◎ AURWatch - AUR Security Monitor
scan coverage …
Last scan …
Next scan -

ipfs-desktop

maintainer RubenKelevra · 21 votes · scanned 2026-08-18 00:03:42.021799
LOW
View on AUR ↗
Why flagged The package downloads a WebUI asset from a trustless gateway, but this is a static data file (CAR format) used by IPFS, not executable code, and the checksum is verified, making the risk low despite the non-standard host.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 90%): The package downloads a WebUI asset from a trustless gateway, but this is a static data file (CAR format) used by IPFS, not executable code, and the checksum is verified, making the risk low despite the non-standard host.

1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:25 "webui-${_webui_cid}.car::https://trustless-gateway.link/ipfs/${_webui_cid}?format=car"

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: @RubenKelevra <rubenkelevra@gmail.com>
2# Contributor: Alex Henrie <alexhenrie24@gmail.com>
3
4_electron_pkg='electron43'
5_webui_cid='bafybeiciqeyipumpmhxzlxnbqdbbv6u5uij4hy4wax64dmj7kvrhusiq6y'
6
7pkgname='ipfs-desktop'
8pkgver='0.50.0'
9pkgrel=1
10epoch=1
11pkgdesc='Desktop client for the InterPlanetary File System'
12arch=('x86_64')
13url="https://github.com/ipfs/${pkgname}"
14license=('MIT')
15depends=(
16 "${_electron_pkg}"
17 'kubo>=0.43.0'
18)
19makedepends=(
20 'nodejs'
21 'npm'
22)
23source=(
24 "${pkgname}-${pkgver}.tar.gz::${url}/archive/refs/tags/v${pkgver}.tar.gz"
25 "webui-${_webui_cid}.car::https://trustless-gateway.link/ipfs/${_webui_cid}?format=car"
26 "${pkgname}.desktop"
27 "${pkgname}-startup.sh"
28 "${pkgname}-system-kubo-autostart.patch"
29)
30b2sums=(
31 'c5691c946de525abb185fa44ea66ff9c5fa15b936d3dd6e7d0c3a6da8b158e4b8c883b1d948c33e7333bf5e7def1fc6677c4c721a67956db56e817260db36cff'
32 '49e1e7d4d55325d4ea05561a4ff4c64537988e5e841231a95d59328fc9f9b60f3098185bf757b70c42d2175f8a2b6394a0f2a9377df7d1603d69edbd4c3655ec'
33 '849d57fd59653ed0c6eca01769ad12a01f37f6a5316f1a83c0bf7cae576074b978e3ca555d50a56114d177e5fe4817338106698716f054a3e18ae1c81d7a8785'
34 '353367dc9c554b8decbee724713faf627e4764f77c1522d3939069e5db4e6caffc847e20e75afccdee0e1d0e025c4bb6c16a80e9655bf8d76412dc37ef8eff64'
35 '5e6b97ee8aec2cbf4e125ae2ced3f23dd77c45b7291ea63f8ed7f5cee1eb7caaab27dad979f61deefe204539389b0c18d418fc6724cec58eddcea944a46d936e'
36)
37
38_pkgsrc="${pkgname}-${pkgver}"
39
40_electron_env() {
41 local _version_file="/usr/lib/${_electron_pkg}/version"
42
43 [[ -r "${_version_file}" ]] || {
44 printf 'Missing Electron version file: %s\n' "${_version_file}" >&2
45 return 1
46 }
47
48 SYSTEM_ELECTRON_VERSION=$(<"${_version_file}")
49 [[ -n "${SYSTEM_ELECTRON_VERSION}" ]] || {
50 printf 'Electron version file is empty: %s\n' "${_version_file}" >&2
51 return 1
52 }
53
54 export SYSTEM_ELECTRON_VERSION
55}
56
57_warn_if_electron_outdated() {
58 local _installed _latest_local _vf _v
59
60 [[ -r "/usr/lib/${_electron_pkg}/version" ]] || return 0
61 _installed=$(< "/usr/lib/${_electron_pkg}/version")
62 _latest_local=$_installed
63
64 shopt -s nullglob
65 for _vf in /usr/lib/electron*/version; do
66 _v=$(< "$_vf")
67 if [[ "$(printf '%s\n%s\n' "$_latest_local" "$_v" | sort -V | tail -n1)" != "$_latest_local" ]]; then
68 _latest_local=$_v
69 fi
70 done
71 shopt -u nullglob
72
73 if [[ $_installed != "$_latest_local" ]]; then
74 echo "==> WARNING: Packaging uses not the latest major version of electron installed. ${_electron_pkg} ${_installed} is used, but a newer local Electron version (${_latest_local}) is available on the system." >&2
75 fi
76}
77
78prepare() (
79 local _car_path
80 local _expected_webui_cid
81 local _ipfs_path
82 local _kubo_version
83 local _webui_path="${srcdir}/webui-${_webui_cid}"
84
85 cd -- "${_pkgsrc}" || return 1
86 patch -Np1 -i "${srcdir}/${pkgname}-system-kubo-autostart.patch"
87
88 _expected_webui_cid=$(
89 sed -nE \
90 '/"build:webui:download"/s/.*[[:space:]]-c[[:space:]]+([^[:space:]\"]+).*/\1/p' \
91 package.json
92 )
93 [[ -n "${_expected_webui_cid}" ]] || {
94 printf '%s\n' 'Unable to determine the WebUI CID expected by upstream' >&2
95 return 1
96 }
97 [[ "${_webui_cid}" == "${_expected_webui_cid}" ]] || {
98 printf 'WebUI CID mismatch: PKGBUILD has %s, upstream expects %s\n' \
99 "${_webui_cid}" "${_expected_webui_cid}" >&2
100 printf 'Update _webui_cid and its source checksum before building.\n' >&2
101 return 1
102 }
103
104 _ipfs_path=$(mktemp -d --tmpdir "${pkgname}-kubo.XXXXXXXX") || return 1
105 trap 'rm -rf -- "${_ipfs_path}"' EXIT
106
107 _car_path=$(readlink -f -- "${srcdir}/webui-${_webui_cid}.car")
108 [[ -f "${_car_path}" ]] || {
109 printf 'WebUI CAR is missing: %s\n' "${_car_path}" >&2
110 return 1
111 }
112
113 IPFS_PATH="${_ipfs_path}" ipfs init --profile=server >/dev/null
114 IPFS_PATH="${_ipfs_path}" ipfs dag import "${_car_path}" >/dev/null
115
116 rm -rf -- "${_webui_path}"
117 IPFS_PATH="${_ipfs_path}" ipfs get "/ipfs/${_webui_cid}" -o "${_webui_path}"
118 [[ -f "${_webui_path}/index.html" ]] || {
119 printf 'Materialized WebUI is missing index.html: %s\n' "${_webui_path}" >&2
120 return 1
121 }
122
123 _kubo_version=$(sed -nE 's/^[[:space:]]*"kubo":[[:space:]]*"([^"]+)".*/\1/p' package.json)
124 [[ -n "${_kubo_version}" ]] || {
125 printf '%s\n' 'Unable to determine the bundled Kubo version' >&2
126 return 1
127 }
128
129 npm pkg set "allowScripts[kubo@${_kubo_version}]=false" --json
130 npm ci --no-audit --no-fund \
131 2> >(sed '/glob@11\.1\.0: Old versions of glob are not supported/d' >&2)
132
133 [[ ! -e node_modules/kubo/kubo/ipfs ]] || {
134 printf '%s\n' 'Unexpected bundled Kubo binary found after npm install' >&2
135 return 1
136 }
137)
138
139build() {
140 local -a _builder_options
141
142 _warn_if_electron_outdated
143 _electron_env
144 cd -- "${_pkgsrc}" || return 1
145
146 IPFS_WEBUI_PATH="${srcdir}/webui-${_webui_cid}" \
147 npm_config_offline=true npm run build
148
149 _builder_options=(
150 "-c.electronDist=/usr/lib/${_electron_pkg}"
151 "-c.electronVersion=${SYSTEM_ELECTRON_VERSION}"
152 )
153 npm_config_offline=true npm exec -- electron-builder --linux --dir --publish never \
154 "${_builder_options[@]}"
155}
156
157package() {
158 mkdir -p -- "${pkgdir}/usr/lib/${pkgname}"
159 cp -a -- "${_pkgsrc}/dist/linux-unpacked/resources/." "${pkgdir}/usr/lib/${pkgname}/"
160
161 install -Dm644 -- "${_pkgsrc}/assets/webui/ipfs-logo-512-ice.png" \
162 "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
163 install -Dm644 -- "${_pkgsrc}/LICENSE" \
164 "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
165
166 sed "s|@ELECTRON_PKG@|${_electron_pkg}|" \
167 "${srcdir}/${pkgname}-startup.sh" \
168 | install -Dm755 /dev/stdin "${pkgdir}/usr/bin/${pkgname}"
169 install -Dm644 -- "${srcdir}/${pkgname}.desktop" \
170 "${pkgdir}/usr/share/applications/${pkgname}.desktop"
171
172 chmod -R u+rwX,go+rX,go-w -- "${pkgdir}"
173}
174

Changes since previous scan

--- PKGBUILD @ 2026-07-30 15:15
+++ PKGBUILD @ 2026-08-18 00:03
@@ -1,38 +1,57 @@
-# Maintainer: @RubenKelevra
+# Maintainer: @RubenKelevra <rubenkelevra@gmail.com>
# Contributor: Alex Henrie <alexhenrie24@gmail.com>
-_electron_pkg=electron41
+_electron_pkg='electron43'
+_webui_cid='bafybeiciqeyipumpmhxzlxnbqdbbv6u5uij4hy4wax64dmj7kvrhusiq6y'
-_archive_extension="tar.gz"
-
-pkgname=ipfs-desktop
-pkgver=0.49.1
+pkgname='ipfs-desktop'
+pkgver='0.50.0'
pkgrel=1
epoch=1
-pkgdesc="Desktop client for the InterPlanetary File System"
-arch=(x86_64)
-url="https://github.com/ipfs/$pkgname"
-license=(MIT)
+pkgdesc='Desktop client for the InterPlanetary File System'
+arch=('x86_64')
+url="https://github.com/ipfs/${pkgname}"
+license=('MIT')
depends=(
- "$_electron_pkg"
+ "${_electron_pkg}"
+ 'kubo>=0.43.0'
)
makedepends=(
- nodejs
- npm
+ 'nodejs'
+ 'npm'
+)
+source=(
+ "${pkgname}-${pkgver}.tar.gz::${url}/archive/refs/tags/v${pkgver}.tar.gz"
+ "webui-${_webui_cid}.car::https://trustless-gateway.link/ipfs/${_webui_cid}?format=car"
+ "${pkgname}.desktop"
+ "${pkgname}-startup.sh"
+ "${pkgname}-system-kubo-autostart.patch"
+)
+b2sums=(
+ 'c5691c946de525abb185fa44ea66ff9c5fa15b936d3dd6e7d0c3a6da8b158e4b8c883b1d948c33e7333bf5e7def1fc6677c4c721a67956db56e817260db36cff'
+ '49e1e7d4d55325d4ea05561a4ff4c64537988e5e841231a95d59328fc9f9b60f3098185bf757b70c42d2175f8a2b6394a0f2a9377df7d1603d69edbd4c3655ec'
+ '849d57fd59653ed0c6eca01769ad12a01f37f6a5316f1a83c0bf7cae576074b978e3ca555d50a56114d177e5fe4817338106698716f054a3e18ae1c81d7a8785'
+ '353367dc9c554b8decbee724713faf627e4764f77c1522d3939069e5db4e6caffc847e20e75afccdee0e1d0e025c4bb6c16a80e9655bf8d76412dc37ef8eff64'
+ '5e6b97ee8aec2cbf4e125ae2ced3f23dd77c45b7291ea63f8ed7f5cee1eb7caaab27dad979f61deefe204539389b0c18d418fc6724cec58eddcea944a46d936e'
)
-source=(
- "$pkgname-$pkgver.$_archive_extension::$url/archive/refs/tags/v$pkgver.$_archive_extension"
- "$pkgname.desktop"
- "$pkgname-startup.sh"
-)
-b2sums=('643e89643b68508373938df8eb1d086311d9f1a3964ecbc1b422a87438fc9e8e45f0a0ffede4b97b16652b06130a731a8cc51a13ef9e06704a1e210ea1f29f0f'
- '849d57fd59653ed0c6eca01769ad12a01f37f6a5316f1a83c0bf7cae576074b978e3ca555d50a56114d177e5fe4817338106698716f054a3e18ae1c81d7a8785'
- '6f603c79a83057d4f4077a859656dbce513be3aa0ab9993dc5b994929e6e26f2f8f58ecd030ea415c44f2d0fbc7dd0cc16526172613555b0f619c530ee7d583d')
-_pkgsrc="$pkgname-$pkgver"
+_pkgsrc="${pkgname}-${pkgver}"
_electron_env() {
- export SYSTEM_ELECTRON_VERSION=$(< "/usr/lib/${_electron_pkg}/version")
+ local _version_file="/usr/lib/${_electron_pkg}/version"
+
+ [[ -r "${_version_file}" ]] || {
+ printf 'Missing Electron version file: %s\n' "${_version_file}" >&2
+ return 1
+ }
+
+ SYSTEM_ELECTRON_VERSION=$(<"${_version_file}")
+ [[ -n "${SYSTEM_ELECTRON_VERSION}" ]] || {
+ printf 'Electron version file is empty: %s\n' "${_version_file}" >&2
+ return 1
+ }
+
+ export SYSTEM_ELECTRON_VERSION
}
_warn_if_electron_outdated() {
@@ -56,46 +75,100 @@
fi
}
+prepare() (
+ local _car_path
+ local _expected_webui_cid
+ local _ipfs_path
+ local _kubo_version
+ local _webui_path="${srcdir}/webui-${_webui_cid}"
+
+ cd -- "${_pkgsrc}" || return 1
+ patch -Np1 -i "${srcdir}/${pkgname}-system-kubo-autostart.patch"
+
+ _expected_webui_cid=$(
+ sed -nE \
+ '/"build:webui:download"/s/.*[[:space:]]-c[[:space:]]+([^[:space:]\"]+).*/\1/p' \
+ package.json
+ )
+ [[ -n "${_expected_webui_cid}" ]] || {
+ printf '%s\n' 'Unable to determine the WebUI CID expected by upstream' >&2
+ return 1
+ }
+ [[ "${_webui_cid}" == "${_expected_webui_cid}" ]] || {
+ printf 'WebUI CID mismatch: PKGBUILD has %s, upstream expects %s\n' \
+ "${_webui_cid}" "${_expected_webui_cid}" >&2
+ printf 'Update _webui_cid and its source checksum before building.\n' >&2
+ return 1
+ }
+
+ _ipfs_path=$(mktemp -d --tmpdir "${pkgname}-kubo.XXXXXXXX") || return 1
+ trap 'rm -rf -- "${_ipfs_path}"' EXIT
+
+ _car_path=$(readlink -f -- "${srcdir}/webui-${_webui_cid}.car")
+ [[ -f "${_car_path}" ]] || {
+ printf 'WebUI CAR is missing: %s\n' "${_car_path}" >&2
+ return 1
+ }
+
+ IPFS_PATH="${_ipfs_path}" ipfs init --profile=server >/dev/null
+ IPFS_PATH="${_ipfs_path}" ipfs dag import "${_car_path}" >/dev/null
+
+ rm -rf -- "${_webui_path}"
+ IPFS_PATH="${_ipfs_path}" ipfs get "/ipfs/${_webui_cid}" -o "${_webui_path}"
+ [[ -f "${_webui_path}/index.html" ]] || {
+ printf 'Materialized WebUI is missing index.html: %s\n' "${_webui_path}" >&2
+ return 1
+ }
+
+ _kubo_version=$(sed -nE 's/^[[:space:]]*"kubo":[[:space:]]*"([^"]+)".*/\1/p' package.json)
+ [[ -n "${_kubo_version}" ]] || {
+ printf '%s\n' 'Unable to determine the bundled Kubo version' >&2
+ return 1
+ }
+
+ npm pkg set "allowScripts[kubo@${_kubo_version}]=false" --json
+ npm ci --no-audit --no-fund \
+ 2> >(sed '/glob@11\.1\.0: Old versions of glob are not supported/d' >&2)
+
+ [[ ! -e node_modules/kubo/kubo/ipfs ]] || {
+ printf '%s\n' 'Unexpected bundled Kubo binary found after npm install' >&2
+ return 1
+ }
+)
+
build() {
+ local -a _builder_options
+
_warn_if_electron_outdated
_electron_env
+ cd -- "${_pkgsrc}" || return 1
- local _builder_options=(
+ IPFS_WEBUI_PATH="${srcdir}/webui-${_webui_cid}" \
+ npm_config_offline=true npm run build
+
+ _builder_options=(
"-c.electronDist=/usr/lib/${_electron_pkg}"
"-c.electronVersion=${SYSTEM_ELECTRON_VERSION}"
)
-
- cd "$_pkgsrc"
- npm ci --no-audit --no-fund \
- 2> >(sed '/glob@11\.1\.0: Old versions of glob are not supported/d' >&2)
- npm run build
- npm exec -- electron-builder --linux --dir --publish never "${_builder_options[@]}"
+ npm_config_offline=true npm exec -- electron-builder --linux --dir --publish never \
+ "${_builder_options[@]}"
}
package() {
- _electron_env
+ mkdir -p -- "${pkgdir}/usr/lib/${pkgname}"
+ cp -a -- "${_pkgsrc}/dist/linux-unpacked/resources/." "${pkgdir}/usr/lib/${pkgname}/"
- depends=("$_electron_pkg")
+ install -Dm644 -- "${_pkgsrc}/assets/webui/ipfs-logo-512-ice.png" \
+ "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
+ install -Dm644 -- "${_pkgsrc}/LICENSE" \
+ "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
- mkdir -pm755 "$pkgdir/usr/lib/$pkgname"
- cp -a "$_pkgsrc/dist/linux-unpacked/resources"/* -t "$pkgdir/usr/lib/$pkgname/"
- rm -f \
- "$pkgdir/usr/lib/$pkgname/app.asar.unpacked/node_modules/kubo/tsconfig.json"
- rm -f \
- "$pkgdir/usr/lib/$pkgname/app.asar.unpacked/node_modules/kubo/LICENSE" \
- "$pkgdir/usr/lib/$pkgname/app.asar.unpacked/node_modules/kubo/kubo/README.md" \
- "$pkgdir/usr/lib/$pkgname/app.asar.unpacked/node_modules/kubo/kubo/build-log" \
- "$pkgdir/usr/lib/$pkgname/app.asar.unpacked/node_modules/kubo/kubo/install.sh" \
- "$pkgdir/usr/lib/$pkgname/app.asar.unpacked/node_modules/kubo/kubo/LICENSE" \
- "$pkgdir/usr/lib/$pkgname/app.asar.unpacked/node_modules/kubo/kubo/LICENSE-APACHE" \
- "$pkgdir/usr/lib/$pkgname/app.asar.unpacked/node_modules/kubo/kubo/LICENSE-MIT"
+ sed "s|@ELECTRON_PKG@|${_electron_pkg}|" \
+ "${srcdir}/${pkgname}-startup.sh" \
+ | install -Dm755 /dev/stdin "${pkgdir}/usr/bin/${pkgname}"
+ install -Dm644 -- "${srcdir}/${pkgname}.desktop" \
+ "${pkgdir}/usr/share/applications/${pkgname}.desktop"
- install -Dm644 "$_pkgsrc/assets/webui/ipfs-logo-512-ice.png" "$pkgdir/usr/share/pixmaps/$pkgname.png"
- install -Dm644 "$_pkgsrc/LICENSE" -t "$pkgdir/usr/share/licenses/$pkgname"
-
- install -Dm755 "$srcdir/ipfs-desktop-startup.sh" "$pkgdir/usr/bin/$pkgname"
- install -Dm644 "$srcdir/ipfs-desktop.desktop" "$pkgdir/usr/share/applications/$pkgname.desktop"
-
- chmod -R u+rwX,go+rX,go-w "$pkgdir/"
+ chmod -R u+rwX,go+rX,go-w -- "${pkgdir}"
}

Scan history

Scanned at (UTC)SeverityRules
2026-08-18 00:03:42 LOW 2
2026-08-17 00:18:29 LOW 2
2026-08-16 00:03:42 LOW 2
2026-08-15 00:26:13 LOW 2
2026-08-14 00:03:41 LOW 2
2026-08-13 00:17:07 LOW 2
2026-08-12 00:27:08 LOW 2
2026-08-11 13:21:13 MEDIUM 1
2026-07-30 15:15:12 CLEAN 0
2026-07-30 13:14:23 CLEAN 0
2026-06-18 16:11:54 CLEAN 0

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion