kraken-desktop-auto-bin

LOW

maintainer emilss 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads prebuilt binaries from the official Kraken domain (desktop-downloads.kraken.com), which is plausibly their own infrastructure; despite the non-whitelisted host, the source is verifiable via checksums and the worst case of a swapped binary would be code execution, but the origin is not inherently swappable like personal file hosts.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads prebuilt binaries from the official Kraken domain (desktop-downloads.kraken.com), which is plausibly their own infrastructure; despite the non-whitelisted host, the source is verifiable via checksums and the worst case of a swapped binary would be code execution, but the origin is not inherently swappable like personal file hosts.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source_x86_64=("${pkgname}-${pkgver}-x86_64.zip::https://desktop-downloads.kraken.com/latest/kraken-x86_64-unknown-linux-gnu.zip")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: sssemil <sssemil at github dot com>
    
      2# Contributor: Ergus <spacibba at aol dot com>
    
      3pkgname=kraken-desktop-auto-bin
    
      4pkgver=1.29.1
    
      5pkgrel=1
    
      6pkgdesc="Kraken crypto exchange desktop application"
    
      7arch=('aarch64' 'armv7' 'x86_64')
    
      8url="https://www.kraken.com/desktop"
    
      9license=('custom: commercial')
    
      10provides=('kraken_desktop')
    
      11conflicts=('kraken_desktop')
    
      12
    
      13source=('kraken.png')
    
      14
    
      15source_x86_64=("${pkgname}-${pkgver}-x86_64.zip::https://desktop-downloads.kraken.com/latest/kraken-x86_64-unknown-linux-gnu.zip")
    
      16source_armv7=("${pkgname}-${pkgver}-armv7.zip::https://desktop-downloads.kraken.com/latest/kraken-armv7-unknown-linux-gnueabihf.zip")
    
      17source_aarch64=("${pkgname}-${pkgver}-aarch64.zip::https://desktop-downloads.kraken.com/latest/kraken-aarch64-unknown-linux-gnu.zip")
    
      18sha256sums=('6fc49c5128736ffa958ded6d12f3a1fa819bce5b563e768d479ca01a67517148')
    
      19sha256sums_aarch64=('657c2260738fa80e8a2333bcaa20560d2edf98e8332c0fd4e13e348835c29958')
    
      20sha256sums_armv7=('aef7476ca8b1a2b73799c30c787d1f5e43972f9b2a34919b5a638c1986122934')
    
      21sha256sums_x86_64=('1a27c0c6081149bbc808e4ece64d64df19c7aae461ceefe430ff46f0b5b128db')
    
      22
    
      23
    
      24options=('!debug' '!lto' '!strip')
    
      25
    
      26package() {
    
      27
    
      28	install -d -m755 "${pkgdir}/usr/bin"
    
      29	install -d -m755 "${pkgdir}/usr/share/"{applications,icons}
    
      30
    
      31	install -Dm0755 -t "$pkgdir/usr/bin/" "kraken_desktop"
    
      32	install -Dm0644 -t "$pkgdir/usr/share/applications/" "kraken.desktop"
    
      33
    
      34	install -Dm0644 -t "$pkgdir/usr/share/icons/" "kraken.png"
    
      35}
    
      36

Changes since previous scan

--- PKGBUILD @ 2026-09-11 00:19
+++ PKGBUILD @ 2026-09-17 00:27
@@ -1,7 +1,7 @@
 # Maintainer: sssemil <sssemil at github dot com>
 # Contributor: Ergus <spacibba at aol dot com>
 pkgname=kraken-desktop-auto-bin
-pkgver=1.29.0
+pkgver=1.29.1
 pkgrel=1
 pkgdesc="Kraken crypto exchange desktop application"
 arch=('aarch64' 'armv7' 'x86_64')
@@ -16,9 +16,9 @@
 source_armv7=("${pkgname}-${pkgver}-armv7.zip::https://desktop-downloads.kraken.com/latest/kraken-armv7-unknown-linux-gnueabihf.zip")
 source_aarch64=("${pkgname}-${pkgver}-aarch64.zip::https://desktop-downloads.kraken.com/latest/kraken-aarch64-unknown-linux-gnu.zip")
 sha256sums=('6fc49c5128736ffa958ded6d12f3a1fa819bce5b563e768d479ca01a67517148')
-sha256sums_aarch64=('36440cd50e87faa1152aa4a7b8333612695a6488a6128ab28d766c5b13756b2a')
-sha256sums_armv7=('604b2663067facc6a972dad6a2f7abe029dbef93357410f190003bc651d74b8d')
-sha256sums_x86_64=('4fb77085d2c75fba90a5f9254e83f493d4058c6e8fc1db45c5b31d4f8eae5c7a')
+sha256sums_aarch64=('657c2260738fa80e8a2333bcaa20560d2edf98e8332c0fd4e13e348835c29958')
+sha256sums_armv7=('aef7476ca8b1a2b73799c30c787d1f5e43972f9b2a34919b5a638c1986122934')
+sha256sums_x86_64=('1a27c0c6081149bbc808e4ece64d64df19c7aae461ceefe430ff46f0b5b128db')
 
 
 options=('!debug' '!lto' '!strip')

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 03:21:42	Medium	1
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 03:18:52	Medium	1
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2