idrive-desktop-bin

LOW

maintainer andybarilla 1 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads an official .deb from the vendor's domain (idrivedownloads.com) which is plausibly part of IDrive's infrastructure; the source is not executed remotely and the payload is installed as-is, with no obfuscation or code modification, making this a standard repackaging pattern for AUR.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads an official .deb from the vendor's domain (idrivedownloads.com) which is plausibly part of IDrive's infrastructure; the source is not executed remotely and the payload is installed as-is, with no obfuscation or code modification, making this a standard repackaging pattern for AUR.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:29 source=("IDriveForLinux.deb::https://www.idrivedownloads.com/downloads/linux/linux-desktop/IDriveForLinux.deb")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Andy <this.is.apb@gmail.com>
    
      2pkgname=idrive-desktop-bin
    
      3pkgver=1.11.0
    
      4pkgrel=1
    
      5pkgdesc="IDrive for Linux - official Electron desktop GUI for cloud backup, restore and sync"
    
      6arch=('x86_64')
    
      7url="https://www.idrive.com/online-backup-download"
    
      8license=('LicenseRef-IDrive')
    
      9# Translated from the .deb Depends. popt is needed by the idevsutil backup engine
    
      10# the app fetches on first run. gtk3/libnotify/etc. are pulled via the GUI libs.
    
      11# valkey is NOT here: redis is used only by the Cloud Sync daemon (sync-daemon,
    
      12# pkg "clouddrive"), so backup/restore and the GUI work without it -> optdepend.
    
      13depends=('nss' 'curl' 'sqlite' 'cronie' 'glib2' 'gtk3' 'xdotool' 'rsync' 'attr'
    
      14         'popt' 'python' 'python-gobject' 'python-watchdog' 'python-psutil')
    
      15optdepends=('valkey: Cloud Sync / Cloud Drive real-time folder sync (redis-compatible server)'
    
      16            'libappindicator-gtk3: system tray icon'
    
      17            'nautilus: file manager integration'
    
      18            'nautilus-python: cloud-sync overlay icons in Nautilus'
    
      19            'nemo-python: cloud-sync overlay icons in Nemo'
    
      20            'python-caja: cloud-sync overlay icons in Caja')
    
      21# Bundles the same /opt/IDriveForLinux backup engine as idrive-bin; only one of
    
      22# the two can manage that tree.
    
      23provides=('idrive')
    
      24conflicts=('idrive' 'idrive-bin')
    
      25options=('!strip')
    
      26install="$pkgname.install"
    
      27# Upstream serves a single, unversioned "latest" .deb, so the checksum cannot be
    
      28# pinned; pkgver() reads the real version from the deb's control file.
    
      29source=("IDriveForLinux.deb::https://www.idrivedownloads.com/downloads/linux/linux-desktop/IDriveForLinux.deb")
    
      30sha256sums=('SKIP')
    
      31
    
      32pkgver() {
    
      33	cd "$srcdir"
    
      34	# deb is an ar archive; pull the control member and read its Version field.
    
      35	bsdtar -xOf IDriveForLinux.deb control.tar.gz | bsdtar -xOf - \
    
      36		| grep -m1 '^Version:' | awk '{print $2}'
    
      37}
    
      38
    
      39package() {
    
      40	cd "$srcdir"
    
      41
    
      42	# Unpack the deb (ar: debian-binary, control.tar.gz, data.tar.xz), then lay
    
      43	# its payload (opt/ + usr/share) straight into the package.
    
      44	bsdtar -xf IDriveForLinux.deb
    
      45	bsdtar -xf data.tar.xz -C "$pkgdir"
    
      46
    
      47	# The Electron sandbox helper must be setuid root.
    
      48	chmod 4755 "$pkgdir/opt/IDriveForLinux/chrome-sandbox"
    
      49
    
      50	# The Cloud Sync daemon reads this seed blob (JUNK_PATH in sync-daemon);
    
      51	# only the upstream postinst writes it, so lay it down here verbatim.
    
      52	install -d "$pkgdir/opt/IDriveForLinux/.config/cloud-drive"
    
      53	printf '%s' 'aJF6Q4IP7IDO1moUhUHwVQ==:Y7B0vLir0nPK/saicnTvGldpsR8HoJWuc5/dVW0A0Xo=' \
    
      54		> "$pkgdir/opt/IDriveForLinux/.config/cloud-drive/.junk.txt"
    
      55	chmod 644 "$pkgdir/opt/IDriveForLinux/.config/cloud-drive/.junk.txt"
    
      56
    
      57	# Launcher on PATH (the .desktop already points at the absolute path).
    
      58	install -d "$pkgdir/usr/bin"
    
      59	ln -s /opt/IDriveForLinux/idriveforlinux "$pkgdir/usr/bin/idriveforlinux"
    
      60
    
      61	# License: pointer to the canonical terms plus the bundled Electron license.
    
      62	install -d "$pkgdir/usr/share/licenses/$pkgname"
    
      63	cat > "$pkgdir/usr/share/licenses/$pkgname/LICENSE" <<-'EOF'
    
      64		IDrive for Linux is proprietary software, Copyright IDrive Inc.
    
      65
    
      66		Use is governed by the IDrive Terms of Service:
    
      67		    https://www.idrive.com/terms-and-conditions
    
      68
    
      69		This package redistributes the unmodified official .deb payload from
    
      70		https://www.idrive.com/online-backup-download for convenience.
    
      71	EOF
    
      72	install -m644 "$pkgdir/opt/IDriveForLinux/LICENSE.electron.txt" \
    
      73		"$pkgdir/usr/share/licenses/$pkgname/LICENSE.electron.txt"
    
      74}
    
      75

Changes since previous scan

--- PKGBUILD @ 2026-09-03 00:15
+++ PKGBUILD @ 2026-09-17 00:27
@@ -1,6 +1,6 @@
 # Maintainer: Andy <this.is.apb@gmail.com>
 pkgname=idrive-desktop-bin
-pkgver=1.7.0
+pkgver=1.11.0
 pkgrel=1
 pkgdesc="IDrive for Linux - official Electron desktop GUI for cloud backup, restore and sync"
 arch=('x86_64')
@@ -11,8 +11,7 @@
 # valkey is NOT here: redis is used only by the Cloud Sync daemon (sync-daemon,
 # pkg "clouddrive"), so backup/restore and the GUI work without it -> optdepend.
 depends=('nss' 'curl' 'sqlite' 'cronie' 'glib2' 'gtk3' 'xdotool' 'rsync' 'attr'
-         'popt' 'python' 'python-gobject' 'python-watchdog' 'python-psutil'
-         'python-dbus')
+         'popt' 'python' 'python-gobject' 'python-watchdog' 'python-psutil')
 optdepends=('valkey: Cloud Sync / Cloud Drive real-time folder sync (redis-compatible server)'
             'libappindicator-gtk3: system tray icon'
             'nautilus: file manager integration'
@@ -48,6 +47,13 @@
 	# The Electron sandbox helper must be setuid root.
 	chmod 4755 "$pkgdir/opt/IDriveForLinux/chrome-sandbox"
 
+	# The Cloud Sync daemon reads this seed blob (JUNK_PATH in sync-daemon);
+	# only the upstream postinst writes it, so lay it down here verbatim.
+	install -d "$pkgdir/opt/IDriveForLinux/.config/cloud-drive"
+	printf '%s' 'aJF6Q4IP7IDO1moUhUHwVQ==:Y7B0vLir0nPK/saicnTvGldpsR8HoJWuc5/dVW0A0Xo=' \
+		> "$pkgdir/opt/IDriveForLinux/.config/cloud-drive/.junk.txt"
+	chmod 644 "$pkgdir/opt/IDriveForLinux/.config/cloud-drive/.junk.txt"
+
 	# Launcher on PATH (the .desktop already points at the absolute path).
 	install -d "$pkgdir/usr/bin"
 	ln -s /opt/IDriveForLinux/idriveforlinux "$pkgdir/usr/bin/idriveforlinux"

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 21:54:41	Medium	1
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2