openscreen-git

maintainer psychosomat · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package builds from a git source but extracts and installs an AppImage built from that source, which is then used in the package; while the source is open, the final binary artifact is not directly built from source in a verifiable way, introducing a supply-chain risk if the AppImage is tampered with during build.

Triggered rules

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package builds from a git source but extracts and installs an AppImage built from that source, which is then used in the package; while the source is open, the final binary artifact is not directly built from source in a verifiable way, introducing a supply-chain risk if the AppImage is tampered with during build.

PKGBUILD

      1# Maintainer: psychosomat <hello@ddark.dev>
    
      2
    
      3pkgname=openscreen-git
    
      4pkgver=1.7.0.r21.gf508a21
    
      5pkgrel=1
    
      6pkgdesc="Create stunning demos for free. Open-source, no subscriptions, no watermarks, and free for commercial use. An alternative to Screen Studio."
    
      7arch=('x86_64')
    
      8url="https://github.com/getopenscreen/openscreen"
    
      9license=('MIT')
    
      10depends=('fuse')
    
      11makedepends=('git' 'nodejs' 'npm')
    
      12conflicts=('openscreen' 'openscreen-appimage' 'openscreen-bin')
    
      13options=(!strip !debug)
    
      14source=("openscreen-git::git+https://github.com/getopenscreen/openscreen" "openscreen" "openscreen.desktop" "Build_AppImage_Only.patch")
    
      15sha256sums=('SKIP' 'SKIP' 'SKIP' 'SKIP')
    
      16
    
      17pkgver() {
    
      18    cd "$srcdir/openscreen-git"
    
      19    local latest_tag
    
      20    latest_tag=$(git tag --sort=-v:refname | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' | head -n1)
    
      21    if [[ -n $latest_tag ]]; then
    
      22        local commits sha
    
      23        commits=$(git rev-list --count "$latest_tag"..HEAD)
    
      24        sha=$(git rev-parse --short HEAD)
    
      25        echo "${latest_tag#v}.r${commits}.g${sha}"
    
      26    else
    
      27        printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
    
      28    fi
    
      29}
    
      30
    
      31prepare() {
    
      32    cd "$srcdir/openscreen-git"
    
      33    patch -p1 < "$srcdir/Build_AppImage_Only.patch"
    
      34    npm i
    
      35}
    
      36
    
      37build() {
    
      38    cd "$srcdir/openscreen-git"
    
      39    npm run build
    
      40
    
      41    app=$(find release -regex ".*\.AppImage" | head -n1)
    
      42    appdir=$(dirname "$app")
    
      43
    
      44    echo "==> Extracting AppImage..."
    
      45    chmod +x "$app"
    
      46    (
    
      47        cd "$appdir"
    
      48        "$app" --appimage-extract > /dev/null
    
      49    )
    
      50}
    
      51
    
      52package() {
    
      53    cd "$srcdir/openscreen-git"
    
      54
    
      55    app=$(find release -regex ".*\.AppImage" | head -n1)
    
      56    appdir=$(dirname "$app")
    
      57
    
      58    install -Dm755 "$srcdir/openscreen" "$pkgdir/usr/bin/openscreen"
    
      59    install -Dm755 "$app" "$pkgdir/opt/openscreen/Openscreen.AppImage"
    
      60    install -Dm755 "$srcdir/openscreen.desktop" "$pkgdir/usr/share/applications/openscreen.desktop"
    
      61
    
      62    install -Dm644 LICENSE "$pkgdir/usr/share/licenses/openscreen-git/LICENSE"
    
      63
    
      64    icon_types="16 24 32 48 64 128 256 512 1024"
    
      65    for num in $icon_types; do
    
      66        install -Dm644 \
    
      67            "$appdir/squashfs-root/usr/share/icons/hicolor/${num}x${num}/apps/openscreen.png" \
    
      68            "$pkgdir/usr/share/icons/hicolor/${num}x${num}/apps/openscreen.png"
    
