gitkraken-standalone

maintainer 0cool_f · 2 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a source tarball from a non-whitelisted but plausibly official domain (api.gitkraken.dev) used by the project; it builds and installs the official application without executing untrusted remote code or exfiltrating data.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a source tarball from a non-whitelisted but plausibly official domain (api.gitkraken.dev) used by the project; it builds and installs the official application without executing untrusted remote code or exfiltrating data.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:29 "${pkgname}-${pkgver}.tar.gz::https://api.gitkraken.dev/releases/standalone/production/linux/x64/${pkgver}/gitkraken-amd64.tar.gz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Fabio Di Giorgio <ravnos at duck dot com>
    
      2# Contributor: Jay Ta'ala <jay@jaytaala.com>
    
      3# Contributor: Tim Kleinschmidt <tim.kleinschmidt@gmail.com>
    
      4# Contributor: Marcin Wieczorek <marcin@marcin.co>
    
      5# Contributor: Jean-Pier Brochu <jeanpier.brochu@gmail.com>
    
      6# Contributor: Samuel Littley <samuel@samuellittley.me>
    
      7# Contributor: KillWolfVlad <github.com/KillWolfVlad>
    
      8# Contributor: Victor Hugo Souza <vhbsouza@gmail.com>
    
      9# Contributor: William Penton <william@penton.us>
    
      10# Contributor: Jeff Moody <jeff@fifthecho.com>
    
      11# Contributor: KokaKiwi <kokakiwi+aur@kokakiwi.net>
    
      12
    
      13pkgname=gitkraken-standalone
    
      14pkgrel=1
    
      15pkgver=12.3.1
    
      16pkgdesc="The intuitive, fast, and beautiful cross-platform Git client. Serverless version (requires license file)."
    
      17url="https://help.gitkraken.com/gitkraken-desktop/serverless/"
    
      18provides=('gitkraken')
    
      19conflicts=('gitkraken')
    
      20arch=('x86_64')
    
      21license=('custom')
    
      22depends=('nss' 'gtk3' 'libsecret' 'libxkbfile')
    
      23optdepends=('git-lfs: git-lfs support'
    
      24            'org.freedesktop.secrets: Provides ways to store passwords and encryption keys')
    
      25makedepends=()
    
      26backup=()
    
      27install=''
    
      28source=(
    
      29    "${pkgname}-${pkgver}.tar.gz::https://api.gitkraken.dev/releases/standalone/production/linux/x64/${pkgver}/gitkraken-amd64.tar.gz"
    
      30    "GitKraken.desktop"
    
      31    "eula.html"
    
      32    "gitkraken.sh"
    
      33)
    
      34sha256sums=('dae97cc3f233a717e81afdcbe09eef46d3c4ee0e0407223e95d8c24ebd7a449f'
    
      35            '078fa2cdf6826d956bf73387fb2ef147b1aca5f4a7a3cb4be8c71e6105fc9c6c'
    
      36            '5b7b39b331bc32a606e1e79c695df4519c9b220225be00fb34ef368c3af319a6'
    
      37            '6e6c6ac37287e1ec5d5266689a49d18899488be901b21f5cb9749f545453626f')
    
      38
    
      39package() {
    
      40    install -d "$pkgdir"/opt
    
      41    cp -R "$srcdir"/gitkraken "$pkgdir"/opt/gitkraken
    
      42
    
      43    install -d "$pkgdir"/usr/bin
    
      44
    
      45    install -D -m755 "./gitkraken.sh" "${pkgdir}/usr/bin/gitkraken"
    
      46    install -D -m644 "./eula.html" "${pkgdir}/usr/share/licenses/${pkgname}/eula.html"
    
      47    install -D -m644 "./GitKraken.desktop" "${pkgdir}/usr/share/applications/GitKraken.desktop"
    
      48    install -D -m644 "$pkgdir/opt/gitkraken/gitkraken.png" "$pkgdir/usr/share/pixmaps/gitkraken.png"
    
      49}
    
      50

Changes since previous scan

--- PKGBUILD @ 2026-07-22 00:29
+++ PKGBUILD @ 2026-08-03 00:08
@@ -12,7 +12,7 @@
 
 pkgname=gitkraken-standalone
 pkgrel=1
-pkgver=12.3.0
+pkgver=12.3.1
 pkgdesc="The intuitive, fast, and beautiful cross-platform Git client. Serverless version (requires license file)."
 url="https://help.gitkraken.com/gitkraken-desktop/serverless/"
 provides=('gitkraken')
@@ -31,7 +31,7 @@
     "eula.html"
     "gitkraken.sh"
 )
-sha256sums=('f6049b8114b620b9e9b5d3b4f37d82bda7ff0d49dda8786b27792df3c95db81a'
+sha256sums=('dae97cc3f233a717e81afdcbe09eef46d3c4ee0e0407223e95d8c24ebd7a449f'
             '078fa2cdf6826d956bf73387fb2ef147b1aca5f4a7a3cb4be8c71e6105fc9c6c'
             '5b7b39b331bc32a606e1e79c695df4519c9b220225be00fb34ef368c3af319a6'
             '6e6c6ac37287e1ec5d5266689a49d18899488be901b21f5cb9749f545453626f')

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 01:18:42	MEDIUM	1
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2