official-chatgpt-bin

LOW

maintainer heisenberg_1205 0 votes scanned 2026-10-02 00:00:32.890515

View on AUR

Why flagged

Downloads a prebuilt .deb from persistent.oaistatic.com, which appears to be OpenAI's own CDN/static asset domain for the official ChatGPT desktop app; the checksum is pinned so swapping is detectable, and the host is plausibly official infrastructure rather than a personal/cloud-storage host.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 70%): Downloads a prebuilt .deb from persistent.oaistatic.com, which appears to be OpenAI's own CDN/static asset domain for the official ChatGPT desktop app; the checksum is pinned so swapping is detectable, and the host is plausibly official infrastructure rather than a personal/cloud-storage host.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:44 source_x86_64=('https://persistent.oaistatic.com/codex-app-prod/linux/deb/latest/chatgpt_amd64.deb')

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Aditya Hebballe <adityahebbale@gmail.com>
    
      2
    
      3pkgname=official-chatgpt-bin
    
      4pkgver=26.803.81509
    
      5pkgrel=1
    
      6pkgdesc='The official ChatGPT desktop application for Linux'
    
      7arch=(x86_64)
    
      8url='https://chatgpt.com/'
    
      9license=('LicenseRef-Proprietary')
    
      10depends=(
    
      11  alsa-lib
    
      12  at-spi2-core
    
      13  cairo
    
      14  cups
    
      15  dbus
    
      16  expat
    
      17  gdk-pixbuf2
    
      18  glib2
    
      19  glibc
    
      20  gcc-libs
    
      21  graphite
    
      22  gtk3
    
      23  libdrm
    
      24  libglvnd
    
      25  libnotify
    
      26  libusb
    
      27  libx11
    
      28  libxcomposite
    
      29  libxdamage
    
      30  libxext
    
      31  libxfixes
    
      32  libxkbcommon
    
      33  libxrandr
    
      34  mesa
    
      35  nspr
    
      36  nss
    
      37  openssl
    
      38  pango
    
      39  systemd-libs
    
      40  xdg-utils
    
      41  xz
    
      42)
    
      43options=(!strip)
    
      44source_x86_64=('https://persistent.oaistatic.com/codex-app-prod/linux/deb/latest/chatgpt_amd64.deb')
    
      45sha256sums_x86_64=('a9bf91a368f9f7c4eea38082a9fb8fb46b8d005b719a6d7715d2e5a1982c38eb')
    
      46
    
      47package() {
    
      48  bsdtar -xOf "${srcdir}/chatgpt_amd64.deb" data.tar.xz | bsdtar -xf - -C "${pkgdir}"
    
      49}
    
      50

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-02 00:00:32	Low	2
2026-10-01 00:02:06	Low	2
2026-09-30 00:20:07	Low	2
2026-09-29 00:07:46	Low	2
2026-09-28 00:28:32	Low	2
2026-09-27 00:07:07	Low	2
2026-09-26 00:12:15	Low	2
2026-09-25 00:03:36	Low	2
2026-09-24 00:24:14	Low	2
2026-09-23 00:28:13	Low	2
2026-09-22 00:15:14	Low	2
2026-09-21 00:26:32	Low	2
2026-09-20 00:25:31	Low	2
2026-09-19 00:25:36	Low	2
2026-09-18 00:17:11	Low	2
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2