grunden-work-bin

LOW

maintainer grundenai 0 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

The package downloads a prebuilt binary from the project's own domain and includes a PGP signature check, but the signature is marked SKIP, reducing verifiability; however, the binary is from an official project host and the risk is mitigated by the PGP key infrastructure, making it low severity.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The package downloads a prebuilt binary from the project's own domain and includes a PGP signature check, but the signature is marked SKIP, reducing verifiability; however, the binary is from an official project host and the risk is mitigated by the PGP key infrastructure, making it low severity.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:20 source=("$pkgname-$pkgver.tar.gz::https://work.grunden.ai/installers/grunden-work-linux-x64-$pkgver.tar.gz"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Grunden AI <support@grunden.ai>
    
      2# This is a template — packaging/aur/render.sh writes PKGBUILD from it with a
    
      3# release's version and tarball hash. The workflow (.github/workflows/
    
      4# aur-publish.yml) does that on every release; see packaging/aur/README.md to
    
      5# render it by hand.
    
      6pkgname=grunden-work-bin
    
      7pkgver=0.17.76
    
      8pkgrel=1
    
      9pkgdesc="Grunden Cowork desktop - sovereign AI workbench (prebuilt release)"
    
      10arch=('x86_64')
    
      11url="https://grunden.ai"
    
      12license=('custom')
    
      13depends=('gtk3' 'nss' 'alsa-lib' 'libsecret' 'xdg-utils')
    
      14optdepends=('gnome-keyring: Secret Service backend for sign-in credential storage'
    
      15            'kwallet: KDE keyring backend for sign-in credential storage'
    
      16            'libayatana-appindicator: system tray support')
    
      17conflicts=('grunden-work')
    
      18provides=('grunden-work')
    
      19options=('!strip')
    
      20source=("$pkgname-$pkgver.tar.gz::https://work.grunden.ai/installers/grunden-work-linux-x64-$pkgver.tar.gz"
    
      21        "$pkgname-$pkgver.tar.gz.asc::https://work.grunden.ai/installers/grunden-work-linux-x64-$pkgver.tar.gz.asc")
    
      22sha256sums=('9b678c1954babaf58efecb12ab20a8d0a1b26c7c07537244b1396a67adff2175'
    
      23            'SKIP')
    
      24# Grunden's Linux release key (ADR 0123 Amendment 2); makepkg refuses a tarball
    
      25# whose signature it cannot check against it. The key is also in this
    
      26# repository under keys/pgp/, and at https://work.grunden.ai/installers/grunden-linux-release-key.asc.
    
      27validpgpkeys=('F0278514447EB0CC73F11D02E2773FCE0DD16E0A')
    
      28package() {
    
      29  install -d "$pkgdir/opt/grunden-work"
    
      30  cp -a "$srcdir/grunden-work-linux-x64-$pkgver/." "$pkgdir/opt/grunden-work/"
    
      31  # Chromium's SUID sandbox; harmless where unprivileged user namespaces suffice
    
      32  chmod 4755 "$pkgdir/opt/grunden-work/chrome-sandbox"
    
      33  install -d "$pkgdir/usr/bin"
    
      34  ln -s /opt/grunden-work/grunden-work "$pkgdir/usr/bin/grunden-work"
    
      35  install -Dm644 "$srcdir/grunden-work-linux-x64-$pkgver/resources/legal/OPENWORK-LICENSE.txt" \
    
      36    "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      37  install -Dm644 "$srcdir/grunden-work-linux-x64-$pkgver/resources/icons/icon.png" \
    
      38    "$pkgdir/usr/share/icons/hicolor/512x512/apps/grunden-work.png"
    
      39  install -Dm644 /dev/stdin "$pkgdir/usr/share/applications/grunden-work.desktop" <<'DESKTOP'
    
      40[Desktop Entry]
    
      41Type=Application
    
      42Name=Grunden Cowork
    
      43Comment=Grunden Cowork desktop app
    
      44Exec=grunden-work %U
    
      45Icon=grunden-work
    
      46Terminal=false
    
      47Categories=Network;
    
      48MimeType=x-scheme-handler/grunden-work;
    
      49StartupNotify=true
    
      50StartupWMClass=grunden-work
    
      51DESKTOP
    
      52}
    
      53

Changes since previous scan

--- PKGBUILD @ 2026-10-16 00:12
+++ PKGBUILD @ 2026-10-17 00:21
@@ -4,7 +4,7 @@
 # aur-publish.yml) does that on every release; see packaging/aur/README.md to
 # render it by hand.
 pkgname=grunden-work-bin
-pkgver=0.17.75
+pkgver=0.17.76
 pkgrel=1
 pkgdesc="Grunden Cowork desktop - sovereign AI workbench (prebuilt release)"
 arch=('x86_64')
@@ -19,7 +19,7 @@
 options=('!strip')
 source=("$pkgname-$pkgver.tar.gz::https://work.grunden.ai/installers/grunden-work-linux-x64-$pkgver.tar.gz"
         "$pkgname-$pkgver.tar.gz.asc::https://work.grunden.ai/installers/grunden-work-linux-x64-$pkgver.tar.gz.asc")
-sha256sums=('3d215e9a43bf41f451cf223763f8153d19f483052fb1312b35a942f96bbf9cfb'
+sha256sums=('9b678c1954babaf58efecb12ab20a8d0a1b26c7c07537244b1396a67adff2175'
             'SKIP')
 # Grunden's Linux release key (ADR 0123 Amendment 2); makepkg refuses a tarball
 # whose signature it cannot check against it. The key is also in this

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Low	3
2026-10-16 07:15:06	Medium	2
2026-10-16 00:12:47	Low	3
2026-10-15 23:13:54	Medium	2
2026-10-15 21:13:25	Medium	2
2026-10-15 00:28:05	Low	3
2026-10-14 23:21:11	Medium	2
2026-10-14 00:06:47	Low	3
2026-10-13 23:18:21	Medium	2
2026-10-13 00:23:45	Low	3
2026-10-12 13:13:52	Medium	2
2026-10-12 00:18:51	Medium	3
2026-10-11 21:14:37	Medium	3
2026-10-11 21:11:00	Medium	2