mailspring

maintainer xiota · 4 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package builds Mailspring from its official GitHub repository, uses system-provided Electron, and does not execute untrusted remote code; the orphaned/re-adopted status is a metadata concern, not a security risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds Mailspring from its official GitHub repository, uses system-provided Electron, and does not execute untrusted remote code; the orphaned/re-adopted status is a metadata concern, not a security risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

PKGBUILD

      1# Maintainer: aur.chaotic.cx
    
      2# Contributor: Fabio 'Lolix' Loli <fabio.loli@disroot.org>
    
      3# Contributor: Eric S. Londres <ericlondres@protonmail.com>
    
      4# Contributor: Mandeep Sangwan <mandeep@sangwan.me>
    
      5# Contributor: Joakim Nylén <me@jnylen.nu>
    
      6# Contributor: Rashintha Maduneth <rashinthamaduneth@gmail.com>
    
      7# Contributor: Dhananjay Balan <mail@dbalan.in>
    
      8
    
      9: ${_install_path:=usr/lib}
    
      10
    
      11_pkgname="mailspring"
    
      12pkgname="$_pkgname"
    
      13pkgver=1.23.0
    
      14pkgrel=1
    
      15pkgdesc="A beautiful and fast mail client"
    
      16url="https://github.com/Foundry376/Mailspring"
    
      17license=('GPL-3.0-only')
    
      18arch=('x86_64')
    
      19
    
      20depends=(
    
      21  'db5.3'
    
      22  'gnome-keyring'
    
      23)
    
      24makedepends=(
    
      25  'git'
    
      26  'nvm'
    
      27  'python'
    
      28  'patchelf'
    
      29)
    
      30
    
      31_pkgsrc="$_pkgname"
    
      32source=("$_pkgname"::"git+$url.git#tag=$pkgver")
    
      33sha256sums=('d10372d596a37bfd587a3db5c28d2c263266f195e10c994ddd0f4cb4f00ed0b0')
    
      34
    
      35_nvm_env() {
    
      36  [ -n "$NVM_DIR" ] && return
    
      37  export NVM_DIR="$SRCDEST/node-nvm"
    
      38
    
      39  # set up nvm
    
      40  source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
    
      41  nvm install node
    
      42  nvm use node
    
      43}
    
      44
    
      45_electron_env() {
    
      46  [ -n "$ELECTRON_SKIP_BINARY_DOWNLOAD" ] && return
    
      47  export ELECTRON_SKIP_BINARY_DOWNLOAD=1
    
      48
    
      49  local _electron_version=$(grep -Pom1 '^\s*"electron":\s*"\K[0-9.]+' "$srcdir/$_pkgsrc/package.json")
    
      50  : ${_electron_version:?}
    
      51
    
      52  export SYSTEM_ELECTRON_VERSION=$(LC_ALL=C pacman -Si "electron${_electron_version%%.*}" | grep -Pom1 '^Version\s+:\s+\K\S+(?=-[0-9])')
    
      53  : ${SYSTEM_ELECTRON_VERSION:?}
    
      54
    
      55  export ELECTRON_VERSION=$(sed -E 's&\..*&&' <<< "${SYSTEM_ELECTRON_VERSION%%.*}")
    
      56  : ${ELECTRON_VERSION:?}
    
      57}
    
      58
    
      59prepare() {
    
      60  _electron_env
    
      61
    
      62  cd "$_pkgsrc"
    
      63
    
      64  # set electron version
    
      65  sed -E \
    
      66    -e 's&^(\s*)("electron"): "(.*)"(,?)$&\1\2: "'"$SYSTEM_ELECTRON_VERSION"'"\4&' \
    
      67    -i "package.json" "app/package.json"
    
      68
    
      69  # allow any npm version
    
      70  sed -E \
    
      71    -e 's&^(\s*)"(node|npm)": "(.*)"(,?)$&\1"\2": ">=1.0.0"\4&' \
    
      72    -i "package.json"
    
      73
    
      74  # don't try to create deb or rpm
    
      75  sed -E -e "/await (createRpmInstaller|createDebInstaller)/d" -i app/build/build.js
    
      76}
    
      77
    
      78build() (
    
      79  _nvm_env
    
      80  _electron_env
    
      81
    
      82  cd "$_pkgsrc"
    
      83  npm install --no-audit --no-fund
    
      84  npm run-script build
    
      85)
    
      86
    
      87package() {
    
      88  _electron_env
    
      89  depends+=("electron${ELECTRON_VERSION:-}")
    
      90
    
      91  cd "$_pkgsrc"
    
      92
    
      93  # resources
    
      94  mkdir -pm755 "${pkgdir}/$_install_path/$_pkgname"
    
      95  cp -r app/dist/mailspring-linux-x64/resources/* "$pkgdir/$_install_path/$_pkgname/"
    
      96
    
      97  # fix rpath
    
      98  patchelf --set-rpath '$ORIGIN' "$pkgdir/$_install_path/$_pkgname/app.asar.unpacked/mailsync.bin"
    
      99
    
      100  # icon
    
      101  install -Dm0644 "app/build/resources/linux/icons/512.png" "$pkgdir/usr/share/icons/hicolor/512x512/apps/$_pkgname.png"
    
      102
    
      103  # launcher
    
      104  install -Dm644 /dev/stdin "$pkgdir/usr/share/applications/$_pkgname.desktop" << END
    
      105$(
    
      106    sed -E \
    
      107      -e 's&<%= productName %>&'"${_pkgname^}"'&' \
    
      108      -e 's&<%= description %>&'"${pkgdesc}"'&' \
    
      109      "app/build/resources/linux/Mailspring.desktop.in"
    
      110  )
    
      111END
    
      112
    
      113  # metainfo
    
      114  install -Dm644 /dev/stdin "$pkgdir/usr/share/metainfo/$_pkgname.appdata.xml" << END
    
      115$(sed -E -e 's&<%= productName %>&Mailspring&g' "app/build/resources/linux/mailspring.appdata.xml.in")
    
      116END
    
      117
    
      118  # script
    
      119  install -Dm755 /dev/stdin "$pkgdir/usr/bin/$_pkgname" << END
    
      120#!/usr/bin/env bash
    
      121
    
      122set -euo pipefail
    
      123
    
      124name=$_pkgname
    
      125flags_file="\${XDG_CONFIG_HOME:-\$HOME/.config}/\${name}-flags.conf"
    
      126
    
      127lines=()
    
      128if [[ -f "\${flags_file}" ]]; then
    
      129  mapfile -t lines < "\${flags_file}"
    
      130fi
    
      131
    
      132flags=()
    
      133for line in "\${lines[@]}"; do
    
      134  if [[ ! "\${line}" =~ ^[[:space:]]*#.* ]] && [[ -n "\${line}" ]]; then
    
      135    flags+=("\${line}")
    
      136  fi
    
      137done
    
      138
    
      139: \${ELECTRON_IS_DEV:=0}
    
      140export ELECTRON_IS_DEV
    
      141: \${ELECTRON_FORCE_IS_PACKAGED:=true}
    
      142export ELECTRON_FORCE_IS_PACKAGED
    
      143
    
      144exec electron${ELECTRON_VERSION:-} "\${flags[@]}" "/$_install_path/$_pkgname/app.asar" --password-store="gnome-libsecret" "\$@"
    
      145END
    
      146}
    
      147

Changes since previous scan

--- PKGBUILD @ 2026-07-25 00:13
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,64 +1,147 @@
-# Maintainer: Fabio 'Lolix' Loli <fabio.loli@disroot.org> -> https://github.com/FabioLolix
+# Maintainer: aur.chaotic.cx
+# Contributor: Fabio 'Lolix' Loli <fabio.loli@disroot.org>
 # Contributor: Eric S. Londres <ericlondres@protonmail.com>
 # Contributor: Mandeep Sangwan <mandeep@sangwan.me>
 # Contributor: Joakim Nylén <me@jnylen.nu>
 # Contributor: Rashintha Maduneth <rashinthamaduneth@gmail.com>
 # Contributor: Dhananjay Balan <mail@dbalan.in>
-# Contributor: ahrs
 
-pkgname=mailspring
-pkgver=1.21.0
+: ${_install_path:=usr/lib}
+
+_pkgname="mailspring"
+pkgname="$_pkgname"
+pkgver=1.23.0
 pkgrel=1
-pkgdesc="A beautiful, fast and maintained fork of Nylas Mail by one of the original authors."
-arch=(x86_64)
-license=(GPL-3.0-only)
+pkgdesc="A beautiful and fast mail client"
 url="https://github.com/Foundry376/Mailspring"
-depends=(alsa-lib gtk3 nss glibc)
-makedepends=(git npm nodejs-lts-iron grunt-cli python chrpath)
-source=("git+https://github.com/Foundry376/Mailspring.git#tag=${pkgver}")
-sha256sums=('a87a1d336d55388bcb541de266b0d780242cb31fbdc8289af987362179cd4c36')
+license=('GPL-3.0-only')
+arch=('x86_64')
+
+depends=(
+  'db5.3'
+  'gnome-keyring'
+)
+makedepends=(
+  'git'
+  'nvm'
+  'python'
+  'patchelf'
+)
+
+_pkgsrc="$_pkgname"
+source=("$_pkgname"::"git+$url.git#tag=$pkgver")
+sha256sums=('d10372d596a37bfd587a3db5c28d2c263266f195e10c994ddd0f4cb4f00ed0b0')
+
+_nvm_env() {
+  [ -n "$NVM_DIR" ] && return
+  export NVM_DIR="$SRCDEST/node-nvm"
+
+  # set up nvm
+  source /usr/share/nvm/init-nvm.sh || [[ $? != 1 ]]
+  nvm install node
+  nvm use node
+}
+
+_electron_env() {
+  [ -n "$ELECTRON_SKIP_BINARY_DOWNLOAD" ] && return
+  export ELECTRON_SKIP_BINARY_DOWNLOAD=1
+
+  local _electron_version=$(grep -Pom1 '^\s*"electron":\s*"\K[0-9.]+' "$srcdir/$_pkgsrc/package.json")
+  : ${_electron_version:?}
+
+  export SYSTEM_ELECTRON_VERSION=$(LC_ALL=C pacman -Si "electron${_electron_version%%.*}" | grep -Pom1 '^Version\s+:\s+\K\S+(?=-[0-9])')
+  : ${SYSTEM_ELECTRON_VERSION:?}
+
+  export ELECTRON_VERSION=$(sed -E 's&\..*&&' <<< "${SYSTEM_ELECTRON_VERSION%%.*}")
+  : ${ELECTRON_VERSION:?}
+}
 
 prepare() {
-  cd Mailspring
-  sed -i "/await createRpmInstaller/d" app/build/build.js
-  sed -i "s/execstack --clear-execstack//g" app/script/mkdeb
+  _electron_env
+
+  cd "$_pkgsrc"
+
+  # set electron version
+  sed -E \
+    -e 's&^(\s*)("electron"): "(.*)"(,?)$&\1\2: "'"$SYSTEM_ELECTRON_VERSION"'"\4&' \
+    -i "package.json" "app/package.json"
+
+  # allow any npm version
+  sed -E \
+    -e 's&^(\s*)"(node|npm)": "(.*)"(,?)$&\1"\2": ">=1.0.0"\4&' \
+    -i "package.json"
+
+  # don't try to create deb or rpm
+  sed -E -e "/await (createRpmInstaller|createDebInstaller)/d" -i app/build/build.js
 }
 
-build() {
-  cd Mailspring
-  npm install
+build() (
+  _nvm_env
+  _electron_env
+
+  cd "$_pkgsrc"
+  npm install --no-audit --no-fund
   npm run-script build
+)
+
+package() {
+  _electron_env
+  depends+=("electron${ELECTRON_VERSION:-}")
+
+  cd "$_pkgsrc"
+
+  # resources
+  mkdir -pm755 "${pkgdir}/$_install_path/$_pkgname"
+  cp -r app/dist/mailspring-linux-x64/resources/* "$pkgdir/$_install_path/$_pkgname/"
+
+  # fix rpath
+  patchelf --set-rpath '$ORIGIN' "$pkgdir/$_install_path/$_pkgname/app.asar.unpacked/mailsync.bin"
+
+  # icon
+  install -Dm0644 "app/build/resources/linux/icons/512.png" "$pkgdir/usr/share/icons/hicolor/512x512/apps/$_pkgname.png"
+
+  # launcher
+  install -Dm644 /dev/stdin "$pkgdir/usr/share/applications/$_pkgname.desktop" << END
+$(
+    sed -E \
+      -e 's&<%= productName %>&'"${_pkgname^}"'&' \
+      -e 's&<%= description %>&'"${pkgdesc}"'&' \
+      "app/build/resources/linux/Mailspring.desktop.in"
+  )
+END
+
+  # metainfo
+  install -Dm644 /dev/stdin "$pkgdir/usr/share/metainfo/$_pkgname.appdata.xml" << END
+$(sed -E -e 's&<%= productName %>&Mailspring&g' "app/build/resources/linux/mailspring.appdata.xml.in")
+END
+
+  # script
+  install -Dm755 /dev/stdin "$pkgdir/usr/bin/$_pkgname" << END
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+name=$_pkgname
+flags_file="\${XDG_CONFIG_HOME:-\$HOME/.config}/\${name}-flags.conf"
+
+lines=()
+if [[ -f "\${flags_file}" ]]; then
+  mapfile -t lines < "\${flags_file}"
+fi
+
+flags=()
+for line in "\${lines[@]}"; do
+  if [[ ! "\${line}" =~ ^[[:space:]]*#.* ]] && [[ -n "\${line}" ]]; then
+    flags+=("\${line}")
+  fi
+done
+
+: \${ELECTRON_IS_DEV:=0}
+export ELECTRON_IS_DEV
+: \${ELECTRON_FORCE_IS_PACKAGED:=true}
+export ELECTRON_FORCE_IS_PACKAGED
+
+exec electron${ELECTRON_VERSION:-} "\${flags[@]}" "/$_install_path/$_pkgname/app.asar" --password-store="gnome-libsecret" "\$@"
+END
 }
 
-package() {
-  cd Mailspring
-  install -d "${pkgdir}/opt/mailspring"
-  cp -r app/dist/mailspring-linux-x64/* "${pkgdir}/opt/mailspring"
-
-  install -d "${pkgdir}/usr/bin"
-  ln -s /opt/mailspring/mailspring "${pkgdir}/usr/bin/mailspring"
-
-  cd app/build/resources/linux
-
-  install -D Mailspring.desktop.in "${pkgdir}/usr/share/applications/Mailspring.desktop"
-  install -D mailspring.appdata.xml.in "${pkgdir}/usr/share/metainfo/mailspring.appdata.xml"
-
-  sed -i 's/<%= productName %>/Mailspring/g' "${pkgdir}/usr/share/applications/Mailspring.desktop"
-  sed -i 's/<%= description %>/Email client/g' "${pkgdir}/usr/share/applications/Mailspring.desktop"
-  sed -i 's/<%= productName %>/Mailspring/g' "${pkgdir}/usr/share/metainfo/mailspring.appdata.xml"
-
-  #for s in 16 32 64 128 256 512; do
-  #  install -Dm0644 "icons/$s.png" "${pkgdir}/usr/share/icons/hicolor/$s/apps/mailspring.png"
-  #done
-
-  install -Dm0644 "icons/16.png" "${pkgdir}/usr/share/icons/hicolor/16x16/apps/mailspring.png"
-  install -Dm0644 "icons/32.png" "${pkgdir}/usr/share/icons/hicolor/32x32/apps/mailspring.png"
-  install -Dm0644 "icons/64.png" "${pkgdir}/usr/share/icons/hicolor/64x64/apps/mailspring.png"
-  install -Dm0644 "icons/128.png" "${pkgdir}/usr/share/icons/hicolor/128x128/apps/mailspring.png"
-  install -Dm0644 "icons/256.png" "${pkgdir}/usr/share/icons/hicolor/256x256/apps/mailspring.png"
-  install -Dm0644 "icons/512.png" "${pkgdir}/usr/share/icons/hicolor/512x512/apps/mailspring.png"
-
-  #Insecure RPATH '/opt/openssl/lib' in file ('opt/mailspring/resources/app.asar.unpacked/mailsync.bin')
-  chrpath --delete "${pkgdir}/opt/mailspring/resources/app.asar.unpacked/mailsync.bin"
-}
-

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 23:13:22	MEDIUM	1
2026-07-25 00:13:44	CLEAN	2
2026-07-24 23:28:32	MEDIUM	1
2026-07-24 21:28:26	MEDIUM	1
2026-06-18 16:11:54	CLEAN	0