openai-chatgpt

maintainer WH-2099 · 2 votes · scanned 2026-08-18 00:03:42.021799

LOW

Why flagged Downloads official ChatGPT .deb packages directly from OpenAI's own CDN (persistent.oaistatic.com) with pinned SHA256 checksums; the flagged 'non-standard host' is plausibly OpenAI's own infrastructure, and the bundled 'OpenAI-Proprietary-Notice' is a local data file — no obfuscation, no remote code execution, no exfiltration.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 85%): Downloads official ChatGPT .deb packages directly from OpenAI's own CDN (persistent.oaistatic.com) with pinned SHA256 checksums; the flagged 'non-standard host' is plausibly OpenAI's own infrastructure, and the bundled 'OpenAI-Proprietary-Notice' is a local data file — no obfuscation, no remote code execution, no exfiltration.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:62 source_x86_64=("https://persistent.oaistatic.com/codex-app-prod/linux/deb/pool/main/c/chatgpt/chatgpt_${pkgver}_amd64.deb")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: WH-2099 <wh2099@pm.me>
    
      2pkgname=openai-chatgpt
    
      3pkgver=26.803.81509
    
      4pkgrel=3
    
      5pkgdesc="OpenAI's ChatGPT desktop app for Linux (preview)"
    
      6arch=('x86_64' 'aarch64')
    
      7url='https://chatgpt.com/download/'
    
      8license=('LicenseRef-proprietary')
    
      9depends=(
    
      10  'alsa-lib'
    
      11  'at-spi2-core'
    
      12  'bash'
    
      13  'cairo'
    
      14  'coreutils'
    
      15  'dbus'
    
      16  'expat'
    
      17  'gdk-pixbuf2'
    
      18  'glib2'
    
      19  'glibc'
    
      20  'gtk3'
    
      21  'libcups'
    
      22  'libdrm'
    
      23  'libgcc'
    
      24  'libglvnd'
    
      25  'libnotify'
    
      26  'libstdc++'
    
      27  'libusb'
    
      28  'libx11'
    
      29  'libxcb'
    
      30  'libxcomposite'
    
      31  'libxdamage'
    
      32  'libxext'
    
      33  'libxfixes'
    
      34  'libxkbcommon'
    
      35  'libxrandr'
    
      36  'mesa'
    
      37  'nspr'
    
      38  'nss'
    
      39  'pango'
    
      40  'systemd-libs'
    
      41  'tar'
    
      42  'xdg-utils'
    
      43  'xz'
    
      44)
    
      45depends_x86_64=(
    
      46  'graphite'
    
      47  'openssl'
    
      48)
    
      49optdepends=(
    
      50  'apparmor: allow the Electron sandbox to use user namespaces when AppArmor is enabled'
    
      51  'git: repository workflows'
    
      52  'openssh: remote SSH workspaces'
    
      53  'org.freedesktop.secrets: secure credential storage'
    
      54  'pipewire: WebRTC desktop sharing under Wayland'
    
      55)
    
      56provides=("openai-chatgpt-bin=$pkgver")
    
      57conflicts=('chatgpt')
    
      58backup=('etc/apparmor.d/chatgpt')
    
      59options=('!strip' '!debug')
    
      60install='openai-chatgpt.install'
    
      61source=('OpenAI-Proprietary-Notice')
    
      62source_x86_64=("https://persistent.oaistatic.com/codex-app-prod/linux/deb/pool/main/c/chatgpt/chatgpt_${pkgver}_amd64.deb")
    
      63source_aarch64=("https://persistent.oaistatic.com/codex-app-prod/linux/deb/pool/main/c/chatgpt/chatgpt_${pkgver}_arm64.deb")
    
      64sha256sums=('45cffaa1435cab2a50b340850bb2e9684e8c561635d091465d576e5dcf679af5')
    
      65sha256sums_x86_64=('a9bf91a368f9f7c4eea38082a9fb8fb46b8d005b719a6d7715d2e5a1982c38eb')
    
      66sha256sums_aarch64=('f38fcc194eca9ab0327dc10c92340681eae77c5d75164df700384ce2adaccbc1')
    
      67
    
      68package() {
    
      69  bsdtar --no-same-owner -xf data.tar.xz -C "$pkgdir" ./etc ./usr
    
      70  install -Dm644 OpenAI-Proprietary-Notice "$pkgdir/usr/share/licenses/$pkgname/PROPRIETARY"
    