      69    done
    
      70}
    
      71

Changes since previous scan

--- PKGBUILD @ 2026-07-21 00:24
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,51 +1,45 @@
-# Maintainer: AImixAE <AImixAE[at]outlook[dot]com>
+# Maintainer: psychosomat <hello@ddark.dev>
 
 pkgname=openscreen-git
-pkgver=r500.e7d5f51
+pkgver=1.7.0.r21.gf508a21
 pkgrel=1
-pkgdesc="Create stunning screen recordings for free. Open-source, no subscriptions, no watermarks, and free for commercial use. An alternative to Screen Studio."
+pkgdesc="Create stunning demos for free. Open-source, no subscriptions, no watermarks, and free for commercial use. An alternative to Screen Studio."
 arch=('x86_64')
-url="https://github.com/siddharthvaddem/openscreen"
+url="https://github.com/getopenscreen/openscreen"
 license=('MIT')
 depends=('fuse')
 makedepends=('git' 'nodejs' 'npm')
-provides=()
-conflicts=('openscreen-appimage' 'openscreen-bin')
+conflicts=('openscreen' 'openscreen-appimage' 'openscreen-bin')
 options=(!strip !debug)
-source=("openscreen-git::git+$url" "openscreen" "openscreen.desktop" "Build_AppImage_Only.patch")
+source=("openscreen-git::git+https://github.com/getopenscreen/openscreen" "openscreen" "openscreen.desktop" "Build_AppImage_Only.patch")
 sha256sums=('SKIP' 'SKIP' 'SKIP' 'SKIP')
-
-_find_appimage() {
-    app="release/$pkgver/Openscreen-Linux-$pkgver.AppImage"
-    [[ ! -f "$app" ]] && app=$(find $srcdir/openscreen-$pkgver/release -regex ".*\.AppImage")
-
-    echo $app
-}
 
 pkgver() {
     cd "$srcdir/openscreen-git"
-
-    printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
+    local latest_tag
+    latest_tag=$(git tag --sort=-v:refname | grep -E '^v[0-9]+\.[0-9]+\.[0-9]+$' | head -n1)
+    if [[ -n $latest_tag ]]; then
+        local commits sha
+        commits=$(git rev-list --count "$latest_tag"..HEAD)
+        sha=$(git rev-parse --short HEAD)
+        echo "${latest_tag#v}.r${commits}.g${sha}"
+    else
+        printf "r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short HEAD)"
+    fi
 }
 
 prepare() {
-    patch -p0 < Build_AppImage_Only.patch
-
     cd "$srcdir/openscreen-git"
+    patch -p1 < "$srcdir/Build_AppImage_Only.patch"
     npm i
-
-    # if [[ -d "openscreen-$pkgver/release" ]]; then
-    #     echo "==> Clearing release dir"
-    #     rm -r "openscreen-$pkgver/release"
-    # fi
 }
 
 build() {
     cd "$srcdir/openscreen-git"
     npm run build
 
-    app=$(_find_appimage)
-    appdir=$(dirname $app)
+    app=$(find release -regex ".*\.AppImage" | head -n1)
+    appdir=$(dirname "$app")
 
     echo "==> Extracting AppImage..."
     chmod +x "$app"
@@ -55,20 +49,17 @@
     )
 }
 
-check() {
-    app=$(_find_appimage)
-    appdir=$(dirname $app)
+package() {
+    cd "$srcdir/openscreen-git"
 
-    [[ -f "$app" ]]
-}
-
-package() {
-    app=$(_find_appimage)
-    appdir=$(dirname $app)
+    app=$(find release -regex ".*\.AppImage" | head -n1)
+    appdir=$(dirname "$app")
 
     install -Dm755 "$srcdir/openscreen" "$pkgdir/usr/bin/openscreen"
     install -Dm755 "$app" "$pkgdir/opt/openscreen/Openscreen.AppImage"
     install -Dm755 "$srcdir/openscreen.desktop" "$pkgdir/usr/share/applications/openscreen.desktop"
+
+    install -Dm644 LICENSE "$pkgdir/usr/share/licenses/openscreen-git/LICENSE"
 
     icon_types="16 24 32 48 64 128 256 512 1024"
     for num in $icon_types; do

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 09:16:42	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2