idrive-desktop-bin
LOW
maintainer andybarilla
1 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The package downloads an official .deb from the vendor's domain (idrivedownloads.com) which is plausibly part of IDrive's infrastructure; the source is not executed remotely and the payload is installed as-is, with no obfuscation or code modification, making this a standard repackaging pattern for AUR.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads an official .deb from the vendor's domain (idrivedownloads.com) which is plausibly part of IDrive's infrastructure; the source is not executed remotely and the payload is installed as-is, with no obfuscation or code modification, making this a standard repackaging pattern for AUR.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:29
source=("IDriveForLinux.deb::https://www.idrivedownloads.com/downloads/linux/linux-desktop/IDriveForLinux.deb")
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Andy <this.is.apb@gmail.com>
2
pkgname=idrive-desktop-bin
3
pkgver=1.11.0
4
pkgrel=1
5
pkgdesc="IDrive for Linux - official Electron desktop GUI for cloud backup, restore and sync"
6
arch=('x86_64')
7
url="https://www.idrive.com/online-backup-download"
8
license=('LicenseRef-IDrive')
9
# Translated from the .deb Depends. popt is needed by the idevsutil backup engine
10
# the app fetches on first run. gtk3/libnotify/etc. are pulled via the GUI libs.
11
# valkey is NOT here: redis is used only by the Cloud Sync daemon (sync-daemon,
12
# pkg "clouddrive"), so backup/restore and the GUI work without it -> optdepend.
13
depends=('nss' 'curl' 'sqlite' 'cronie' 'glib2' 'gtk3' 'xdotool' 'rsync' 'attr'
14
'popt' 'python' 'python-gobject' 'python-watchdog' 'python-psutil')
15
optdepends=('valkey: Cloud Sync / Cloud Drive real-time folder sync (redis-compatible server)'
16
'libappindicator-gtk3: system tray icon'
17
'nautilus: file manager integration'
18
'nautilus-python: cloud-sync overlay icons in Nautilus'
19
'nemo-python: cloud-sync overlay icons in Nemo'
20
'python-caja: cloud-sync overlay icons in Caja')
21
# Bundles the same /opt/IDriveForLinux backup engine as idrive-bin; only one of
22
# the two can manage that tree.
23
provides=('idrive')
24
conflicts=('idrive' 'idrive-bin')
25
options=('!strip')
26
install="$pkgname.install"
27
# Upstream serves a single, unversioned "latest" .deb, so the checksum cannot be
28
# pinned; pkgver() reads the real version from the deb's control file.
29
source=("IDriveForLinux.deb::https://www.idrivedownloads.com/downloads/linux/linux-desktop/IDriveForLinux.deb")
30
sha256sums=('SKIP')
31
32
pkgver() {
33
cd "$srcdir"
34
# deb is an ar archive; pull the control member and read its Version field.
35
bsdtar -xOf IDriveForLinux.deb control.tar.gz | bsdtar -xOf - \
36
| grep -m1 '^Version:' | awk '{print $2}'
37
}
38
39
package() {
40
cd "$srcdir"
41
42
# Unpack the deb (ar: debian-binary, control.tar.gz, data.tar.xz), then lay
43
# its payload (opt/ + usr/share) straight into the package.
44
bsdtar -xf IDriveForLinux.deb
45
bsdtar -xf data.tar.xz -C "$pkgdir"
46
47
# The Electron sandbox helper must be setuid root.
48
chmod 4755 "$pkgdir/opt/IDriveForLinux/chrome-sandbox"
49
50
# The Cloud Sync daemon reads this seed blob (JUNK_PATH in sync-daemon);
51
# only the upstream postinst writes it, so lay it down here verbatim.
52
install -d "$pkgdir/opt/IDriveForLinux/.config/cloud-drive"
53
printf '%s' 'aJF6Q4IP7IDO1moUhUHwVQ==:Y7B0vLir0nPK/saicnTvGldpsR8HoJWuc5/dVW0A0Xo=' \
54
> "$pkgdir/opt/IDriveForLinux/.config/cloud-drive/.junk.txt"
55
chmod 644 "$pkgdir/opt/IDriveForLinux/.config/cloud-drive/.junk.txt"
56
57
# Launcher on PATH (the .desktop already points at the absolute path).
58
install -d "$pkgdir/usr/bin"
59
ln -s /opt/IDriveForLinux/idriveforlinux "$pkgdir/usr/bin/idriveforlinux"
60
61
# License: pointer to the canonical terms plus the bundled Electron license.
62
install -d "$pkgdir/usr/share/licenses/$pkgname"
63
cat > "$pkgdir/usr/share/licenses/$pkgname/LICENSE" <<-'EOF'
64
IDrive for Linux is proprietary software, Copyright IDrive Inc.
65
66
Use is governed by the IDrive Terms of Service:
67
https://www.idrive.com/terms-and-conditions
68
69
This package redistributes the unmodified official .deb payload from
70
https://www.idrive.com/online-backup-download for convenience.
71
EOF
72
install -m644 "$pkgdir/opt/IDriveForLinux/LICENSE.electron.txt" \
73
"$pkgdir/usr/share/licenses/$pkgname/LICENSE.electron.txt"
74
}
75
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 00:13:55 | Low | 2 |
| 2026-10-28 00:06:54 | Low | 2 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |
| 2026-10-14 00:06:47 | Low | 2 |
| 2026-10-13 00:23:45 | Low | 2 |