notion-calendar-electron-fixed

LOW
maintainer Ishan-Parihar 0 votes scanned 2026-11-01 00:21:48.120785
View on AUR
Why flagged

The package downloads a prebuilt Windows executable from the official Notion static domain, verifies its SHA512 checksum from a signed manifest, and repacks only the asar payload after patching and a headless smoke test; the download is from a plausible project-owned host and not executed directly, limiting supply-chain risk to the integrity of Notion's release pipeline.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt Windows executable from the official Notion static domain, verifies its SHA512 checksum from a signed manifest, and repacks only the asar payload after patching and a headless smoke test; the download is from a plausible project-owned host and not executed directly, limiting supply-chain risk to the integrity of Notion's release pipeline.

1 higher static finding superseded - not the current verdict (shown for transparency)
Medium External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

  • PKGBUILD:30 curl -fsSL "https://calendar-desktop-release.notion-static.com/latest.yml"

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: Ishan Parihar <ishanparihar@gmail.com>
2# Contributor: Stoffi05
3
4pkgname=notion-calendar-electron-fixed
5pkgver=1.141.0
6pkgrel=2
7pkgdesc="Notion Calendar Desktop Client - your calendar, tasks, and schedule in one place (official installer, electron41)"
8arch=(x86_64)
9url=https://www.notion.so/product/calendar
10license=(custom)
11depends=(
12 bash
13 electron41
14 gcc-libs
15 glibc
16 hicolor-icon-theme
17)
18makedepends=(
19 7zip
20 asar
21 curl
22 electron41
23 python
24)
25provides=('notion-calendar-electron')
26conflicts=('notion-calendar-electron')
27install=.install
28
29_manifest() {
30 curl -fsSL "https://calendar-desktop-release.notion-static.com/latest.yml"
31}
32_upstream_ver() {
33 _manifest | sed -n 's/^version: *//p' | head -1
34}
35_upstream_sha512_hex() {
36 _manifest | awk '/sha512:/{print $2; exit}' | base64 -d | od -An -tx1 | tr -d ' \n'
37}
38
39pkgver() {
40 _upstream_ver
41}
42
43source=(
44 "notion-calendar-electron-fixed::git+https://aur.archlinux.org/notion-calendar-electron-fixed.git"
45 patch_notion_calendar.py
46)
47sha256sums=('SKIP'
48 'SKIP')
49
50options=(!emptydirs)
51
52prepare() {
53 local ver exe url want got
54 ver=$(_upstream_ver)
55 exe="Notion Calendar Setup ${ver}.exe"
56 url="https://calendar-desktop-release.notion-static.com/Notion%20Calendar%20Setup%20${ver}.exe"
57 want=$(_upstream_sha512_hex)
58 if [[ ! -f "$srcdir/$exe" ]]; then
59 curl -fL -o "$srcdir/$exe" "$url"
60 fi
61 got=$(sha512sum "$srcdir/$exe" | cut -d' ' -f1)
62 if [[ "$got" != "$want" ]]; then
63 echo "CHECKSUM MISMATCH for $exe" >&2
64 echo " got: $got" >&2
65 echo " want: $want" >&2
66 exit 1
67 fi
68 echo "==> checksum verified: $exe (upstream $ver)"
69
70 # makepkg only auto-extracts files listed in source(); since we fetch the
71 # installer ourselves in prepare(), extract it here.
72 if [[ ! -d "$srcdir/resources" ]]; then
73 bsdtar -xf "$srcdir/$exe" -C "$srcdir"
74 fi
75
76 # bsdtar (makepkg) already extracted the NSIS installer; app.asar is in resources/
77 # Clean up Windows-specific files left by the extraction
78 rm -f "$srcdir/Notion Calendar Setup ${ver}.exe" "$srcdir/Notion Calendar.exe"
79 rm -rf "$srcdir/\$PLUGINSDIR" 2>/dev/null || true
80 rm -rf "$srcdir/asar_patched" 2>/dev/null || true
81
82 # extracting resources from app.asar
83 asar e "$srcdir/resources/app.asar" "$srcdir/asar_patched"
84
85 # Use Python for patching to avoid sed issues with minified JS
