openbubbles-app-git
LOW
maintainer kanya-approve
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package builds from a legitimate project Git repository and uses a standard Flutter SDK from Google's official infrastructure; the non-whitelisted host is a known official source, and the source code is openly reviewable, making the risk low despite SKIP'd checksum on the Git source.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package builds from a legitimate project Git repository and uses a standard Flutter SDK from Google's official infrastructure; the non-whitelisted host is a known official source, and the source code is openly reviewable, making the risk low despite SKIP'd checksum on the Git source.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:41
"flutter-${_flutterver}.tar.xz::https://storage.googleapis.com/flutter_infra_release/releases/stable/linux/flutter_linux_${_flutterver}-stable.tar.xz"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Brian
2
3
_gitname=openbubbles-app
4
pkgname=openbubbles-app-git
5
pkgver=1.15.0.227
6
pkgrel=2
7
pkgdesc="OpenBubbles messaging app (iMessage client, built from git)"
8
arch=('x86_64')
9
url="https://github.com/OpenBubbles/openbubbles-app"
10
license=('Apache-2.0')
11
depends=(
12
'gtk3'
13
'hicolor-icon-theme'
14
'libayatana-appindicator'
15
'libnotify'
16
'libsecret'
17
'mpv'
18
'webkit2gtk-4.1'
19
)
20
makedepends=(
21
'clang'
22
'cmake'
23
'curl'
24
'git'
25
'ninja'
26
'pkgconf'
27
'protobuf'
28
'rust'
29
'unzip'
30
)
31
provides=('openbubbles-app')
32
conflicts=('openbubbles-app' 'openbubbles-app-bin')
33
# !lto: rustpush links vendored openssl/ring, whose CPUID symbols live in asm that LTO drops
34
options=('!strip' '!debug' '!lto')
35
36
_flutterver=3.24.0
37
_fluttersum=d52a5d12f17d8bcf868d1ccc01fe0f7ffb05b53d9628aa21b07a18f9d33621f2
38
39
source=(
40
"$_gitname::git+https://github.com/OpenBubbles/openbubbles-app.git#branch=rustpush"
41
"flutter-${_flutterver}.tar.xz::https://storage.googleapis.com/flutter_infra_release/releases/stable/linux/flutter_linux_${_flutterver}-stable.tar.xz"
42
"openbubbles.desktop"
43
)
44
sha256sums=(
45
'SKIP'
46
"$_fluttersum"
47
'57b3eec669f620ec6259a3e98669b80bd82f8a7a7b1cbf8f53301e0c2f4d457b'
48
)
49
50
pkgver() {
51
cd "$srcdir/$_gitname"
52
local _ver
53
_ver="$(awk '/^version:/{print $2; exit}' pubspec.yaml | tr '+' '.')"
54
printf '%s.r%s.g%s' "$_ver" "$(git rev-list --count HEAD)" "$(git rev-parse --short=8 HEAD)"
55
}
56
57
prepare() {
58
cd "$srcdir/$_gitname"
59
export GIT_CONFIG_GLOBAL="$srcdir/.gitconfig"
60
git config --global url."https://github.com/".insteadOf "git@github.com:"
61
git submodule update --init --recursive
62
63
# upstream CI copies the legacy fairplay cert to each numbered key id the source embeds
64
install -d rustpush/certs/fairplay
65
grep -oP 'include_cert!\("\K[^"]+' rustpush/src/activation.rs | while read -r _n; do
66
cp rustpush/certs/legacy-fairplay/fairplay.crt "rustpush/certs/fairplay/$_n.crt"
67
cp rustpush/certs/legacy-fairplay/fairplay.pem "rustpush/certs/fairplay/$_n.pem"
68
done
69
70
# relax the flutter template's -Werror; newer system libs (libayatana-appindicator)
71
# emit deprecation warnings that would otherwise abort the plugin builds
72
sed -i 's/-Wall -Werror/-Wall/' linux/CMakeLists.txt
73
}
74
75
build() {
76
export RUSTUP_HOME="${RUSTUP_HOME:-$HOME/.rustup}"
77
export HOME="$srcdir/.home"
78
export PUB_CACHE="$srcdir/.pub-cache"
79
export CARGO_HOME="$srcdir/.cargo"
80
export GIT_CONFIG_GLOBAL="$srcdir/.gitconfig"
81
export PATH="$srcdir/flutter/bin:$srcdir/flutter/bin/cache/dart-sdk/bin:$PATH"
82
mkdir -p "$HOME"
83
84
git config --global --add safe.directory '*'
85
86
flutter config --no-analytics --enable-linux-desktop >/dev/null
87
flutter --version
88
89
cd "$srcdir/$_gitname"
90
flutter pub get
91
flutter build linux --release
92
}
93
94
package() {
95
cd "$srcdir/$_gitname"
96
local _bundle="build/linux/x64/release/bundle"
97
98
install -dm755 "$pkgdir/usr/lib/openbubbles-app"
99
cp -a "$_bundle/." "$pkgdir/usr/lib/openbubbles-app/"
100
101
if [[ ! -e "$pkgdir/usr/lib/openbubbles-app/lib/libmpv.so.1" ]]; then
102
ln -s /usr/lib/libmpv.so.2 "$pkgdir/usr/lib/openbubbles-app/lib/libmpv.so.1"
103
fi
104
105
install -dm755 "$pkgdir/usr/bin"
106
cat > "$pkgdir/usr/bin/openbubbles" <<'EOF'
107
#!/bin/bash
108
APPDIR="/usr/lib/openbubbles-app"
109
export LD_LIBRARY_PATH="$APPDIR/lib:$APPDIR:${LD_LIBRARY_PATH}"
110
exec "$APPDIR/bluebubbles" "$@"
111
EOF
112
chmod 755 "$pkgdir/usr/bin/openbubbles"
113
114
install -Dm644 "$srcdir/openbubbles.desktop" \
115
"$pkgdir/usr/share/applications/openbubbles.desktop"
116
install -Dm644 "$_bundle/data/flutter_assets/assets/icon/icon.png" \
117
"$pkgdir/usr/share/icons/hicolor/256x256/apps/openbubbles.png"
118
}
119
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |