linear-bin

maintainer shrimpwtf · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD fetches a Python script (patch-main.py) from a personal GitHub repository (shrimpwtf/linear-arch) with 'SKIP' for its checksum, then executes it directly via 'python patch-main.py' during the build phase. This script has arbitrary code execution capability over the build environment and the app.asar being packaged. With no checksum pinning, any future change to that script (whether by the maintainer, a compromised account, or a GitHub-side substitution) would silently execute without detection. The Windows installer source is from the official releases.linear.app domain with a pinned sha512, which is fine. The core concern is the unpinned, executed Python script from a personal repo — a genuine supply-chain risk meeting the medium threshold.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source=("Linear-Setup-${pkgver}.exe::https://releases.linear.app/Linear%20Setup%20${pkgver}.exe"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 85%): The PKGBUILD fetches a Python script (patch-main.py) from a personal GitHub repository (shrimpwtf/linear-arch) with 'SKIP' for its checksum, then executes it directly via 'python patch-main.py' during the build phase. This script has arbitrary code execution capability over the build environment and the app.asar being packaged. With no checksum pinning, any future change to that script (whether by the maintainer, a compromised account, or a GitHub-side substitution) would silently execute without detection. The Windows installer source is from the official releases.linear.app domain with a pinned sha512, which is fine. The core concern is the unpinned, executed Python script from a personal repo — a genuine supply-chain risk meeting the medium threshold.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: shrimp
    
      2# Linear Desktop for Linux (unofficial)
    
      3
    
      4pkgname=linear-bin
    
      5pkgver=1.30.0
    
      6pkgrel=1
    
      7pkgdesc="Linear - Issue tracking & project management (unofficial Linux build)"
    
      8arch=('x86_64')
    
      9url="https://linear.app"
    
      10license=('LicenseRef-Proprietary')
    
      11depends=('electron')
    
      12makedepends=('p7zip' 'imagemagick' 'icoutils' 'python')
    
      13provides=('linear')
    
      14conflicts=('linear-desktop' 'linear-desktop-bin' 'linear-desktop-git')
    
      15_ghraw="https://raw.githubusercontent.com/shrimpwtf/linear-arch/main"
    
      16source=("Linear-Setup-${pkgver}.exe::https://releases.linear.app/Linear%20Setup%20${pkgver}.exe"
    
      17        "patch-main.py::${_ghraw}/patch-main.py")
    
      18sha512sums=('31d309720ce21c93dd8a5bce9735bdfc045781db27b1bbfb80ad0048e16bde22836353d6abf1797f6dbb0bf250f48afb354bab63bd804f25997022424985fb98'
    
      19            'SKIP')
    
      20
    
      21prepare() {
    
      22    cd "${srcdir}"
    
      23
    
      24    # Extract the NSIS installer
    
      25    7z x -y "Linear-Setup-${pkgver}.exe" -oextracted
    
      26
    
      27    # Linear's NSIS bundles BOTH x64 and arm64 archives. We're an x86_64 package.
    
      28    if [ -f "extracted/\$PLUGINSDIR/app-64.7z" ]; then
    
      29        7z x -y "extracted/\$PLUGINSDIR/app-64.7z" -oapp
    
      30    else
    
      31        echo "ERROR: app-64.7z not found in NSIS installer"
    
      32        exit 1
    
      33    fi
    
      34
    
      35    # Extract icon group from Linear.exe (single 256x256 entry as of v1.30.0)
    
      36    if [ -f "app/Linear.exe" ]; then
    
      37        wrestool -x -t 14 app/Linear.exe -o linear.ico 2>/dev/null || true
    
      38    fi
    
      39
    
      40    if [ -f "linear.ico" ]; then
    
      41        # Decompose ico → individual PNG sizes shipped inside the ico
    
      42        icotool -x linear.ico 2>/dev/null || true
    
      43
    
      44        # Linear ships only 256x256, so derive smaller sizes via imagemagick
    
      45        SRC_PNG=$(ls linear_*256x256*.png 2>/dev/null | head -1)
    
      46        mkdir -p icons/hicolor
    
      47
    
      48        for size in 16 24 32 48 64 128 256; do
    
      49            mkdir -p "icons/hicolor/${size}x${size}/apps"
    
      50            existing=$(ls linear_*"${size}x${size}"*.png 2>/dev/null | head -1)
    
      51            if [ -n "$existing" ]; then
    
      52                cp "$existing" "icons/hicolor/${size}x${size}/apps/linear.png"
    
      53            elif [ -n "$SRC_PNG" ]; then
    
      54                # Use ImageMagick 7's `magick` if available, fall back to legacy `convert`
    
      55                if command -v magick >/dev/null 2>&1; then
    
      56                    magick "$SRC_PNG" -resize "${size}x${size}" "icons/hicolor/${size}x${size}/apps/linear.png"
    
      57                else
    
      58                    convert "$SRC_PNG" -resize "${size}x${size}" "icons/hicolor/${size}x${size}/apps/linear.png"
    
      59                fi
    
      60            fi
    
      61        done
    
      62    fi
    
      63}
    
      64
    
      65_find_asar() {
    
      66    if [ -f "${srcdir}/app/resources/app.asar" ]; then
    
      67        echo "${srcdir}/app/resources"
    
      68    elif [ -f "${srcdir}/extracted/resources/app.asar" ]; then
    
      69        echo "${srcdir}/extracted/resources"
    
      70    else
    
      71        dirname "$(find "${srcdir}" -name 'app.asar' -type f | head -1)"
    
      72    fi
    
      73}
    
      74
    
      75build() {
    
      76    # Patch app.asar: stub the in-app auto-updater on Linux so AUR is the
    
      77    # sole source of updates (avoids 404 spam against latest-linux.yml,
    
      78    # which Linear doesn't host).
    
      79    ASAR_PATH="$(_find_asar)"
    
      80    if [ -z "$ASAR_PATH" ] || [ ! -f "$ASAR_PATH/app.asar" ]; then
    
      81        echo "ERROR: Could not find app.asar"
    
      82        exit 1
    
      83    fi
    
      84
    
      85    cd "$ASAR_PATH"
    
      86    python "${srcdir}/patch-main.py"
    
      87}
    
      88
    
      89package() {
    
      90    ASAR_PATH="$(_find_asar)"
    
      91    if [ -z "$ASAR_PATH" ] || [ ! -f "$ASAR_PATH/app.asar" ]; then
    
      92        echo "ERROR: Could not find app.asar"
    
      93        exit 1
    
      94    fi
    
      95
    
      96    # Install app payload
    
      97    install -d "${pkgdir}/usr/lib/${pkgname}"
    
      98    cp "$ASAR_PATH/app.asar" "${pkgdir}/usr/lib/${pkgname}/"
    
      99
    
      100    # Linear bundles native helper resources alongside the asar (e.g. app-update.yml)
    
      101    if [ -d "$ASAR_PATH/app.asar.unpacked" ]; then
    
      102        cp -r "$ASAR_PATH/app.asar.unpacked" "${pkgdir}/usr/lib/${pkgname}/"
    
      103    fi
    
      104
    
      105    # Install icons if we extracted them
    
      106    if [ -d "${srcdir}/icons/hicolor" ]; then
    
      107        install -d "${pkgdir}/usr/share/icons"
    
      108        cp -r "${srcdir}/icons/"* "${pkgdir}/usr/share/icons/"
    
      109    fi
    
      110
    
      111    # Desktop entry. linear:// MimeType registers the deep-link handler so
    
      112    # Cursor/Claude Code/etc can open issues directly in the desktop app.
    
      113    install -Dm644 /dev/stdin "${pkgdir}/usr/share/applications/${pkgname}.desktop" <<EOF
    
      114[Desktop Entry]
    
      115Name=Linear
    
      116GenericName=Issue Tracking
    
      117Comment=Linear desktop client
    
      118Exec=${pkgname} %u
    
      119Icon=linear
    
      120Type=Application
    
      121Terminal=false
    
      122Categories=Office;ProjectManagement;Development;
    
      123MimeType=x-scheme-handler/linear;
    
      124StartupWMClass=Linear
    
      125EOF
    
      126
    
      127    # Launcher: --class & --name pin Wayland/X11 window grouping to "Linear"
    
      128    # so StartupWMClass and the icon resolve correctly.
    
      129    install -Dm755 /dev/stdin "${pkgdir}/usr/bin/${pkgname}" <<EOF
    
      130#!/bin/sh
    
      131exec electron --class=Linear --name=Linear /usr/lib/${pkgname}/app.asar "\$@"
    
      132EOF
    
      133}
    
      134

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2