      71}
    
      72

Changes since previous scan

--- PKGBUILD @ 2026-08-11 19:31
+++ PKGBUILD @ 2026-08-18 00:03
@@ -1,11 +1,11 @@
 # Maintainer: WH-2099 <wh2099@pm.me>
 pkgname=openai-chatgpt
 pkgver=26.803.81509
-pkgrel=1
-pkgdesc='Official ChatGPT desktop app for Linux with Codex (preview)'
+pkgrel=3
+pkgdesc="OpenAI's ChatGPT desktop app for Linux (preview)"
 arch=('x86_64' 'aarch64')
-url='https://chatgpt.com/codex/'
-license=('LicenseRef-OpenAI-Terms-of-Use')
+url='https://chatgpt.com/download/'
+license=('LicenseRef-proprietary')
 depends=(
   'alsa-lib'
   'at-spi2-core'
@@ -17,7 +17,6 @@
   'gdk-pixbuf2'
   'glib2'
   'glibc'
-  'graphite'
   'gtk3'
   'libcups'
   'libdrm'
@@ -37,30 +36,37 @@
   'mesa'
   'nspr'
   'nss'
-  'openssl'
   'pango'
   'systemd-libs'
+  'tar'
   'xdg-utils'
   'xz'
 )
+depends_x86_64=(
+  'graphite'
+  'openssl'
+)
 optdepends=(
+  'apparmor: allow the Electron sandbox to use user namespaces when AppArmor is enabled'
   'git: repository workflows'
+  'openssh: remote SSH workspaces'
   'org.freedesktop.secrets: secure credential storage'
+  'pipewire: WebRTC desktop sharing under Wayland'
 )
-provides=("openai-chatgpt-bin=$pkgver" "chatgpt-desktop=$pkgver")
-conflicts=('openai-chatgpt-bin' 'chatgpt' 'chatgpt-desktop' 'chatgpt-desktop-bin' 'openai-codex-desktop')
-replaces=('openai-chatgpt-bin')
+provides=("openai-chatgpt-bin=$pkgver")
+conflicts=('chatgpt')
+backup=('etc/apparmor.d/chatgpt')
 options=('!strip' '!debug')
-source=('OpenAI-Terms-of-Use')
+install='openai-chatgpt.install'
+source=('OpenAI-Proprietary-Notice')
 source_x86_64=("https://persistent.oaistatic.com/codex-app-prod/linux/deb/pool/main/c/chatgpt/chatgpt_${pkgver}_amd64.deb")
 source_aarch64=("https://persistent.oaistatic.com/codex-app-prod/linux/deb/pool/main/c/chatgpt/chatgpt_${pkgver}_arm64.deb")
-sha256sums=('c8d20129e5b1e349f7f03a878334298bf3a8d7ca4e8ba66ba83869433aa93bac')
+sha256sums=('45cffaa1435cab2a50b340850bb2e9684e8c561635d091465d576e5dcf679af5')
 sha256sums_x86_64=('a9bf91a368f9f7c4eea38082a9fb8fb46b8d005b719a6d7715d2e5a1982c38eb')
 sha256sums_aarch64=('f38fcc194eca9ab0327dc10c92340681eae77c5d75164df700384ce2adaccbc1')
 
 package() {
-  bsdtar --no-same-owner -xf data.tar.xz -C "$pkgdir" ./usr
-  rm -r "$pkgdir/usr/share/lintian"
-  install -Dm644 OpenAI-Terms-of-Use "$pkgdir/usr/share/licenses/$pkgname/OpenAI-Terms-of-Use"
+  bsdtar --no-same-owner -xf data.tar.xz -C "$pkgdir" ./etc ./usr
+  install -Dm644 OpenAI-Proprietary-Notice "$pkgdir/usr/share/licenses/$pkgname/PROPRIETARY"
 }
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	LOW	3
2026-08-17 00:18:29	LOW	3
2026-08-16 00:03:42	LOW	3
2026-08-15 00:26:13	LOW	3
2026-08-14 00:03:41	LOW	3
2026-08-13 00:17:07	LOW	3
2026-08-12 00:27:08	LOW	3
2026-08-11 21:26:06	LOW	3
2026-08-11 21:21:47	MEDIUM	2
2026-08-11 19:31:27	LOW	3
2026-08-11 19:21:46	MEDIUM	2