86 python3 "$srcdir/patch_notion_calendar.py"
87
88 # repacking asar with all the patches
89 asar p "$srcdir/asar_patched" "$srcdir/app.asar" --unpack *.node
90
91 # --- runtime smoke test ---------------------------------------------
92 # The 1.141.0 bundle initialises Sentry with an undefined DSN and
93 # enableNative defaults to true, so @sentry/electron throws during
94 # startup and the app never opens a window. The patch above fixes it,
95 # but a future upstream re-minify could reintroduce it (or break
96 # something else) without the build noticing. So: actually RUN the
97 # patched app and require that it starts and stays up.
98 #
99 # --headless runs the real electron runtime with no display server,
100 # which is what a build sandbox has. The signal we need is exact: the
101 # Sentry throw happens during startup, before any window would exist,
102 # so "the process reached its event loop and stayed alive" means the
103 # startup path is clean.
104 echo "==> smoke test: launching the patched app (headless)"
105 local _log="$srcdir/smoke.log"
106 local _pid
107 env -u DISPLAY -u WAYLAND_DISPLAY \
108 electron41 --headless "$srcdir/app.asar" >"$_log" 2>&1 &
109 _pid=$!
110
111 # Give it time to start. If the Sentry bug is present the process dies
112 # within a second or two.
113 local _i
114 for _i in $(seq 1 20); do
115 sleep 0.5
116 kill -0 "$_pid" 2>/dev/null || break
117 done
118
119 local _alive=0
120 kill -0 "$_pid" 2>/dev/null && _alive=1
121
122 if [[ $_alive -eq 0 ]]; then
123 echo "SMOKE TEST FAILED: the app exited during startup" >&2
124 cat "$_log" >&2
125 exit 1
126 fi
127
128 # It is running. Now check it did not log the fatal startup errors.
129 # NOTE: makepkg runs PKGBUILD functions under `set -e`, and `wait` returns
130 # 143 when the process was killed by SIGTERM. Without the `|| true` here
131 # the whole prepare() aborts silently with no diagnostic.
132 kill -TERM "$_pid" 2>/dev/null || true
133 wait "$_pid" 2>/dev/null || true
134
135 if grep -qE "Attempted to enable Electron native crash reporter|SentryError" "$_log"; then
136 echo "SMOKE TEST FAILED: a fatal startup error was logged" >&2
137 grep -E "SentryError|Attempted to enable" "$_log" >&2
138 exit 1
139 fi
140
141 # A syntax error in the patched bundle means the app cannot even load.
142 if grep -qE "SyntaxError|Uncaught Exception" "$_log"; then
143 echo "SMOKE TEST FAILED: the app threw during load" >&2
144 grep -E "SyntaxError|Uncaught Exception" "$_log" >&2
145 exit 1
146 fi
147
148 # The patched main.js must actually be in the asar we are about to ship.
149 # (A patch script that silently did nothing must not pass the build.)
150 if ! asar e "$srcdir/app.asar" "$srcdir/.verify" 2>/dev/null; then
151 echo "SMOKE TEST FAILED: could not read back the repacked asar" >&2
152 exit 1
153 fi
154 if ! grep -q "enableNative:!1" "$srcdir/.verify/build/main/main.js"; then
155 echo "SMOKE TEST FAILED: the sentry guard is missing from the packed asar" >&2
156 exit 1
157 fi
158 rm -rf "$srcdir/.verify"
159
160 echo "==> smoke test passed"
161}
162
163package() {
164 local usr="$pkgdir/usr"
165 local share="$usr/share"
166 local lib="$usr/lib/notion-calendar"
167
168 install -d "$lib"
169 cp "$srcdir/app.asar" "$lib"
170 cp -r "$srcdir/app.asar.unpacked" "$lib" 2>/dev/null || true
171 install -vDm755 "$srcdir/notion-calendar-electron-fixed/notion-calendar" -t "$usr/bin"
172 install -vDm644 "$srcdir/notion-calendar-electron-fixed/notion-calendar.desktop" -t "$share/applications"
173 install -vDm644 "$srcdir/notion-calendar-electron-fixed/notion-calendar.png" -t "$share/icons/hicolor/256x256/apps"
174}
175

