paseo-desktop-git-bin
LOW
maintainer xpufx
0 votes
scanned 2026-09-08 01:15:25.605207
Why flagged
Package installs a prebuilt Electron binary from the maintainer's GitHub release, which is a supply-chain risk if compromised, but the source is plausibly project-owned and checksums are pinned; no active code execution or exfiltration is present.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Low
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): Package installs a prebuilt Electron binary from the maintainer's GitHub release, which is a supply-chain risk if compromised, but the source is plausibly project-owned and checksums are pinned; no active code execution or exfiltration is present.
PKGBUILD
1
# Maintainer: xpufx <github@xpufx.com>
2
# Prebuilt companion to paseo-desktop-git: same Electron tree (built from
3
# upstream/main), repacked from our release asset so users skip the build.
4
# _commit pins the upstream commit; _asset/_bin_sha pin the prebuilt tarball
5
# (unversioned filename, content rolls — sha is bumped every cycle).
6
7
pkgname=paseo-desktop-git-bin
8
pkgver=0.7.2.r57.g1f5b6143d
9
pkgrel=1
10
_commit='1f5b6143d603ebecc678daf76d407938175be044'
11
_asset='Paseo-0.7.2-x64.tar.gz'
12
_bin_sha='666b3d712ea5d7341b41f48ccd7694f261a3277175a5af1f3bbb1bebe6cb6439'
13
_icon_sha='585d202ff6a6e41bcd5c7464a1c4889b78977cea000f7b88ba1f67f3d9fff0bd'
14
_pkgdesc_base='One interface for all your Claude Code, Codex and OpenCode agents.'
15
pkgdesc='One interface for all your Claude Code, Codex and OpenCode agents. (built from main 2026-09-07 @1f5b614)'
16
arch=('x86_64')
17
url="https://paseo.sh"
18
license=("Apache-2.0")
19
depends=(libxkbcommon libxcb libgcc gtk3 libxext libx11 libcups nspr mesa dbus pango libxcomposite libxrandr nodejs glib2 nss libxdamage alsa-lib systemd-libs bash hicolor-icon-theme cairo at-spi2-core expat libstdc++ libxfixes)
20
provides=("paseo=${pkgver}" "paseo-desktop-git")
21
conflicts=(paseo paseo-bin paseo-appimage paseo-desktop-bin paseo-desktop-bin-beta paseo-desktop-bin-edge paseo-desktop-git)
22
source=("Paseo-git-bin.tar.gz::https://github.com/xpufx/xpufx-pkgs/releases/download/arch-x86_64-current/${_asset}"
23
"icon.png::https://raw.githubusercontent.com/getpaseo/paseo/${_commit}/packages/desktop/assets/icon.png")
24
sha256sums=("$_bin_sha"
25
"$_icon_sha")
26
options=('!strip')
27
28
package() {
29
cd "$srcdir"
30
tar -xzf "Paseo-git-bin.tar.gz"
31
# electron-builder tarballs wrap linux-unpacked either at root or one
32
# level down — locate the Paseo binary instead of assuming the layout.
33
_bindir=$(find "$srcdir" -maxdepth 3 -name Paseo -type f -printf '%h\n' 2>/dev/null | head -n1)
34
if [ -z "$_bindir" ]; then
35
echo "Paseo binary not found in tarball" >&2
36
find "$srcdir" -maxdepth 3 2>/dev/null | head -n 40
37
exit 1
38
fi
39
echo "Using unpacked: $_bindir"
40
mkdir -p "${pkgdir}/opt/Paseo"
41
cp -a "${_bindir}/." "${pkgdir}/opt/Paseo/"
42
43
# Desktop file and icons — match paseo-desktop-git (/opt/Paseo/Paseo).
44
mkdir -p "${pkgdir}/usr/share/applications" "${pkgdir}/usr/share/icons"
45
install -Dm644 "$srcdir/icon.png" "${pkgdir}/usr/share/icons/hicolor/512x512/apps/Paseo.png"
46
install -Dm644 "$srcdir/icon.png" "${pkgdir}/usr/share/icons/hicolor/512x512/apps/paseo.png"
47
install -Dm644 /dev/stdin "${pkgdir}/usr/share/applications/Paseo.desktop" <<DESKTOP
48
[Desktop Entry]
49
Name=Paseo
50
Comment=One interface for all your Claude Code, Codex and OpenCode agents
51
Exec=/opt/Paseo/Paseo %U
52
Icon=Paseo
53
Type=Application
54
Categories=Development;
55
StartupWMClass=Paseo
56
MimeType=x-scheme-handler/paseo;
57
DESKTOP
58
install -Dm644 "${pkgdir}/usr/share/applications/Paseo.desktop" "${pkgdir}/usr/share/applications/paseo.desktop"
59
60
# Provide /usr/bin/paseo as symlink to bundled CLI (mutually exclusive with cli)
61
mkdir -p "${pkgdir}/usr/bin"
62
ln -sf /opt/Paseo/resources/bin/paseo "${pkgdir}/usr/bin/paseo"
63
64
chmod -R go-w "${pkgdir}/opt" "${pkgdir}/usr" 2>/dev/null || true
65
find "${pkgdir}/opt" "${pkgdir}/usr" -type d -exec chmod 755 {} + 2>/dev/null || true
66
chown -R root:root "${pkgdir}" 2>/dev/null || true
67
chmod 755 "${pkgdir}/opt/Paseo/Paseo" "${pkgdir}/opt/Paseo/resources/bin/paseo" 2>/dev/null || true
68
}
69
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-08 01:15:25 | Low | 2 |