openai-codex-desktop-bin

LOW

maintainer aryklein 0 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

Downloads a prebuilt Debian binary from persistent.oaistatic.com, which is plausibly OpenAI's own CDN infrastructure, with a pinned sha256 checksum; the main concern is that this is an unofficial/unverified CDN host rather than a canonical release page, but the checksum mitigates swap risk and the package otherwise does nothing suspicious.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 80%): Downloads a prebuilt Debian binary from persistent.oaistatic.com, which is plausibly OpenAI's own CDN infrastructure, with a pinned sha256 checksum; the main concern is that this is an unofficial/unverified CDN host rather than a canonical release page, but the checksum mitigates swap risk and the package otherwise does nothing suspicious.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:24 source=("https://persistent.oaistatic.com/codex-app-prod/linux/deb/pool/main/c/chatgpt/${_deb}")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Ary Kleinerman <kleinerman at gmail dot com>
    
      2
    
      3pkgname=openai-codex-desktop-bin
    
      4pkgver=26.1007.71326
    
      5pkgrel=1
    
      6pkgdesc='ChatGPT desktop application by OpenAI (upstream Debian binary)'
    
      7arch=('x86_64')
    
      8url='https://developers.openai.com/codex/app'
    
      9license=('LicenseRef-proprietary')
    
      10depends=(
    
      11  'alsa-lib' 'at-spi2-core' 'cairo' 'dbus' 'expat' 'gcc-libs'
    
      12  'gdk-pixbuf2' 'glib2' 'glibc' 'gtk3' 'libcups' 'libdrm' 'libglvnd'
    
      13  'libnotify' 'libusb' 'libx11' 'libxcb' 'libxcomposite' 'libxdamage'
    
      14  'libxext' 'libxfixes' 'libxkbcommon' 'libxrandr' 'mesa' 'nspr' 'nss'
    
      15  'openssl' 'pango' 'systemd-libs' 'tpm2-tss' 'vulkan-driver' 'wayland'
    
      16  'xdg-utils' 'xz'
    
      17)
    
      18optdepends=('git: Git repository integration')
    
      19provides=("chatgpt=${pkgver}")
    
      20conflicts=('chatgpt' 'chatgpt-bin')
    
      21replaces=('chatgpt-bin')
    
      22options=('!strip' '!debug')
    
      23_deb="chatgpt_${pkgver}_amd64.deb"
    
      24source=("https://persistent.oaistatic.com/codex-app-prod/linux/deb/pool/main/c/chatgpt/${_deb}")
    
      25noextract=("${_deb}")
    
      26sha256sums=('0e006b4931712f5a90d4cd04972c6e0b533cedcdfdb2b51946d5b9367471f556')
    
      27
    
      28package() {
    
      29  bsdtar -xOf "${srcdir}/${_deb}" data.tar.xz | bsdtar -xf - -C "$pkgdir" ./usr
    
      30
    
      31  rm -r "$pkgdir/usr/share/lintian"
    
      32  install -Dm644 "$pkgdir/usr/share/doc/chatgpt/copyright" \
    
      33    "$pkgdir/usr/share/licenses/$pkgname/copyright"
    
      34  ln -s /usr/lib/chatgpt/LICENSES.chromium.html \
    
      35    "$pkgdir/usr/share/licenses/$pkgname/LICENSES.chromium.html"
    
      36
    
      37  rm "$pkgdir/usr/bin/chatgpt"
    
      38  install -Dm755 /dev/stdin "$pkgdir/usr/bin/chatgpt" << 'EOF'
    
      39#!/bin/sh
    
      40set -eu
    
      41
    
      42args=
    
      43if [ -n "${WAYLAND_DISPLAY-}" ] || [ "${XDG_SESSION_TYPE-}" = wayland ]; then
    
      44  case " $* " in
    
      45    *' --ozone-platform='* | *' --ozone-platform '*) ;;
    
      46    *) args='--ozone-platform=wayland' ;;
    
      47  esac
    
      48fi
    
      49
    
      50exec /usr/lib/chatgpt/codex-launcher $args "$@"
    
      51EOF
    
      52}
    
      53

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Low	3
2026-10-16 00:12:47	Low	3
2026-10-15 17:14:49	Low	3
2026-10-15 17:12:54	Medium	3