gotohp-git

MEDIUM

maintainer krishn 1 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The PKGBUILD runs `go install github.com/wailsapp/wails/v3/cmd/wails3@latest` at build time, fetching and executing an unpinned (`@latest`) version of the Wails build tool from the internet with no checksum verification. While wailsapp/wails is a legitimate, well-known open-source project, using `@latest` means any future compromise or version bump of that module (or its transitive dependencies resolved at build time) would silently execute arbitrary code during the build. This is a genuine supply-chain concern: an executed build tool pulled at an unversioned, unverified reference. The main application source itself is cloned from the official GitHub repo (git+https, SKIP checksum is acceptable for -git packages), but the unbounded `@latest` go install is the real issue. This is a real medium-severity concern, not a false positive.

Triggered rules

Medium External install via pipx/uv/poetry/cargo/go/gem alt_pkg_manager_install

A non-pip/npm package manager (pipx, uv, poetry, cargo install, go install, gem, conda…) fetches and builds an external package at build time, outside source=() and makepkg's checksums.

PKGBUILD:37 go install github.com/wailsapp/wails/v3/cmd/wails3@latest

Medium AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD runs `go install github.com/wailsapp/wails/v3/cmd/wails3@latest` at build time, fetching and executing an unpinned (`@latest`) version of the Wails build tool from the internet with no checksum verification. While wailsapp/wails is a legitimate, well-known open-source project, using `@latest` means any future compromise or version bump of that module (or its transitive dependencies resolved at build time) would silently execute arbitrary code during the build. This is a genuine supply-chain concern: an executed build tool pulled at an unversioned, unverified reference. The main application source itself is cloned from the official GitHub repo (git+https, SKIP checksum is acceptable for -git packages), but the unbounded `@latest` go install is the real issue. This is a real medium-severity concern, not a false positive.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Omansh Krishn <omansh@duck.com>
    
      2
    
      3_pkgname=gotohp
    
      4pkgname=${_pkgname}-git
    
      5pkgver=0.7.0.r1.g5c26b8c
    
      6pkgrel=1
    
      7pkgdesc='Unofficial Google Photos Desktop GUI Client - git version'
    
      8arch=('x86_64')
    
      9url='https://github.com/xob0t/gotohp'
    
      10license=('MIT')
    
      11makedepends=(
    
      12  git
    
      13  go
    
      14  nodejs
    
      15  npm
    
      16  pkgconf
    
      17)
    
      18depends=(
    
      19  webkit2gtk-4.1
    
      20  gtk3
    
      21)
    
      22provides=("${_pkgname}" "${_pkgname}=${pkgver}")
    
      23conflicts=("${_pkgname}" "${_pkgname}-bin")
    
      24options=(!debug)
    
      25
    
      26source=("${_pkgname}"::"git+${url}.git")
    
      27sha256sums=('SKIP')
    
      28
    
      29pkgver() {
    
      30    git -C "${srcdir}/${_pkgname}" describe --long --tags | sed 's/^v//;s/\([^-]*-g\)/r\1/;s/-/./g'
    
      31}
    
      32
    
      33build() {
    
      34  cd "${srcdir}/${_pkgname}"
    
      35  export GOPATH="${srcdir}/go"
    
      36  export PATH="${GOPATH}/bin:${PATH}"
    
      37  go install github.com/wailsapp/wails/v3/cmd/wails3@latest
    
      38  # go build -tags production -trimpath -buildvcs=false -ldflags="-w -s" -o bin/gotohp
    
      39  wails3 task linux:build -- PRODUCTION=true
    
      40}
    
      41
    
      42package() {
    
      43  install -dm755 "${pkgdir}/usr/bin"
    
      44  install -m755 "${srcdir}/${_pkgname}/bin/${_pkgname}" "${pkgdir}/usr/bin/${_pkgname}"
    
      45
    
      46  install -dm755 "${pkgdir}/usr/share/icons/hicolor/128x128/apps"
    
      47  install -m644 "${srcdir}/${_pkgname}/build/appicon.png" "${pkgdir}/usr/share/icons/hicolor/128x128/apps/${_pkgname}.png"
    
      48
    
      49  install -dm755 "${pkgdir}/usr/share/applications"
    
      50  sed -i "s|^Exec=.*|Exec=${_pkgname}|" "${srcdir}/${_pkgname}/build/linux/desktop"
    
      51  install -Dm644 "${srcdir}/${_pkgname}/build/linux/desktop" "${pkgdir}/usr/share/applications/${_pkgname}.desktop"
    
      52}
    
      53

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2
2026-08-29 00:29:17	Medium	2