nook-bin

maintainer Opolak95 · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads and installs a prebuilt proprietary binary (.deb) from nook.cloudylake.io, which is the maintainer's own personal/company domain (matching the maintainer email domain). The binary is an Electron-based desktop application (given the depends on gtk3, nss, libxss, libxtst, alsa-lib) that will be executed on the user's system. While the sha256sum provides some integrity protection against in-transit tampering, the host is not a well-known vendor CDN or major forge — it is a personal/small-company server that could be compromised or the binary swapped. The license is proprietary, the source is closed, and there is no way to audit what the binary does. This is a classic AUR binary package pattern (like -bin packages for Slack, Discord, etc.) but from a completely unknown vendor with no established reputation. The risk is real but not evidence of active malice — it is a genuine supply-chain concern because a compromised or malicious update to the binary on that server would be silently installed by users. Medium severity is appropriate.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=("nook-${pkgver}-${pkgrel}.deb::https://nook.cloudylake.io/download/nook-0.1.21-linux.deb")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads and installs a prebuilt proprietary binary (.deb) from nook.cloudylake.io, which is the maintainer's own personal/company domain (matching the maintainer email domain). The binary is an Electron-based desktop application (given the depends on gtk3, nss, libxss, libxtst, alsa-lib) that will be executed on the user's system. While the sha256sum provides some integrity protection against in-transit tampering, the host is not a well-known vendor CDN or major forge — it is a personal/small-company server that could be compromised or the binary swapped. The license is proprietary, the source is closed, and there is no way to audit what the binary does. This is a classic AUR binary package pattern (like -bin packages for Slack, Discord, etc.) but from a completely unknown vendor with no established reputation. The risk is real but not evidence of active malice — it is a genuine supply-chain concern because a compromised or malicious update to the binary on that server would be silently installed by users. Medium severity is appropriate.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Ondrej Polak <ondrej.polak@cloudylake.io>
    
      2pkgname=nook-bin
    
      3pkgver=0.1.21
    
      4pkgrel=1
    
      5pkgdesc="Calm collaboration for teams and communities — self-hosted messaging, voice, and meetings"
    
      6arch=('x86_64')
    
      7url="https://nook.cloudylake.io"
    
      8license=('proprietary')
    
      9depends=('alsa-lib' 'gtk3' 'libayatana-appindicator' 'libxss' 'libxtst' 'nss')
    
      10optdepends=('libpulse: PulseAudio audio support')
    
      11provides=('nook')
    
      12conflicts=('nook')
    
      13source=("nook-${pkgver}-${pkgrel}.deb::https://nook.cloudylake.io/download/nook-0.1.21-linux.deb")
    
      14sha256sums=("b189a27fe9ebba734b8e1dc36b52cffa8029463e2624aa24eecbc09e3517e622")
    
      15
    
      16package() {
    
      17    bsdtar -xf "nook-${pkgver}-${pkgrel}.deb" -C "${srcdir}"
    
      18
    
      19    local data_archive
    
      20    data_archive="$(find "${srcdir}" -maxdepth 1 -type f -name 'data.tar*' | head -n 1)"
    
      21    if [ -z "${data_archive}" ]; then
    
      22        echo "Unable to find data archive in extracted .deb" >&2
    
      23        return 1
    
      24    fi
    
      25
    
      26    bsdtar -xf "${data_archive}" -C "${pkgdir}"
    
      27
    
      28    # Normalize desktop filename for AUR consumers.
    
      29    if [ -f "${pkgdir}/usr/share/applications/Nook.desktop" ]; then
    
      30        mv "${pkgdir}/usr/share/applications/Nook.desktop" "${pkgdir}/usr/share/applications/nook.desktop"
    
      31    fi
    
      32}
    
      33
    
      34options=(!strip)
    
      35

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2