grunden-work-beta-bin

MEDIUM

maintainer grundenai 0 votes scanned 2026-11-04 10:09:25.276471

View on AUR

Why flagged

Downloads a prebuilt binary tarball from work.grunden.ai (the vendor's own domain, not a personal file-sharing host), with a PGP signature verification step that provides meaningful integrity assurance; the main concern is that this is a closed-source prebuilt executable from a low-vote, recently uploaded package whose vendor infrastructure cannot be independently audited, but the GPG signing mitigates the worst supply-chain swap scenarios.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:20 source=("$pkgname-$pkgver.tar.gz::https://work.grunden.ai/installers/beta/grunden-work-beta-linux-x64-$pkgver.tar.gz"

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 65%): Downloads a prebuilt binary tarball from work.grunden.ai (the vendor's own domain, not a personal file-sharing host), with a PGP signature verification step that provides meaningful integrity assurance; the main concern is that this is a closed-source prebuilt executable from a low-vote, recently uploaded package whose vendor infrastructure cannot be independently audited, but the GPG signing mitigates the worst supply-chain swap scenarios.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Grunden AI <support@grunden.ai>
    
      2# This is a template — packaging/aur/render.sh writes PKGBUILD from it with a
    
      3# release's version and tarball hash. The workflow (.github/workflows/
    
      4# aur-publish.yml) does that on every release; see packaging/aur/README.md to
    
      5# render it by hand.
    
      6pkgname=grunden-work-beta-bin
    
      7pkgver=0.17.96
    
      8pkgrel=1
    
      9pkgdesc="Grunden Cowork Beta desktop - sovereign AI workbench (prebuilt release)"
    
      10arch=('x86_64')
    
      11url="https://grunden.ai"
    
      12license=('custom')
    
      13depends=('gtk3' 'nss' 'alsa-lib' 'libsecret' 'xdg-utils')
    
      14optdepends=('gnome-keyring: Secret Service backend for sign-in credential storage'
    
      15            'kwallet: KDE keyring backend for sign-in credential storage'
    
      16            'libayatana-appindicator: system tray support')
    
      17conflicts=('grunden-work-beta')
    
      18provides=('grunden-work-beta')
    
      19options=('!strip')
    
      20source=("$pkgname-$pkgver.tar.gz::https://work.grunden.ai/installers/beta/grunden-work-beta-linux-x64-$pkgver.tar.gz"
    
      21        "$pkgname-$pkgver.tar.gz.asc::https://work.grunden.ai/installers/beta/grunden-work-beta-linux-x64-$pkgver.tar.gz.asc")
    
      22sha256sums=('ffac3f94adb7310932111cb23b59d6400293d98f783bc977ebc1a78d06584cb5'
    
      23            'SKIP')
    
      24# Grunden's Linux release key (ADR 0123 Amendment 2); makepkg refuses a tarball
    
      25# whose signature it cannot check against it. The key is also in this
    
      26# repository under keys/pgp/, and at https://work.grunden.ai/installers/grunden-linux-release-key.asc.
    
      27validpgpkeys=('F0278514447EB0CC73F11D02E2773FCE0DD16E0A')
    
      28package() {
    
      29  install -d "$pkgdir/opt/grunden-work-beta"
    
      30  cp -a "$srcdir/grunden-work-beta-linux-x64-$pkgver/." "$pkgdir/opt/grunden-work-beta/"
    
      31  # Chromium's SUID sandbox; harmless where unprivileged user namespaces suffice
    
      32  chmod 4755 "$pkgdir/opt/grunden-work-beta/chrome-sandbox"
    
      33  # A launcher rather than a symlink, so a member adds flags (on i3 or sway,
    
      34  # --password-store=gnome-libsecret) in a file instead of a user-level
    
      35  # grunden-work-beta.desktop, which hides this package's entry from the menu.
    
      36  install -Dm755 /dev/stdin "$pkgdir/usr/bin/grunden-work-beta" <<'LAUNCHER'
    
      37#!/bin/sh
    
      38# Flags from ~/.config/grunden-work-beta-flags.conf: whitespace-separated, # starts a comment.
    
      39set -f
    
      40conf="${XDG_CONFIG_HOME:-$HOME/.config}/grunden-work-beta-flags.conf"
    
      41flags=
    
      42[ -r "$conf" ] && flags=$(sed 's/#.*//' "$conf")
    
      43exec /opt/grunden-work-beta/grunden-work-beta $flags "$@"
    
      44LAUNCHER
    
      45  install -Dm644 "$srcdir/grunden-work-beta-linux-x64-$pkgver/resources/legal/OPENWORK-LICENSE.txt" \
    
      46    "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      47  install -Dm644 "$srcdir/grunden-work-beta-linux-x64-$pkgver/resources/icons/icon.png" \
    
      48    "$pkgdir/usr/share/icons/hicolor/512x512/apps/grunden-work-beta.png"
    
      49  install -Dm644 /dev/stdin "$pkgdir/usr/share/applications/grunden-work-beta.desktop" <<'DESKTOP'
    
      50[Desktop Entry]
    
      51Type=Application
    
      52Name=Grunden Cowork Beta
    
      53Comment=Grunden Cowork Beta desktop app
    
      54Exec=grunden-work-beta %U
    
      55Icon=grunden-work-beta
    
      56Terminal=false
    
      57Categories=Network;
    
      58MimeType=x-scheme-handler/grunden-work-beta;
    
      59StartupNotify=true
    
      60StartupWMClass=grunden-work-beta
    
      61DESKTOP
    
      62}
    
      63

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-04 10:09:25	Medium	3
2026-11-04 10:06:54	Medium	2