grok-desktop

LOW

maintainer VVL 0 votes scanned 2026-11-06 20:13:57.208379

View on AUR

Why flagged

The package builds from source hosted on GitHub and uses a Node.js binary from nodejs.org for the build toolchain, which is standard practice; the only concern is the low vote count and recent upload, but no malicious behavior or unverifiable executables are present.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package builds from source hosted on GitHub and uses a Node.js binary from nodejs.org for the build toolchain, which is standard practice; the only concern is the low vote count and recent upload, but no malicious behavior or unverifiable executables are present.

PKGBUILD

      1# Maintainer: Vladislav Minakov <v@minakov.pro>
    
      2
    
      3pkgname=grok-desktop
    
      4pkgver=1.4.8
    
      5pkgrel=1
    
      6pkgdesc="Desktop GUI for the Grok Build coding agent"
    
      7arch=('x86_64')
    
      8url="https://github.com/liaan/grok-desktop"
    
      9license=('MIT')
    
      10depends=(
    
      11  'alsa-lib'
    
      12  'grok'
    
      13  'gtk3'
    
      14  'nss'
    
      15  'xdg-utils'
    
      16)
    
      17optdepends=('bubblewrap: sandboxed agent terminals')
    
      18# Upstream builds with Node 22. The official linux-x64 tarball is the toolchain
    
      19# so this does not replace the system nodejs package.
    
      20_nodever=22.23.4
    
      21makedepends=('python')
    
      22options=('!strip' '!debug')
    
      23source=("$pkgname-$pkgver.tar.gz::https://github.com/liaan/grok-desktop/archive/refs/tags/v${pkgver}.tar.gz"
    
      24        "https://nodejs.org/dist/v${_nodever}/node-v${_nodever}-linux-x64.tar.xz"
    
      25        "disable-updater.patch"
    
      26        "grok-desktop.sh"
    
      27        "grok-desktop.desktop")
    
      28sha512sums=('5f98eeb36568b293d7df0ec082312f8cd17c254cbcc6641858e8cfaec696e75cf7fe6d80189db8e206c75c0d01c1475a5a51dfc82c5bb98168844b37c5112691'
    
      29            'fb72434120aec53aae61ac328bdf711bde4341208dd735a6e4d4004452e0f232ecac19b10d1c5e978c85d615b5ddd96e67f01134d9d39c89b46488415265ce48'
    
      30            '19f83375b3d55b8ae9b057c27b09df4c0b151f96334e60d2c86be32511adb6dada88646684beea2dbb96eb9350155b5a6e7fc748c486a5cf8b4cab9c18d1fdb2'
    
      31            '7825e307d63d951d9e8c58f1e4cd0caa06f0673f1f75727c6439259dbac419296213ad727d3ab290ccaadeb187fbe67633f46c668d9df15664ac3e92ed54a5ee'
    
      32            'e22a2649db3b0e6f594180469b42f4c1de94a4910dc3438c9dbbb41156dc326f9476af2769308f974f4a0c7acfc1a9d7490cc905e12c933883be8d84843194bb')
    
      33
    
      34prepare() {
    
      35  cd "$pkgname-$pkgver"
    
      36  patch -Np1 -i "$srcdir/disable-updater.patch"
    
      37}
    
      38
    
      39build() {
    
      40  local _node="${srcdir}/node-v${_nodever}-linux-x64"
    
      41  export PATH="${_node}/bin:${PATH}"
    
      42  export npm_config_cache="${srcdir}/npm-cache"
    
      43  export ELECTRON_CACHE="${srcdir}/electron-cache"
    
      44  export ELECTRON_BUILDER_CACHE="${srcdir}/electron-builder-cache"
    
      45  export HOME="${srcdir}/home"
    
      46  export CSC_IDENTITY_AUTO_DISCOVERY=false
    
      47  mkdir -p "$npm_config_cache" "$ELECTRON_CACHE" "$ELECTRON_BUILDER_CACHE" "$HOME"
    
      48
    
      49  cd "$pkgname-$pkgver"
    
      50  # dir only: AppImage auto-update is disabled in the launcher.
    
      51  python - << 'PY'
    
      52import json
    
      53with open("package.json") as f:
    
      54    data = json.load(f)
    
      55linux = data["build"].setdefault("linux", {})
    
      56linux["target"] = [{"target": "dir", "arch": ["x64"]}]
    
      57linux["executableName"] = "grok-desktop"
    
      58with open("package.json", "w") as f:
    
      59    json.dump(data, f, indent=2)
    
      60    f.write("\n")
    
      61PY
    
      62
    
      63  local attempt max=3 status
    
      64  for attempt in 1 2 3; do
    
      65    echo "=== npm ci attempt ${attempt}/${max} ==="
    
      66    if npm ci --no-audit --no-fund; then
    
      67      status=0
    
      68      break
    
      69    fi
    
      70    status=$?
    
      71    rm -rf node_modules
    
      72    sleep $((attempt * 5))
    
      73  done
    
      74  [ "$status" -eq 0 ]
    
      75
    
      76  npm run build
    
      77  ./node_modules/.bin/electron-builder --linux dir --x64 --publish never
    
      78}
    
      79
    
      80package() {
    
      81  local _unpacked="${srcdir}/$pkgname-$pkgver/release/linux-unpacked"
    
      82  install -d "${pkgdir}/usr/lib/${pkgname}"
    
      83  cp -a "${_unpacked}/." "${pkgdir}/usr/lib/${pkgname}/"
    
      84  chmod 4755 "${pkgdir}/usr/lib/${pkgname}/chrome-sandbox"
    
      85  # In-app updater installs GitHub AppImages. Pacman owns this tree.
    
      86  rm -f "${pkgdir}/usr/lib/${pkgname}/resources/app-update.yml"
    
      87
    
      88  install -Dm755 "${srcdir}/grok-desktop.sh" "${pkgdir}/usr/bin/grok-desktop"
    
      89  install -Dm644 "${srcdir}/grok-desktop.desktop" "${pkgdir}/usr/share/applications/grok-desktop.desktop"
    
      90  install -Dm644 "${srcdir}/$pkgname-$pkgver/build/icon.svg" \
    
      91    "${pkgdir}/usr/share/icons/hicolor/scalable/apps/grok-desktop.svg"
    
      92  install -Dm644 "${srcdir}/$pkgname-$pkgver/LICENSE" \
    
      93    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      94}
    
      95

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-06 20:13:57	Low	2