letta-code-desktop-bin

maintainer That1Calculator · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads and executes an AppImage from a third-party hosting service (todesktop.com) without a verifiable upstream source, creating a supply-chain risk if the host is compromised.

Triggered rules

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:27 curl -Lo "$_filename" "https://download.todesktop.com/${_todesktop_id}/${_filename}"

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=("latest-linux.yml::https://download.todesktop.com/${_todesktop_id}/latest-linux.yml"

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads and executes an AppImage from a third-party hosting service (todesktop.com) without a verifiable upstream source, creating a supply-chain risk if the host is compromised.

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Kainoa Kanter <kainoa@t1c.dev>
    
      2pkgname=letta-code-desktop-bin
    
      3pkgver=0.28.12
    
      4pkgrel=1
    
      5pkgdesc="Letta lets you build agents that learn"
    
      6arch=('x86_64')
    
      7url="https://www.letta.com"
    
      8license=('custom')
    
      9depends=('electron')
    
      10makedepends=('npm')
    
      11options=('!strip')
    
      12_todesktop_id=260305dtu2nh5
    
      13source=("latest-linux.yml::https://download.todesktop.com/${_todesktop_id}/latest-linux.yml"
    
      14        'patch-safestorage.sh')
    
      15sha256sums=('e9d99980cb724ee81162f607a678c0685aa6dd3acaad32570956be404ca8ff20'
    
      16            'e1327529ac049a94d70c39ef5c1a2de21c5bb91e031b293cff73588ead7a8753')
    
      17
    
      18pkgver() {
    
      19    grep '^version:' latest-linux.yml | awk '{print $2}'
    
      20}
    
      21
    
      22prepare() {
    
      23    local _filename=$(grep '^path:' latest-linux.yml | awk '{print $2}')
    
      24    local _sha512=$(grep '^sha512:' latest-linux.yml | tail -1 | awk '{print $2}')
    
      25
    
      26    # Download the latest AppImage
    
      27    curl -Lo "$_filename" "https://download.todesktop.com/${_todesktop_id}/${_filename}"
    
      28
    
      29    # Verify integrity using the sha512 from latest-linux.yml
    
      30    local _actual=$(openssl dgst -sha512 -binary "$_filename" | base64 -w0)
    
      31    [[ "$_sha512" == "$_actual" ]] || { echo "SHA512 mismatch!"; return 1; }
    
      32
    
      33    chmod +x "$_filename"
    
      34    ./"$_filename" --appimage-extract
    
      35}
    
      36
    
      37build() {
    
      38    # Fix permissions; AppImage directories are 700 by default
    
      39    chmod -R a-x+rX squashfs-root/
    
      40
    
      41    # Patch safeStorage to fall back to plaintext on unsupported desktops
    
      42    bash "${srcdir}/patch-safestorage.sh" squashfs-root/resources/app.asar
    
      43}
    
      44
    
      45package() {
    
      46    install -dm755 "${pkgdir}/opt/${pkgname}"
    
      47    cp -dpr --no-preserve=ownership squashfs-root/resources "${pkgdir}/opt/${pkgname}/"
    
      48
    
      49    # Wrapper script
    
      50    install -Dm755 /dev/stdin "${pkgdir}/usr/bin/letta-code" <<EOF
    
      51#!/bin/sh
    
      52exec electron /opt/${pkgname}/resources/app.asar --no-sandbox "\$@"
    
      53EOF
    
      54
    
      55    # Desktop entry
    
      56    install -Dm644 squashfs-root/letta-code.desktop \
    
      57        "${pkgdir}/usr/share/applications/letta-code.desktop"
    
      58    sed -i "s|Exec=AppRun.*|Exec=/usr/bin/letta-code %U|g" \
    
      59        "${pkgdir}/usr/share/applications/letta-code.desktop"
    
      60
    
      61    # Icon
    
      62    install -Dm644 squashfs-root/letta-code.png \
    
      63        "${pkgdir}/usr/share/pixmaps/letta-code.png"
    
      64}
    
      65

Changes since previous scan

--- PKGBUILD @ 2026-07-21 00:24
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,6 +1,6 @@
 # Maintainer: Kainoa Kanter <kainoa@t1c.dev>
 pkgname=letta-code-desktop-bin
-pkgver=0.28.11
+pkgver=0.28.12
 pkgrel=1
 pkgdesc="Letta lets you build agents that learn"
 arch=('x86_64')
@@ -12,7 +12,7 @@
 _todesktop_id=260305dtu2nh5
 source=("latest-linux.yml::https://download.todesktop.com/${_todesktop_id}/latest-linux.yml"
         'patch-safestorage.sh')
-sha256sums=('5158a38f5e293590b622e964873e1338e81c49af1e4e5e2c41a77d8bf6cc1cca'
+sha256sums=('e9d99980cb724ee81162f607a678c0685aa6dd3acaad32570956be404ca8ff20'
             'e1327529ac049a94d70c39ef5c1a2de21c5bb91e031b293cff73588ead7a8753')
 
 pkgver() {

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	3
2026-08-02 00:16:08	MEDIUM	3
2026-08-01 00:11:18	MEDIUM	3
2026-07-31 00:14:10	MEDIUM	3
2026-07-30 00:17:23	MEDIUM	3
2026-07-29 00:25:53	MEDIUM	3
2026-07-28 00:07:28	MEDIUM	3
2026-07-27 00:24:32	MEDIUM	3
2026-07-26 00:07:32	MEDIUM	3
2026-07-25 00:13:44	MEDIUM	3
2026-07-24 00:02:28	MEDIUM	3
2026-07-23 00:14:47	MEDIUM	3
2026-07-22 00:29:32	MEDIUM	3
2026-07-21 17:17:32	MEDIUM	3
2026-07-21 00:24:15	MEDIUM	3
2026-07-20 23:15:21	MEDIUM	3
2026-07-20 00:19:49	MEDIUM	3
2026-07-19 00:17:08	MEDIUM	3
2026-07-18 00:14:48	MEDIUM	3
2026-07-17 00:06:16	MEDIUM	3