gitkraken-standalone

LOW

maintainer 0cool_f 2 votes scanned 2026-11-02 00:26:00.633185

View on AUR

Why flagged

The source downloads a tarball from the official GitKraken API domain, which is plausibly the project's own release infrastructure; the package builds from official project sources and installs only the application files and metadata, with no evidence of malicious or remote code execution behavior.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The source downloads a tarball from the official GitKraken API domain, which is plausibly the project's own release infrastructure; the package builds from official project sources and installs only the application files and metadata, with no evidence of malicious or remote code execution behavior.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:29 "${pkgname}-${pkgver}.tar.gz::https://api.gitkraken.dev/releases/standalone/production/linux/x64/${pkgver}/gitkraken-amd64.tar.gz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Fabio Di Giorgio <ravnos at duck dot com>
    
      2# Contributor: Jay Ta'ala <jay@jaytaala.com>
    
      3# Contributor: Tim Kleinschmidt <tim.kleinschmidt@gmail.com>
    
      4# Contributor: Marcin Wieczorek <marcin@marcin.co>
    
      5# Contributor: Jean-Pier Brochu <jeanpier.brochu@gmail.com>
    
      6# Contributor: Samuel Littley <samuel@samuellittley.me>
    
      7# Contributor: KillWolfVlad <github.com/KillWolfVlad>
    
      8# Contributor: Victor Hugo Souza <vhbsouza@gmail.com>
    
      9# Contributor: William Penton <william@penton.us>
    
      10# Contributor: Jeff Moody <jeff@fifthecho.com>
    
      11# Contributor: KokaKiwi <kokakiwi+aur@kokakiwi.net>
    
      12
    
      13pkgname=gitkraken-standalone
    
      14pkgrel=1
    
      15pkgver=12.6.1
    
      16pkgdesc="The intuitive, fast, and beautiful cross-platform Git client. Serverless version (requires license file)."
    
      17url="https://help.gitkraken.com/gitkraken-desktop/serverless/"
    
      18provides=('gitkraken')
    
      19conflicts=('gitkraken')
    
      20arch=('x86_64')
    
      21license=('custom')
    
      22depends=('nss' 'gtk3' 'libsecret' 'libxkbfile')
    
      23optdepends=('git-lfs: git-lfs support'
    
      24            'org.freedesktop.secrets: Provides ways to store passwords and encryption keys')
    
      25makedepends=()
    
      26backup=()
    
      27install=''
    
      28source=(
    
      29    "${pkgname}-${pkgver}.tar.gz::https://api.gitkraken.dev/releases/standalone/production/linux/x64/${pkgver}/gitkraken-amd64.tar.gz"
    
      30    "GitKraken.desktop"
    
      31    "eula.html"
    
      32    "gitkraken.sh"
    
      33)
    
      34sha256sums=('eb5e100a00752540805bcb97871c91ecef03e313cdd2cc8358119607ea1974ed'
    
      35            '078fa2cdf6826d956bf73387fb2ef147b1aca5f4a7a3cb4be8c71e6105fc9c6c'
    
      36            '5b7b39b331bc32a606e1e79c695df4519c9b220225be00fb34ef368c3af319a6'
    
      37            '6e6c6ac37287e1ec5d5266689a49d18899488be901b21f5cb9749f545453626f')
    
      38
    
      39package() {
    
      40    install -d "$pkgdir"/opt
    
      41    cp -R "$srcdir"/gitkraken "$pkgdir"/opt/gitkraken
    
      42
    
      43    install -d "$pkgdir"/usr/bin
    
      44
    
      45    install -D -m755 "./gitkraken.sh" "${pkgdir}/usr/bin/gitkraken"
    
      46    install -D -m644 "./eula.html" "${pkgdir}/usr/share/licenses/${pkgname}/eula.html"
    
      47    install -D -m644 "./GitKraken.desktop" "${pkgdir}/usr/share/applications/GitKraken.desktop"
    
      48    install -D -m644 "$pkgdir/opt/gitkraken/gitkraken.png" "$pkgdir/usr/share/pixmaps/gitkraken.png"
    
      49}
    
      50

Changes since previous scan

--- PKGBUILD @ 2026-10-26 00:12
+++ PKGBUILD @ 2026-11-02 00:26
@@ -12,7 +12,7 @@
 
 pkgname=gitkraken-standalone
 pkgrel=1
-pkgver=12.5.0
+pkgver=12.6.1
 pkgdesc="The intuitive, fast, and beautiful cross-platform Git client. Serverless version (requires license file)."
 url="https://help.gitkraken.com/gitkraken-desktop/serverless/"
 provides=('gitkraken')
@@ -31,7 +31,7 @@
     "eula.html"
     "gitkraken.sh"
 )
-sha256sums=('7356701d32c1f24cdc36db4481dd0c54db8778a275ca02006604b8cadd95eeb8'
+sha256sums=('eb5e100a00752540805bcb97871c91ecef03e313cdd2cc8358119607ea1974ed'
             '078fa2cdf6826d956bf73387fb2ef147b1aca5f4a7a3cb4be8c71e6105fc9c6c'
             '5b7b39b331bc32a606e1e79c695df4519c9b220225be00fb34ef368c3af319a6'
             '6e6c6ac37287e1ec5d5266689a49d18899488be901b21f5cb9749f545453626f')

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-02 00:26:00	Low	2
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 00:13:55	Low	2
2026-10-28 00:06:54	Low	2
2026-10-27 00:23:28	Low	2
2026-10-26 23:46:04	Medium	1
2026-10-26 00:12:40	Low	2
2026-10-25 00:20:48	Low	2
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 00:13:10	Low	2
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2