gitkraken

LOW

maintainer Azd325 312 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads prebuilt binaries from the official GitKraken API domain, which is plausibly the project's own release infrastructure; despite the non-whitelisted host, the source is verifiable via signed checksums and the binaries are from the official vendor.

Triggered rules

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package downloads prebuilt binaries from the official GitKraken API domain, which is plausibly the project's own release infrastructure; despite the non-whitelisted host, the source is verifiable via signed checksums and the binaries are from the official vendor.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:33 source_x86_64=("${pkgname}-${pkgver}-x86_64.tar.gz::https://api.gitkraken.dev/releases/production/linux/x64/${pkgver}/gitkraken-amd64.tar.gz")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Tim Kleinschmidt <tim.kleinschmidt@gmail.com>
    
      2# Contributor: Marcin Wieczorek <marcin@marcin.co>
    
      3# Contributor: Jean-Pier Brochu <jeanpier.brochu@gmail.com>
    
      4# Contributor: Samuel Littley <samuel@samuellittley.me>
    
      5# Contributor: KillWolfVlad <github.com/KillWolfVlad>
    
      6# Contributor: Victor Hugo Souza <vhbsouza@gmail.com>
    
      7# Contributor: William Penton <william@nexxuz.co>
    
      8# Contributor: Jeff Moody <jeff@fifthecho.com>
    
      9# Contributor: KokaKiwi <kokakiwi+aur@kokakiwi.net>
    
      10# Contributor: iBernd81 <aur at gempel dot bayern>
    
      11# Contributor: mosi0815 <ralph.twentyone@gmail.com>
    
      12
    
      13pkgname=gitkraken
    
      14pkgrel=1
    
      15pkgver=12.4.1
    
      16pkgdesc="The intuitive, fast, and beautiful cross-platform Git client."
    
      17url="https://www.gitkraken.com/"
    
      18provides=('gitkraken')
    
      19arch=('x86_64' 'aarch64')
    
      20license=('custom')
    
      21depends=('nss' 'gtk3' 'libsecret' 'libxkbfile')
    
      22optdepends=('git-lfs: git-lfs support'
    
      23            'org.freedesktop.secrets: Provides ways to store passwords and encryption keys')
    
      24makedepends=()
    
      25backup=()
    
      26install=''
    
      27source=(
    
      28    "GitKraken.desktop"
    
      29    "gitkraken-url-handler.desktop"
    
      30    "gk-cli-url-handler.desktop"
    
      31    "eula.html"
    
      32)
    
      33source_x86_64=("${pkgname}-${pkgver}-x86_64.tar.gz::https://api.gitkraken.dev/releases/production/linux/x64/${pkgver}/gitkraken-amd64.tar.gz")
    
      34source_aarch64=("${pkgname}-${pkgver}-aarch64.tar.gz::https://api.gitkraken.dev/releases/production/linux/arm64/${pkgver}/gitkraken-aarch64.tar.gz")
    
      35sha256sums=('af2d2e5a44ec6e543c34f94cfb89fe34b6c05d2baf6ca9db5b6d332e4a5686e5'
    
      36            '4342596839114228740e5d61cdc49fbe9e98d05d1aabe2694ffe9d48ffd4082e'
    
      37            '4b3eaf932b79e8f1d6a6a6efd030e73cb544d3d0fbe6bf7b61b884f4c6042b0a'
    
      38            '5b7b39b331bc32a606e1e79c695df4519c9b220225be00fb34ef368c3af319a6')
    
      39sha256sums_x86_64=('344276052482d68d334fc9535fb681a5600e5658f1a962f04ea09a200fd42ea4')
    
      40sha256sums_aarch64=('7b94b6681ace919d494848eab45b1177cc432ecdf57c6713d4ab22bc0b9d9bce')
    
      41options=('!strip' '!debug')
    
      42
    
      43package() {
    
      44    install -d "$pkgdir"/opt
    
      45    cp -R "$srcdir"/gitkraken "$pkgdir"/opt/gitkraken
    
      46
    
      47    # chrome-sandbox must be setuid root for Electron's SUID sandbox; cp drops the
    
      48    # bit. Restore it to match upstream's deb. namcap will flag this as a setuid
    
      49    # binary -- that warning is expected and intentional, not a packaging mistake.
    
      50    chmod 4755 "$pkgdir"/opt/gitkraken/chrome-sandbox
    
      51
    
      52    install -d "$pkgdir"/usr/bin
    
      53    # CLI and URL entrypoint. Symlink to the launcher bundled in the tarball (as
    
      54    # the upstream deb does) instead of carrying our own wrapper; it resolves its
    
      55    # own real path, so it works unchanged from /opt. The URL-handler entries
    
      56    # invoke this via `--uri=`.
    
      57    ln -s /opt/gitkraken/resources/bin/gitkraken.sh "$pkgdir"/usr/bin/gitkraken
    
      58
    
      59    install -D -m644 "./eula.html" "${pkgdir}/usr/share/licenses/${pkgname}/eula.html"
    
      60
    
      61    # Desktop entries taken from upstream's deb: the visible launcher plus the two
    
      62    # scheme handlers that make gitkraken:// and gk:// links (e.g. OAuth callbacks)
    
      63    # register and open via `/usr/bin/gitkraken --uri=`. The launcher drops the
    
      64    # deb's MimeType=text/plain, which wrongly associated GitKraken with every
    
      65    # plaintext file (issue #260).
    
      66    install -D -m644 "./GitKraken.desktop" "${pkgdir}/usr/share/applications/GitKraken.desktop"
    
      67    install -D -m644 "./gitkraken-url-handler.desktop" "${pkgdir}/usr/share/applications/gitkraken-url-handler.desktop"
    
      68    install -D -m644 "./gk-cli-url-handler.desktop" "${pkgdir}/usr/share/applications/gk-cli-url-handler.desktop"
    
      69
    
      70    install -D -m644 "$pkgdir/opt/gitkraken/gitkraken.png" "$pkgdir/usr/share/pixmaps/gitkraken.png"
    
      71}
    
      72

Changes since previous scan

--- PKGBUILD @ 2026-09-16 00:03
+++ PKGBUILD @ 2026-09-17 00:27
@@ -12,7 +12,7 @@
 
 pkgname=gitkraken
 pkgrel=1
-pkgver=12.4.0
+pkgver=12.4.1
 pkgdesc="The intuitive, fast, and beautiful cross-platform Git client."
 url="https://www.gitkraken.com/"
 provides=('gitkraken')
@@ -36,8 +36,8 @@
             '4342596839114228740e5d61cdc49fbe9e98d05d1aabe2694ffe9d48ffd4082e'
             '4b3eaf932b79e8f1d6a6a6efd030e73cb544d3d0fbe6bf7b61b884f4c6042b0a'
             '5b7b39b331bc32a606e1e79c695df4519c9b220225be00fb34ef368c3af319a6')
-sha256sums_x86_64=('7f7e56b5bf345c1da3bcc3ff4f50bf51bf8292399f471e5c5bc2213bfafefb4d')
-sha256sums_aarch64=('66d6d7cc158187074afd0d6933a1636a7c15c14f9c0404e7c45599f3c9cad3e9')
+sha256sums_x86_64=('344276052482d68d334fc9535fb681a5600e5658f1a962f04ea09a200fd42ea4')
+sha256sums_aarch64=('7b94b6681ace919d494848eab45b1177cc432ecdf57c6713d4ab22bc0b9d9bce')
 options=('!strip' '!debug')
 
 package() {

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 07:21:35	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 05:52:26	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2