gitkraken-standalone

LOW

maintainer 0cool_f 2 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads a source tarball from the project's official API domain (api.gitkraken.dev) for building the package; this is a legitimate and expected source for GitKraken's serverless release, not a malicious or untrusted host, despite being flagged due to non-standard domain use.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a source tarball from the project's official API domain (api.gitkraken.dev) for building the package; this is a legitimate and expected source for GitKraken's serverless release, not a malicious or untrusted host, despite being flagged due to non-standard domain use.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:29 "${pkgname}-${pkgver}.tar.gz::https://api.gitkraken.dev/releases/standalone/production/linux/x64/${pkgver}/gitkraken-amd64.tar.gz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Fabio Di Giorgio <ravnos at duck dot com>
    
      2# Contributor: Jay Ta'ala <jay@jaytaala.com>
    
      3# Contributor: Tim Kleinschmidt <tim.kleinschmidt@gmail.com>
    
      4# Contributor: Marcin Wieczorek <marcin@marcin.co>
    
      5# Contributor: Jean-Pier Brochu <jeanpier.brochu@gmail.com>
    
      6# Contributor: Samuel Littley <samuel@samuellittley.me>
    
      7# Contributor: KillWolfVlad <github.com/KillWolfVlad>
    
      8# Contributor: Victor Hugo Souza <vhbsouza@gmail.com>
    
      9# Contributor: William Penton <william@penton.us>
    
      10# Contributor: Jeff Moody <jeff@fifthecho.com>
    
      11# Contributor: KokaKiwi <kokakiwi+aur@kokakiwi.net>
    
      12
    
      13pkgname=gitkraken-standalone
    
      14pkgrel=1
    
      15pkgver=12.5.0
    
      16pkgdesc="The intuitive, fast, and beautiful cross-platform Git client. Serverless version (requires license file)."
    
      17url="https://help.gitkraken.com/gitkraken-desktop/serverless/"
    
      18provides=('gitkraken')
    
      19conflicts=('gitkraken')
    
      20arch=('x86_64')
    
      21license=('custom')
    
      22depends=('nss' 'gtk3' 'libsecret' 'libxkbfile')
    
      23optdepends=('git-lfs: git-lfs support'
    
      24            'org.freedesktop.secrets: Provides ways to store passwords and encryption keys')
    
      25makedepends=()
    
      26backup=()
    
      27install=''
    
      28source=(
    
      29    "${pkgname}-${pkgver}.tar.gz::https://api.gitkraken.dev/releases/standalone/production/linux/x64/${pkgver}/gitkraken-amd64.tar.gz"
    
      30    "GitKraken.desktop"
    
      31    "eula.html"
    
      32    "gitkraken.sh"
    
      33)
    
      34sha256sums=('7356701d32c1f24cdc36db4481dd0c54db8778a275ca02006604b8cadd95eeb8'
    
      35            '078fa2cdf6826d956bf73387fb2ef147b1aca5f4a7a3cb4be8c71e6105fc9c6c'
    
      36            '5b7b39b331bc32a606e1e79c695df4519c9b220225be00fb34ef368c3af319a6'
    
      37            '6e6c6ac37287e1ec5d5266689a49d18899488be901b21f5cb9749f545453626f')
    
      38
    
      39package() {
    
      40    install -d "$pkgdir"/opt
    
      41    cp -R "$srcdir"/gitkraken "$pkgdir"/opt/gitkraken
    
      42
    
      43    install -d "$pkgdir"/usr/bin
    
      44
    
      45    install -D -m755 "./gitkraken.sh" "${pkgdir}/usr/bin/gitkraken"
    
      46    install -D -m644 "./eula.html" "${pkgdir}/usr/share/licenses/${pkgname}/eula.html"
    
      47    install -D -m644 "./GitKraken.desktop" "${pkgdir}/usr/share/applications/GitKraken.desktop"
    
      48    install -D -m644 "$pkgdir/opt/gitkraken/gitkraken.png" "$pkgdir/usr/share/pixmaps/gitkraken.png"
    
      49}
    
      50

Changes since previous scan

--- PKGBUILD @ 2026-09-16 00:03
+++ PKGBUILD @ 2026-09-17 00:27
@@ -12,7 +12,7 @@
 
 pkgname=gitkraken-standalone
 pkgrel=1
-pkgver=12.4.1
+pkgver=12.5.0
 pkgdesc="The intuitive, fast, and beautiful cross-platform Git client. Serverless version (requires license file)."
 url="https://help.gitkraken.com/gitkraken-desktop/serverless/"
 provides=('gitkraken')
@@ -31,7 +31,7 @@
     "eula.html"
     "gitkraken.sh"
 )
-sha256sums=('6e8c74b32076b9b7f10de8f979196cfd654d9e75ad5ff21d4a07475034329657'
+sha256sums=('7356701d32c1f24cdc36db4481dd0c54db8778a275ca02006604b8cadd95eeb8'
             '078fa2cdf6826d956bf73387fb2ef147b1aca5f4a7a3cb4be8c71e6105fc9c6c'
             '5b7b39b331bc32a606e1e79c695df4519c9b220225be00fb34ef368c3af319a6'
             '6e6c6ac37287e1ec5d5266689a49d18899488be901b21f5cb9749f545453626f')

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 15:22:50	Medium	1
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 21:51:32	Medium	1
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2