openai-codex-desktop

MEDIUM

maintainer parsiad 11 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads a prebuilt .deb from a non-standard host (persistent.oaistatic.com), which is not a standard release domain for OpenAI; while checksums are provided and the host appears related to OpenAI, the use of a static, unverifiable binary from a less common domain introduces a supply-chain risk if the domain were compromised or spoofed.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:62 "${_deb_x86_64}::https://persistent.oaistatic.com/codex-app-prod/linux/deb/pool/main/c/chatgpt/chatgpt_${pkgver}_amd64.deb"

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt .deb from a non-standard host (persistent.oaistatic.com), which is not a standard release domain for OpenAI; while checksums are provided and the host appears related to OpenAI, the use of a static, unverifiable binary from a less common domain introduces a supply-chain risk if the domain were compromised or spoofed.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Parsiad Azimzadeh <parsiad.azimzadeh at gmail dot com>
    
      2# Maintainer: mothran
    
      3# Official downloads: https://chatgpt.com/codex/
    
      4
    
      5pkgname=openai-codex-desktop
    
      6pkgver=26.803.81509
    
      7pkgrel=9
    
      8pkgdesc="Official ChatGPT desktop app with Codex"
    
      9arch=('x86_64' 'aarch64')
    
      10url="https://chatgpt.com/codex/"
    
      11license=('custom')
    
      12
    
      13depends=(
    
      14  'alsa-lib'
    
      15  'at-spi2-core'
    
      16  'bash'
    
      17  'cairo'
    
      18  'dbus'
    
      19  'expat'
    
      20  'gcc-libs'
    
      21  'gdk-pixbuf2'
    
      22  'glib2'
    
      23  'glibc'
    
      24  'gtk3'
    
      25  'libcups'
    
      26  'libdrm'
    
      27  'libglvnd'
    
      28  'libnotify'
    
      29  'libusb'
    
      30  'libx11'
    
      31  'libxcb'
    
      32  'libxcomposite'
    
      33  'libxdamage'
    
      34  'libxext'
    
      35  'libxfixes'
    
      36  'libxkbcommon'
    
      37  'libxrandr'
    
      38  'mesa'
    
      39  'nspr'
    
      40  'nss'
    
      41  'openssl'
    
      42  'pango'
    
      43  'systemd-libs'
    
      44  'xdg-utils'
    
      45  'xz'
    
      46)
    
      47
    
      48optdepends=(
    
      49  'apparmor: load the bundled user-namespace profile on AppArmor systems'
    
      50  'git: version control integration'
    
      51)
    
      52
    
      53makedepends=('libarchive')
    
      54provides=('chatgpt')
    
      55conflicts=('chatgpt')
    
      56options=('!debug' '!strip')
    
      57
    
      58_deb_x86_64="chatgpt_${pkgver}_amd64.deb"
    
      59_deb_aarch64="chatgpt_${pkgver}_arm64.deb"
    
      60source=('chatgpt-launcher.sh')
    
      61source_x86_64=(
    
      62  "${_deb_x86_64}::https://persistent.oaistatic.com/codex-app-prod/linux/deb/pool/main/c/chatgpt/chatgpt_${pkgver}_amd64.deb"
    
      63)
    
      64source_aarch64=(
    
      65  "${_deb_aarch64}::https://persistent.oaistatic.com/codex-app-prod/linux/deb/pool/main/c/chatgpt/chatgpt_${pkgver}_arm64.deb"
    
      66)
    
      67noextract=("${_deb_x86_64}" "${_deb_aarch64}")
    
      68sha256sums=('4e3ca9302600bed268f8fd3ba2c9ac2f1ceb99da139ed71c50db0289b118d06f')
    
      69sha256sums_x86_64=('a9bf91a368f9f7c4eea38082a9fb8fb46b8d005b719a6d7715d2e5a1982c38eb')
    
      70sha256sums_aarch64=('f38fcc194eca9ab0327dc10c92340681eae77c5d75164df700384ce2adaccbc1')
    
      71
    
      72package() {
    
      73  cd "${srcdir}"
    
      74
    
      75  local deb_var="_deb_${CARCH}"
    
      76  local deb="${!deb_var}"
    
      77
    
      78  bsdtar -xOf "${deb}" data.tar.xz |
    
      79    bsdtar --no-same-owner -xf - -C "${pkgdir}"
    
      80
    
      81  rm "${pkgdir}/usr/bin/chatgpt"
    
      82  install -Dm755 chatgpt-launcher.sh "${pkgdir}/usr/bin/chatgpt"
    
      83  ln -s chatgpt "${pkgdir}/usr/bin/codex-desktop"
    
      84
    
      85  install -Dm644 "${pkgdir}/usr/share/doc/chatgpt/copyright" \
    
      86    "${pkgdir}/usr/share/licenses/${pkgname}/copyright"
    
      87
    
      88  # Debian package-policy files are not used on Arch Linux.
    
      89  rm -rf "${pkgdir}/usr/share/doc" "${pkgdir}/usr/share/lintian"
    
      90}
    
      91

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2
2026-08-29 00:29:17	Medium	2