notion-calendar-electron-fixed
LOW
maintainer Ishan-Parihar
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads a prebuilt Windows installer from a plausible project-owned host (notion-static.com), extracts and patches its internal app.asar for Linux compatibility, then repackages it; the patches are transparent and focused on disabling Windows-specific code, not introducing malicious behavior, and the final artifact is installed locally without remote code execution or data exfiltration.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt Windows installer from a plausible project-owned host (notion-static.com), extracts and patches its internal app.asar for Linux compatibility, then repackages it; the patches are transparent and focused on disabling Windows-specific code, not introducing malicious behavior, and the final artifact is installed locally without remote code execution or data exfiltration.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:28
"https://calendar-desktop-release.notion-static.com/Notion%20Calendar%20Setup%20${pkgver}.exe"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Ishan Parihar <ishanparihar@gmail.com>
2
# Contributor: Stoffi05
3
4
pkgname=notion-calendar-electron-fixed
5
pkgver=1.133.0
6
pkgrel=5
7
pkgdesc="Notion Calendar Desktop Client - your calendar, tasks, and schedule in one place (official installer, electron41)"
8
arch=(x86_64)
9
url=https://www.notion.so/product/calendar
10
license=(custom)
11
depends=(
12
bash
13
electron41
14
gcc-libs
15
glibc
16
hicolor-icon-theme
17
)
18
makedepends=(
19
7zip
20
asar
21
python
22
)
23
provides=('notion-calendar-electron')
24
conflicts=('notion-calendar-electron')
25
install=.install
26
27
source=(
28
"https://calendar-desktop-release.notion-static.com/Notion%20Calendar%20Setup%20${pkgver}.exe"
29
notion-calendar
30
notion-calendar.desktop
31
notion-calendar.png
32
)
33
sha256sums=('4256d294aec58932b1723760d19d97528a20bf89922db88e66e3931962d63c36'
34
'SKIP'
35
'SKIP'
36
'SKIP')
37
38
options=(!emptydirs)
39
40
prepare() {
41
# bsdtar (makepkg) already extracted the NSIS installer; app.asar is in resources/
42
# Clean up Windows-specific files left by the extraction
43
rm -f "$srcdir/Notion Calendar Setup ${pkgver}.exe" "$srcdir/Notion Calendar.exe"
44
rm -rf "$srcdir/\$PLUGINSDIR" 2>/dev/null || true
45
rm -rf "$srcdir/asar_patched" 2>/dev/null || true
46
47
# extracting resources from app.asar
48
asar e "$srcdir/resources/app.asar" "$srcdir/asar_patched"
49
50
# Use Python for patching to avoid sed issues with minified JS
51
python3 << 'PYEOF'
52
import sys
53
import os
54
55
main_js = os.path.join(os.getcwd(), 'asar_patched/build/main/main.js')
56
if not os.path.exists(main_js):
57
# Fallback: walk from srcdir env or cwd
58
search_root = os.environ.get('srcdir') or os.getcwd()
59
for root, dirs, files in os.walk(search_root):
60
for f in files:
61
if f == 'main.js':
62
main_js = os.path.join(root, f)
63
break
64
65
with open(main_js, 'r', encoding='utf-8') as f:
66
content = f.read()
67
68
patches = [
69
# Patch 1: disable auto updates (Windows-only Squirrel)
70
('if("win32"===process.platform&&!d.default().wasBuiltByUs&&s.existsSync(c.join(a.app.getAppPath(),"../Update.exe")))', 'if(!1)'),
71
# Patch 2: fix single instance lock for linux
72
('"win32"!==process.platform||qf||u().app.quit()', 'qf||u().app.quit()'),
73
# Patch 3: fix second-instance event to handle linux
74
('"win32"===process.platform&&(tS(),kS(t))', 'tS(),kS(t)'),
75
# Patch 4: fix argv protocol handler for linux
76
('"win32"===process.platform&&kS(process.argv)', 'kS(process.argv)'),
77
# Patch 5: fix protocol registration for linux
78
(',Mf&&"win32"===process.platform', ',Mf'),
79
# Patch 6: fix app user model id (not needed on linux)
80
('"win32"===process.platform&&u().app.setAppUserModelId("com.cron.electron");', 'true;'),
81
# Patch 7: fix tray popup menu for linux (use win32 pattern instead of darwin)
82
('NS)if("darwin"===process.platform)NS.popUpContextMenu();else{', 'NS)if(false)NS.popUpContextMenu();else{'),
83
# Patch 8: fix kS function to work on linux (remove win32-only check)
84
('function kS(e){if("win32"!==process.platform)return;', 'function kS(e){'),
85
# Patch 9: prevent URLs from being treated as file paths in kS function
86
('const n=e.slice(1).find((e=>D().existsSync(e)));', 'const n=e.slice(1).find((e=>!e.includes("://")&&D().existsSync(e)));'),
87
# Patch 10: disable crash reporter on linux (provide fake DSN to skip throw)
88
('if(!(e=this._options.dsn))throw new ae("Attempted to enable Electron native crash reporter but no DSN was supplied");', 'e=this._options.dsn||"https://fake@sentry.io/0";'),
89
# Patch 11: disable autoUpdater on linux (a.autoUpdater is undefined)
90
('_subscribeToElectronEvents(){a.autoUpdater.on("before-quit-for-update",((...e)=>{this._log("info","before-quit-for-update",...e),this.emit("before-quit-for-update",...e)})),i.autoUpdater.on("checking-for-update",((...e)=>{this._log("info","checking-for-update",...e),this.emit("checking-for-update",...e)})),i.autoUpdater.on("download-progress",((...e)=>{this._log("info","download-progress",...e),this.emit("download-progress",...e)})),i.autoUpdater.on("update-available",((...e)=>{this._log("info","update-available",...e),this.emit("update-available",...e)})),i.autoUpdater.on("update-not-available",((...e)=>{this._log("info","update-not-available",...e),this.emit("update-not-available",...e)}))}}', '_subscribeToElectronEvents(){if("linux"===process.platform)return;a.autoUpdater.on("before-quit-for-update",((...e)=>{this._log("info","before-quit-for-update",...e),this.emit("before-quit-for-update",...e)})),i.autoUpdater.on("checking-for-update",((...e)=>{this._log("info","checking-for-update",...e),this.emit("checking-for-update",...e)})),i.autoUpdater.on("download-progress",((...e)=>{this._log("info","download-progress",...e),this.emit("download-progress",...e)})),i.autoUpdater.on("update-available",((...e)=>{this._log("info","update-available",...e),this.emit("update-available",...e)})),i.autoUpdater.on("update-not-available",((...e)=>{this._log("info","update-not-available",...e),this.emit("update-not-available",...e)}))}}'),
91
# Patch 12: disable second autoUpdater subscription on linux (Nf.autoUpdater is undefined)
92
('pT=async()=>{Nf.autoUpdater.on("before-quit-for-update",(()=>{bS=!0,SS(),lT="before-quit-for-update",uT(lT)})),Nf.autoUpdater.on("update-available",(()=>{lT="update-available",uT(lT)})),"latest"!==Wf&&sT(Wf),mT(),setInterval(mT,9e5)}', 'pT=async()=>{if("linux"===process.platform)return;Nf.autoUpdater.on("before-quit-for-update",(()=>{bS=!0,SS(),lT="before-quit-for-update",uT(lT)})),Nf.autoUpdater.on("update-available",(()=>{lT="update-available",uT(lT)})),"latest"!==Wf&&sT(Wf),mT(),setInterval(mT,9e5)}'),
93
]
94
95
applied = 0
96
for old, new in patches:
97
if old in content:
98
content = content.replace(old, new, 1)
99
print(f'Applied: {old[:60]}...')
100
applied += 1
101
else:
102
print(f'WARNING: Not found: {old[:60]}...', file=sys.stderr)
103
104
if applied < len(patches):
105
print(f'ERROR: Only {applied}/{len(patches)} patches applied!', file=sys.stderr)
106
sys.exit(1)
107
108
with open(main_js, 'w', encoding='utf-8') as f:
109
f.write(content)
110
111
print(f'All {applied} patches applied successfully')
112
PYEOF
113
114
# repacking asar with all the patches
115
asar p "$srcdir/asar_patched" "$srcdir/app.asar" --unpack *.node
116
}
117
118
package() {
119
local usr="$pkgdir/usr"
120
local share="$usr/share"
121
local lib="$usr/lib/notion-calendar"
122
123
install -d "$lib"
124
cp "$srcdir/app.asar" "$lib"
125
cp -r "$srcdir/app.asar.unpacked" "$lib" 2>/dev/null || true
126
install -vDm755 notion-calendar -t "$usr/bin"
127
install -vDm644 "$srcdir/notion-calendar.desktop" -t "$share/applications"
128
install -vDm644 "$srcdir/notion-calendar.png" -t "$share/icons/hicolor/256x256/apps"
129
}
130
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 07:38:41 | Medium | 1 |