nook-beta-bin

maintainer Opolak95 · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt .deb from a non-standard host (nook.cloudylake.io), which is not on standard package hosting infrastructure, and installs it without source verification, creating a supply-chain risk if the host is compromised.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source_x86_64=("nook-beta-0.2.33-linux-${pkgver}-${pkgrel}.deb::https://nook.cloudylake.io/download/beta/nook-beta-0.2.33-linux.deb")

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt .deb from a non-standard host (nook.cloudylake.io), which is not on standard package hosting infrastructure, and installs it without source verification, creating a supply-chain risk if the host is compromised.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Nook Release Bot <release-bot@nook.local>
    
      2pkgname=nook-beta-bin
    
      3pkgver=0.2.33
    
      4pkgrel=1
    
      5pkgdesc='Nook Beta desktop collaboration app'
    
      6arch=('x86_64')
    
      7url='https://nook.cloudylake.io'
    
      8license=('custom')
    
      9depends=('alsa-lib' 'at-spi2-core' 'gtk3' 'hicolor-icon-theme' 'libayatana-appindicator' 'libdrm' 'libx11' 'libxcb' 'libxcomposite' 'libxdamage' 'libxext' 'libxfixes' 'libxkbcommon' 'libxrandr' 'libxss' 'libxtst' 'mesa' 'nss' 'xdg-utils')
    
      10optdepends=('libpulse: PulseAudio audio support')
    
      11provides=('nook-beta')
    
      12conflicts=('nook-beta')
    
      13options=(!strip)
    
      14source_x86_64=("nook-beta-0.2.33-linux-${pkgver}-${pkgrel}.deb::https://nook.cloudylake.io/download/beta/nook-beta-0.2.33-linux.deb")
    
      15sha256sums_x86_64=('08a60f2df163d74d8456990eb6fd003f44a640af8849ba39f6c2c77c657c7b14')
    
      16
    
      17package() {
    
      18    bsdtar -xf "nook-beta-0.2.33-linux-${pkgver}-${pkgrel}.deb" -C "${srcdir}"
    
      19
    
      20    local data_archive
    
      21    local app_install_dir='nook-beta'
    
      22    local versioned_app_dir="${app_install_dir}-${pkgver}"
    
      23    data_archive="$(find "${srcdir}" -maxdepth 1 -type f -name 'data.tar*' | head -n 1)"
    
      24    if [ -z "${data_archive}" ]; then
    
      25        echo "Unable to find data archive in extracted .deb" >&2
    
      26        return 1
    
      27    fi
    
      28
    
      29    bsdtar -xf "${data_archive}" -C "${pkgdir}"
    
      30
    
      31    if [ ! -d "${pkgdir}/opt/${app_install_dir}" ]; then
    
      32        echo "Unable to find /opt/${app_install_dir} in extracted .deb" >&2
    
      33        return 1
    
      34    fi
    
      35
    
      36    # AUR upgrades must not write hashed Electron/Vite assets into a stable
    
      37    # /opt path. If an older install left unowned files behind, pacman checks
    
      38    # would fail before scriptlets can clean them. Keep the app payload
    
      39    # versioned and point the stable launchers at it instead.
    
      40    rm -rf "${pkgdir}/opt/${versioned_app_dir}"
    
      41    mv "${pkgdir}/opt/${app_install_dir}" "${pkgdir}/opt/${versioned_app_dir}"
    
      42
    
      43    mkdir -p "${pkgdir}/usr/bin"
    
      44    ln -sfn "/opt/${versioned_app_dir}/${app_install_dir}" "${pkgdir}/usr/bin/${app_install_dir}"
    
      45
    
      46    local desktop_file="${pkgdir}/usr/share/applications/${app_install_dir}.desktop"
    
      47    if [ -f "${pkgdir}/usr/share/applications/Nook.desktop" ]; then
    
      48        mv "${pkgdir}/usr/share/applications/Nook.desktop" "${desktop_file}"
    
      49    fi
    
      50    if [ -f "${desktop_file}" ]; then
    
      51        sed -i "s#/opt/${app_install_dir}/${app_install_dir}#/opt/${versioned_app_dir}/${app_install_dir}#g" "${desktop_file}"
    
      52    fi
    
      53}
    
      54

Changes since previous scan

--- PKGBUILD @ 2026-07-25 00:13
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,6 +1,6 @@
 # Maintainer: Nook Release Bot <release-bot@nook.local>
 pkgname=nook-beta-bin
-pkgver=0.2.32
+pkgver=0.2.33
 pkgrel=1
 pkgdesc='Nook Beta desktop collaboration app'
 arch=('x86_64')
@@ -11,11 +11,11 @@
 provides=('nook-beta')
 conflicts=('nook-beta')
 options=(!strip)
-source_x86_64=("nook-beta-0.2.32-linux-${pkgver}-${pkgrel}.deb::https://nook.cloudylake.io/download/beta/nook-beta-0.2.32-linux.deb")
-sha256sums_x86_64=('dee37448a2ce28a0751dd03cb7d82f916eeb920dbd018fd41d2a471ca80776a7')
+source_x86_64=("nook-beta-0.2.33-linux-${pkgver}-${pkgrel}.deb::https://nook.cloudylake.io/download/beta/nook-beta-0.2.33-linux.deb")
+sha256sums_x86_64=('08a60f2df163d74d8456990eb6fd003f44a640af8849ba39f6c2c77c657c7b14')
 
 package() {
-    bsdtar -xf "nook-beta-0.2.32-linux-${pkgver}-${pkgrel}.deb" -C "${srcdir}"
+    bsdtar -xf "nook-beta-0.2.33-linux-${pkgver}-${pkgrel}.deb" -C "${srcdir}"
 
     local data_archive
     local app_install_dir='nook-beta'

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 13:29:48	MEDIUM	2
2026-07-25 11:29:47	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 07:22:42	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 19:21:42	MEDIUM	2
2026-07-22 15:20:42	MEDIUM	2
2026-07-22 09:20:02	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2