chrome-sandbox must be setuid root for Electron's SUID sandbox; cp drops the
    
      45    # bit. Restore it to match upstream's deb. namcap will flag this as a setuid
    
      46    # binary -- that warning is expected and intentional, not a packaging mistake.
    
      47    chmod 4755 "$pkgdir"/opt/gitkraken/chrome-sandbox
    
      48
    
      49    install -d "$pkgdir"/usr/bin
    
      50    # CLI and URL entrypoint. Symlink to the launcher bundled in the tarball (as
    
      51    # the upstream deb does) instead of carrying our own wrapper; it resolves its
    
      52    # own real path, so it works unchanged from /opt. The URL-handler entries
    
      53    # invoke this via `--uri=`.
    
      54    ln -s /opt/gitkraken/resources/bin/gitkraken.sh "$pkgdir"/usr/bin/gitkraken
    
      55
    
      56    install -D -m644 "./eula.html" "${pkgdir}/usr/share/licenses/${pkgname}/eula.html"
    
      57
    
      58    # Desktop entries taken from upstream's deb: the visible launcher plus the two
    
      59    # scheme handlers that make gitkraken:// and gk:// links (e.g. OAuth callbacks)
    
      60    # register and open via `/usr/bin/gitkraken --uri=`. The launcher drops the
    
      61    # deb's MimeType=text/plain, which wrongly associated GitKraken with every
    
      62    # plaintext file (issue #260).
    
      63    install -D -m644 "./GitKraken.desktop" "${pkgdir}/usr/share/applications/GitKraken.desktop"
    
      64    install -D -m644 "./gitkraken-url-handler.desktop" "${pkgdir}/usr/share/applications/gitkraken-url-handler.desktop"
    
      65    install -D -m644 "./gk-cli-url-handler.desktop" "${pkgdir}/usr/share/applications/gk-cli-url-handler.desktop"
    
      66
    
      67    install -D -m644 "$pkgdir/opt/gitkraken/gitkraken.png" "$pkgdir/usr/share/pixmaps/gitkraken.png"
    
      68}
    
      69

Changes since previous scan

--- PKGBUILD @ 2026-10-26 00:12
+++ PKGBUILD @ 2026-11-01 00:21
@@ -12,18 +12,15 @@
 
 pkgname=gitkraken
 pkgrel=1
-pkgver=12.6.0
+pkgver=12.6.1
 pkgdesc="The intuitive, fast, and beautiful cross-platform Git client."
 url="https://www.gitkraken.com/"
-provides=('gitkraken')
 arch=('x86_64' 'aarch64')
-license=('custom')
-depends=('nss' 'gtk3' 'libsecret' 'libxkbfile')
+license=('LicenseRef-GitKraken-EULA')
+depends=('alsa-lib' 'nss' 'gtk3' 'libsecret' 'libxkbfile')
 optdepends=('git-lfs: git-lfs support'
+            'xdg-utils: open links and files in the default application'
             'org.freedesktop.secrets: Provides ways to store passwords and encryption keys')
-makedepends=()
-backup=()
-install=''
 source=(
     "GitKraken.desktop"
     "gitkraken-url-handler.desktop"
@@ -35,9 +32,9 @@
 sha256sums=('af2d2e5a44ec6e543c34f94cfb89fe34b6c05d2baf6ca9db5b6d332e4a5686e5'
             '4342596839114228740e5d61cdc49fbe9e98d05d1aabe2694ffe9d48ffd4082e'
             '4b3eaf932b79e8f1d6a6a6efd030e73cb544d3d0fbe6bf7b61b884f4c6042b0a'
-            '5b7b39b331bc32a606e1e79c695df4519c9b220225be00fb34ef368c3af319a6')
-sha256sums_x86_64=('68c9a9fcf15e8406832ac4cd2ea115454923893b2af88c69beaa9d8cfef84d39')
-sha256sums_aarch64=('9963a90e1de8eb986707b666da9d9d1d9e7b04fe69ac1416fc425f504a4f6a7c')
+            '22d30f568c6410f76f80412cd9665fbeb44a267828444df3203c37baabdf3335')
+sha256sums_x86_64=('ee3190166d7277f17b4acce5906941beb90fcd5fc00635e36b6728ae10b4afb3')
+sha256sums_aarch64=('8f1f53112409474de29fd0a414026712884824e5081dd6a7e008c83bfb0c184b')
 options=('!strip' '!debug')
 
 package() {

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 00:13:55	Low	2
2026-10-28 00:06:54	Low	2
2026-10-27 00:23:28	Low	2
2026-10-26 19:45:59	Low	2
2026-10-26 00:12:40	Low	2
2026-10-25 00:20:48	Low	2
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 00:13:10	Low	2
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 21:19:24	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2