mendeleydesktop
LOW
maintainer ReyJamonico
304 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The package downloads prebuilt binaries from Mendeley's official domain (desktop-download.mendeley.com), which is plausibly the project's own release infrastructure; despite the non-whitelisted host, the source is verifiable via checksums and the worst case of a swapped download would be code execution, but the context suggests legitimate software distribution.
Triggered rules
Low
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-07-25) reviewed this and agrees it is LOW (confidence 95%): The package downloads prebuilt binaries from Mendeley's official domain (desktop-download.mendeley.com), which is plausibly the project's own release infrastructure; despite the non-whitelisted host, the source is verifiable via checksums and the worst case of a swapped download would be code execution, but the context suggests legitimate software distribution.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:13
source_i686=("https://desktop-download.mendeley.com/download/linux/$pkgbase-$pkgver-linux-i486.tar.bz2")
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: xgdgsc <xgdgsc at gmail dot com>
2
# Maintainer: Alesandar Trifunović <akstrfn at gmail dot com>
3
4
pkgbase=mendeleydesktop
5
pkgname=('mendeleydesktop'
6
'mendeleydesktop-bundled')
7
pkgver=1.19.8
8
pkgrel=1
9
pkgdesc="Academic software for managing and sharing research papers."
10
url=http://www.mendeley.com/release-notes/
11
arch=(i686 x86_64)
12
license=(custom:mendeley_eula)
13
source_i686=("https://desktop-download.mendeley.com/download/linux/$pkgbase-$pkgver-linux-i486.tar.bz2")
14
source_x86_64=("https://desktop-download.mendeley.com/download/linux/$pkgbase-$pkgver-linux-x86_64.tar.bz2")
15
sha512sums_i686=('c2bb4fb332c61275f5fd9ff691f72cec24b9d5c7c5de0f16713bdb38086eb935b5eea24cffa04817d08b997591886d7b8942df38addc7f30c794438be62e1ea7')
16
sha512sums_x86_64=('95e39e6cd19ec5f012ecfe9f340522eacb2afb5766b0640e5934da07ff1c3503f4f5e9ea48c83f78e1df7ed23191d89aa3c0ebe0c483493d6a5cc681d52ec2eb')
17
18
if [[ $CARCH = i686 ]];then
19
$CARCH=i486
20
fi
21
22
prepare() {
23
cp -a "$pkgbase-$pkgver-linux-$CARCH" "mendeley-native"
24
}
25
26
package_mendeleydesktop() {
27
depends=('qt5-webengine')
28
cd "mendeley-native"
29
30
# Using shared libraries so remove the bundled ones
31
rm -rf lib/cpp lib/qt lib/ssl lib/libpng12.so.0 lib/mendeleydesktop/plugins
32
rm -rf lib/mendeleydesktop/libexec/resources
33
rm -rf lib/mendeleydesktop/libexec/translations/qtwebengine_locales
34
35
# TODO Run install-mendeley-link-handler.sh for gconf or just remove it?
36
rm bin/install-mendeley-link-handler.sh
37
38
# # Remove unneeded lines if gconf is not installed.
39
# if ! which gconftool-2 &>/dev/null;then
40
# sed -i '/GCONF/d' \
41
# "$pkgdir"/opt/"$pkgbase"/bin/install-mendeley-link-handler.sh
42
# fi
43
44
# Link system Qt
45
ln -s /usr/share/qt/resources \
46
lib/mendeleydesktop/libexec/
47
ln -s /usr/share/qt/translations/qtwebengine_locales \
48
lib/mendeleydesktop/libexec/translations/
49
50
install -d "$pkgdir/opt/$pkgbase/"
51
cp -a bin lib share "$pkgdir/opt/$pkgbase/"
52
53
# Replace default python laucher with custom bash
54
cat <<'EOF' > "$pkgdir/opt/$pkgbase/bin/mendeleydesktop"
55
#!/bin/bash
56
export LD_LIBRARY_PATH=/usr/lib/:/opt/mendeleydesktop/lib/:/usr/lib/qt/
57
export MENDELEY_BUNDLED_QT_PLUGIN_PATH=/lib/qt/plugins/
58
/opt/mendeleydesktop/lib/mendeleydesktop/libexec/mendeleydesktop.x86_64 "$@"
59
EOF
60
61
install -d "$pkgdir"/usr/bin
62
ln -s "/opt/$pkgbase/bin/mendeleydesktop" \
63
"$pkgdir/usr/bin/mendeleydesktop"
64
65
install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgbase/LICENSE"
66
install -Dm644 share/applications/mendeleydesktop.desktop \
67
"$pkgdir"/usr/share/applications/mendeleydesktop.desktop
68
69
cp -a "$pkgdir/opt/$pkgbase/share/icons" "$pkgdir/usr/share/icons"
70
71
# Clean share from opt (don't remove mendeleydesktop)
72
rm -rf "$pkgdir/opt/$pkgbase/share/"{applications,doc,icons}
73
}
74
75
package_mendeleydesktop-bundled() {
76
provides=('mendeleydesktop')
77
conflicts=('mendeleydesktop')
78
cd "$pkgbase-$pkgver-linux-$CARCH"
79
80
sed -i 's/Exec=/&env LD_LIBRARY_PATH=\/opt\/mendeleydesktop\/lib\/mendeleydesktop\/plugins\/platforms /' bin/install-mendeley-link-handler.sh
81
82
install -d "$pkgdir/opt/$pkgbase"
83
cp -a bin lib share "$pkgdir/opt/$pkgbase/"
84
85
86
install -d "$pkgdir"/usr/bin
87
ln -s "/opt/$pkgbase/bin/mendeleydesktop" \
88
"$pkgdir/usr/bin/mendeleydesktop"
89
90
install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgbase/LICENSE"
91
install -Dm644 share/applications/mendeleydesktop.desktop \
92
"$pkgdir"/usr/share/applications/mendeleydesktop.desktop
93
94
cp -a "$pkgdir/opt/$pkgbase/share/icons" "$pkgdir/usr/share/icons"
95
96
# Clean share from opt (don't remove mendeleydesktop)
97
rm -rf "$pkgdir/opt/$pkgbase/share/"{applications,doc,icons}
98
}
99
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 00:13:55 | Low | 2 |
| 2026-10-28 00:06:54 | Low | 2 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |
| 2026-10-14 00:06:47 | Low | 2 |
| 2026-10-13 00:23:45 | Low | 2 |