Changes since previous scan

--- PKGBUILD @ 2026-10-20 15:28
+++ PKGBUILD @ 2026-11-01 00:21
@@ -3,7 +3,7 @@
pkgname=notion-calendar-electron-fixed
pkgver=1.141.0
-pkgrel=1
+pkgrel=2
pkgdesc="Notion Calendar Desktop Client - your calendar, tasks, and schedule in one place (official installer, electron41)"
arch=(x86_64)
url=https://www.notion.so/product/calendar
@@ -19,6 +19,7 @@
7zip
asar
curl
+ electron41
python
)
provides=('notion-calendar-electron')
@@ -86,6 +87,77 @@
# repacking asar with all the patches
asar p "$srcdir/asar_patched" "$srcdir/app.asar" --unpack *.node
+
+ # --- runtime smoke test ---------------------------------------------
+ # The 1.141.0 bundle initialises Sentry with an undefined DSN and
+ # enableNative defaults to true, so @sentry/electron throws during
+ # startup and the app never opens a window. The patch above fixes it,
+ # but a future upstream re-minify could reintroduce it (or break
+ # something else) without the build noticing. So: actually RUN the
+ # patched app and require that it starts and stays up.
+ #
+ # --headless runs the real electron runtime with no display server,
+ # which is what a build sandbox has. The signal we need is exact: the
+ # Sentry throw happens during startup, before any window would exist,
+ # so "the process reached its event loop and stayed alive" means the
+ # startup path is clean.
+ echo "==> smoke test: launching the patched app (headless)"
+ local _log="$srcdir/smoke.log"
+ local _pid
+ env -u DISPLAY -u WAYLAND_DISPLAY \
+ electron41 --headless "$srcdir/app.asar" >"$_log" 2>&1 &
+ _pid=$!
+
+ # Give it time to start. If the Sentry bug is present the process dies
+ # within a second or two.
+ local _i
+ for _i in $(seq 1 20); do
+ sleep 0.5
+ kill -0 "$_pid" 2>/dev/null || break
+ done
+
+ local _alive=0
+ kill -0 "$_pid" 2>/dev/null && _alive=1
+
+ if [[ $_alive -eq 0 ]]; then
+ echo "SMOKE TEST FAILED: the app exited during startup" >&2
+ cat "$_log" >&2
+ exit 1
+ fi
+
+ # It is running. Now check it did not log the fatal startup errors.
+ # NOTE: makepkg runs PKGBUILD functions under `set -e`, and `wait` returns
+ # 143 when the process was killed by SIGTERM. Without the `|| true` here
+ # the whole prepare() aborts silently with no diagnostic.
+ kill -TERM "$_pid" 2>/dev/null || true
+ wait "$_pid" 2>/dev/null || true
+
+ if grep -qE "Attempted to enable Electron native crash reporter|SentryError" "$_log"; then
+ echo "SMOKE TEST FAILED: a fatal startup error was logged" >&2
+ grep -E "SentryError|Attempted to enable" "$_log" >&2
+ exit 1
+ fi
+
+ # A syntax error in the patched bundle means the app cannot even load.
+ if grep -qE "SyntaxError|Uncaught Exception" "$_log"; then
+ echo "SMOKE TEST FAILED: the app threw during load" >&2
+ grep -E "SyntaxError|Uncaught Exception" "$_log" >&2
+ exit 1
+ fi
+
+ # The patched main.js must actually be in the asar we are about to ship.
+ # (A patch script that silently did nothing must not pass the build.)
+ if ! asar e "$srcdir/app.asar" "$srcdir/.verify" 2>/dev/null; then
+ echo "SMOKE TEST FAILED: could not read back the repacked asar" >&2
+ exit 1
+ fi
+ if ! grep -q "enableNative:!1" "$srcdir/.verify/build/main/main.js"; then
+ echo "SMOKE TEST FAILED: the sentry guard is missing from the packed asar" >&2
+ exit 1
+ fi
+ rm -rf "$srcdir/.verify"
+
+ echo "==> smoke test passed"
}
package() {

Scan history

Scanned at (UTC)SeverityRules
2026-11-01 00:21:48 Low 2
2026-10-31 00:07:41 Low 2
2026-10-30 00:29:30 Low 2
2026-10-29 00:13:55 Low 2
2026-10-28 00:06:54 Low 2
2026-10-27 00:23:28 Low 2
2026-10-26 00:12:40 Low 2
2026-10-25 00:20:48 Low 2
2026-10-24 00:14:55 Low 2
2026-10-23 00:02:19 Low 2
2026-10-22 00:13:10 Low 2
2026-10-21 01:29:42 Medium 1
2026-10-21 00:12:50 Low 2
2026-10-20 17:28:05 Medium 1
2026-10-20 15:28:05 Medium 2
2026-10-20 00:10:31 Low 2
2026-10-19 00:03:55 Low 2
2026-10-18 00:06:55 Low 2
2026-10-17 00:21:55 Low 2
2026-10-16 00:12:47 Low 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion