photon-studio-bin

MEDIUM
maintainer sfs 1 votes scanned 2026-11-01 00:21:48.120785
View on AUR
Why flagged

The package downloads a prebuilt Flatpak from a non-standard, non-whitelisted host (tenzen.studio) with a SKIP'd checksum, representing a supply-chain risk if the host were compromised or the artifact swapped, though it is plausibly the official source.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:36 "Photon-Studio-${pkgver}-linux-x64.flatpak::https://tenzen.studio/api/v1/photon/download?platform=linux&arch=x64"
Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 85%): The package downloads a prebuilt Flatpak from a non-standard, non-whitelisted host (tenzen.studio) with a SKIP'd checksum, representing a supply-chain risk if the host were compromised or the artifact swapped, though it is plausibly the official source.

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: sfs sfslinux@gmail.com
2
3pkgname=photon-studio-bin
4pkgver=0.1.20
5pkgrel=2
6pkgdesc="A desktop local-first image editor with layers and native PSD support (Extracted from Flatpak)"
7arch=('x86_64')
8url="https://tenzen.studio/photon/"
9license=('LicenseRef-Photon-Studio')
10
11makedepends=('flatpak')
12depends=(
13 'alsa-lib'
14 'at-spi2-core'
15 'atk'
16 'gdk-pixbuf2'
17 'gtk3'
18 'libcups'
19 'libsecret'
20 'libx11'
21 'libxcomposite'
22 'libxdamage'
23 'libxext'
24 'libxfixes'
25 'libxkbcommon'
26 'libxrandr'
27 'mesa'
28 'nspr'
29 'nss'
30)
31options=('!strip')
32
33source=(
34 #В России качайте через браузер с ...
35 #Альтернатива https://www.techspot.com/downloads/7907-photon-studio.html
36 "Photon-Studio-${pkgver}-linux-x64.flatpak::https://tenzen.studio/api/v1/photon/download?platform=linux&arch=x64"
37 "photon-studio.png::https://tenzen.studio/assets/brand/photon-logo.png"
38 "update.sh"
39)
40sha256sums=('SKIP'
41 'd49bb3c106257c1f75995fa793737113dc87418be5bec19388e6a523ffaafc18'
42 'c1ef24a0003e94bdcd17176e2e689aac6d224c31656733b64db2512baefabb1a'
43 )
44
45prepare() {
46 cd "$srcdir"
47
48 mkdir -p "$srcdir/fake-flatpak-home"
49
50 echo "==> Extracting Photon Studio Flatpak..."
51
52 FLATPAK_USER_DIR="$srcdir/fake-flatpak-home" \
53 flatpak install \
54 --user \
55 --bundle \
56 --noninteractive \
57 --assumeyes \
58 --no-deps \
59 "$srcdir/Photon-Studio-${pkgver}-linux-x64.flatpak"
60}
61
62package() {
63 local app_dir
64
65 install -dm755 "$pkgdir/opt/photon-studio"
66 install -dm755 "$pkgdir/usr/bin"
67 install -dm755 "$pkgdir/usr/share/applications"
68
69 install -Dm644 \
70 "$srcdir/photon-studio.png" \
71 "$pkgdir/usr/share/pixmaps/photon-studio.png"
72
73 echo "==> Locating extracted application..."
74
75 app_dir="$(
76 find "$srcdir/fake-flatpak-home" \
77 -type d \
78 -path '*/app/*/*/*/*' \
79 -print -quit
80 )"
81
82 if [[ -z "$app_dir" ]]; then
83 echo "ERROR: Photon Studio application directory not found"
84 exit 1
85 fi
86
87 echo "==> Application directory: $app_dir"
88
89 if [[ ! -d "$app_dir/files/lib/com.tenzen.photon" ]]; then
90 echo "ERROR: Photon Studio files directory not found"
91 exit 1
92 fi
93
94 cp -a --no-preserve=links \
95 "$app_dir/files/lib/com.tenzen.photon/." \
96 "$pkgdir/opt/photon-studio/"
97 #
98 # Desktop file
99 #
100 local desktop_file
101
102 desktop_file="$(
103 find "$srcdir/fake-flatpak-home" \
104 -type f \
105 -name '*.desktop' \
106 -path '*/export/share/applications/*' \
107 -print -quit
108 )"
109
110 if [[ -n "$desktop_file" ]]; then
111 install -Dm644 \
112 "$desktop_file" \
113 "$pkgdir/usr/share/applications/photon-studio.desktop"
114
115 sed -i \
116 's|^Exec=.*|Exec=photon-studio %U|' \
117 "$pkgdir/usr/share/applications/photon-studio.desktop"
118
119 sed -i \
120 's|^Icon=.*|Icon=photon-studio|' \
121 "$pkgdir/usr/share/applications/photon-studio.desktop"
122 else
123 cat > "$pkgdir/usr/share/applications/photon-studio.desktop" <<'EOF'
124[Desktop Entry]
125Name=Photon Studio
126Comment=Desktop image editor with layers and native PSD support
127Exec=photon-studio %U
128Terminal=false
129Type=Application
130Icon=photon-studio
131Categories=Graphics;Photography;
132MimeType=image/jpeg;image/png;image/webp;image/tiff;image/vnd.adobe.photoshop;
133StartupWMClass=Photon Studio
134EOF
135 fi
136
137 #
138 # Exported icons
139 #
140 local icon_dir="$srcdir/fake-flatpak-home"
141
142 if find "$icon_dir" \
143 -type d \
144 -path '*/export/share/icons/*' \
145 -print -quit | grep -q .; then
146
147 install -dm755 "$pkgdir/usr/share/icons"
148
149 find "$icon_dir" \
150 -type d \
151 -path '*/export/share/icons/*' \
152 -exec cp -a {} "$pkgdir/usr/share/icons/" \;
153 fi
154
155 #
156 # Launcher
157 #
158 cat > "$pkgdir/usr/bin/photon-studio" <<'EOF'
159#!/bin/sh
160exec /opt/photon-studio/photon-studio "$@"
161EOF
162
163 chmod 755 "$pkgdir/usr/bin/photon-studio"
164
165install -dm755 "$pkgdir/usr/share/licenses/$pkgname"
166
167cat > "$pkgdir/usr/share/licenses/$pkgname/LICENSE" <<'EOF'
168Photon Studio is proprietary software.
169
170The applicable license terms are provided by the copyright holder,
171Tenzen Studio.
172
173Upstream:
174https://tenzen.studio/photon/
175EOF
176}
177

Scan history

Scanned at (UTC)SeverityRules
2026-11-01 00:21:48 Medium 2
2026-10-31 00:07:41 Medium 2
2026-10-30 00:29:30 Medium 2
2026-10-29 00:13:55 Medium 2
2026-10-28 00:06:54 Medium 2
2026-10-27 00:23:28 Medium 2
2026-10-26 00:12:40 Medium 2
2026-10-25 00:20:48 Medium 2
2026-10-24 00:14:55 Medium 2
2026-10-23 00:02:19 Medium 2
2026-10-22 00:13:10 Medium 2
2026-10-21 00:12:50 Medium 2
2026-10-20 00:10:31 Medium 2
2026-10-19 00:03:55 Medium 2
2026-10-18 00:06:55 Medium 2
2026-10-17 00:21:55 Medium 2
2026-10-16 00:12:47 Medium 2
2026-10-15 00:28:05 Medium 2
2026-10-14 00:06:47 Medium 2
2026-10-13 00:23:45 Medium 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion