granola-wine

maintainer GrgaPalcic · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt Windows executable (an NSIS installer) from a CloudFront CDN URL (dr2v7l5emb758.cloudfront.net) that is not the official granola.ai domain. The executable is then extracted with 7zip and its contents are installed to /opt and run under Wine. The sha256 checksum provides integrity against tampering in transit, but the CDN bucket identity cannot be verified as officially controlled by Granola AI — if the CloudFront distribution were compromised or reassigned, a malicious binary could be substituted. The extracted Windows application code runs as a Wine process with user privileges. This is a genuine supply-chain concern: an unofficial/unverifiable CDN host serving an executed binary. However, this pattern is common for proprietary apps distributed via CDN (e.g., Electron apps), and the checksum does mitigate MITM risk. The medium rating is appropriate: not clearly malicious, but the host cannot be confirmed as the official vendor distribution point.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 "Granola-${pkgver}-win-x64.exe::https://dr2v7l5emb758.cloudfront.net/${pkgver}/Granola-${pkgver}-win-x64.exe"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt Windows executable (an NSIS installer) from a CloudFront CDN URL (dr2v7l5emb758.cloudfront.net) that is not the official granola.ai domain. The executable is then extracted with 7zip and its contents are installed to /opt and run under Wine. The sha256 checksum provides integrity against tampering in transit, but the CDN bucket identity cannot be verified as officially controlled by Granola AI — if the CloudFront distribution were compromised or reassigned, a malicious binary could be substituted. The extracted Windows application code runs as a Wine process with user privileges. This is a genuine supply-chain concern: an unofficial/unverifiable CDN host serving an executed binary. However, this pattern is common for proprietary apps distributed via CDN (e.g., Electron apps), and the checksum does mitigate MITM risk. The medium rating is appropriate: not clearly malicious, but the host cannot be confirmed as the official vendor distribution point.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: invt <invt@localhost>
    
      2
    
      3pkgname=granola-wine
    
      4pkgver=7.319.1
    
      5pkgrel=1
    
      6pkgdesc='Granola AI Notepad for Windows packaged to run under Wine'
    
      7arch=('x86_64')
    
      8url='https://www.granola.ai/'
    
      9license=('custom')
    
      10depends=('desktop-file-utils' 'hicolor-icon-theme' 'wine' 'xdg-utils')
    
      11makedepends=('7zip')
    
      12install="${pkgname}.install"
    
      13options=('!strip' '!debug')
    
      14noextract=("Granola-${pkgver}-win-x64.exe")
    
      15source=(
    
      16  "Granola-${pkgver}-win-x64.exe::https://dr2v7l5emb758.cloudfront.net/${pkgver}/Granola-${pkgver}-win-x64.exe"
    
      17  'granola.in'
    
      18  'granola-wine.desktop'
    
      19  'granola-wine.install'
    
      20  'LICENSE'
    
      21)
    
      22sha256sums=('4cdeabf87e9b72d23ef7e59896087a4d67481f50e74b58eac9c25ec1b4a61942'
    
      23            'c92ef8f028398fe840f001dacd6b80e665914275c346e78fccaac89019b179c2'
    
      24            'd3271d0a19cc761fdcdbd45f82670ff45f19362d9a26b6f457617032e6f86c62'
    
      25            '06c5b52f1f88887bf4e501d895c116bf351e46118b707d486ec6f0e0afeddc15'
    
      26            'af454ff477d4c6608b755801ac954010a74ce37580b359e6404cfe8151eec8ba')
    
      27
    
      28prepare() {
    
      29  rm -rf "${srcdir}/installer" "${srcdir}/app"
    
      30  mkdir -p "${srcdir}/installer" "${srcdir}/app"
    
      31
    
      32  7z x -y -o"${srcdir}/installer" "${srcdir}/Granola-${pkgver}-win-x64.exe" '$PLUGINSDIR/app-64.7z'
    
      33  7z x -y -o"${srcdir}/app" "${srcdir}/installer/\$PLUGINSDIR/app-64.7z"
    
      34}
    
      35
    
      36package() {
    
      37  install -d "${pkgdir}/opt/${pkgname}/app"
    
      38  cp -a "${srcdir}/app/." "${pkgdir}/opt/${pkgname}/app/"
    
      39
    
      40  install -Dm755 "${srcdir}/granola.in" "${pkgdir}/usr/bin/granola"
    
      41  sed -i "s/@PKGVER@/${pkgver}/g" "${pkgdir}/usr/bin/granola"
    
      42
    
      43  install -Dm644 "${srcdir}/granola-wine.desktop" "${pkgdir}/usr/share/applications/granola-wine.desktop"
    
      44  install -Dm644 "${srcdir}/app/resources/icons/icon.png" "${pkgdir}/usr/share/icons/hicolor/512x512/apps/granola-wine.png"
    
      45  install -Dm644 "${srcdir}/LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      46}
    
      47

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2