pi-desktop-bin

MEDIUM

maintainer jadren 0 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

The package installs a prebuilt Electron binary from a GitHub release, which is an unverifiable executable artifact; while the source project is plausible, the lack of reproducible build and use of a binary-only release creates a supply-chain risk if the upstream host is compromised.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package installs a prebuilt Electron binary from a GitHub release, which is an unverifiable executable artifact; while the source project is plausible, the lack of reproducible build and use of a binary-only release creates a supply-chain risk if the upstream host is compromised.

PKGBUILD

      1# Maintainer: Jadren <jadren@jadren.dev>
    
      2
    
      3pkgname=pi-desktop-bin
    
      4_pkgname=pi-desktop
    
      5pkgver=0.19.1
    
      6pkgrel=1
    
      7pkgdesc="Local-first AI coding agent desktop: Electron + Rust host core + pi Agent Harness + user-installable plugins"
    
      8arch=('x86_64' 'aarch64')
    
      9url="https://github.com/vastsa/PI-Desktop"
    
      10license=('LGPL-3.0-only')
    
      11depends=('alsa-lib' 'at-spi2-core' 'gcc-libs' 'glibc' 'gtk3' 'libcups' 'libnotify' 'libsecret'
    
      12         'libxss' 'libxtst' 'mesa' 'nss' 'xdg-utils')
    
      13optdepends=('libappindicator-gtk3: tray icon support')
    
      14provides=("${_pkgname}")
    
      15conflicts=("${_pkgname}")
    
      16options=('!strip' '!debug')
    
      17source=("LICENSE-${pkgver}::https://raw.githubusercontent.com/vastsa/PI-Desktop/v${pkgver}/LICENSE")
    
      18source_x86_64=("${_pkgname}-${pkgver}-x86_64.deb::${url}/releases/download/v${pkgver}/${_pkgname}_${pkgver}_amd64.deb")
    
      19source_aarch64=("${_pkgname}-${pkgver}-aarch64.deb::${url}/releases/download/v${pkgver}/${_pkgname}_${pkgver}_arm64.deb")
    
      20noextract=("${_pkgname}-${pkgver}-x86_64.deb" "${_pkgname}-${pkgver}-aarch64.deb")
    
      21sha256sums=('e3a994d82e644b03a792a930f574002658412f62407f5fee083f2555c5f23118')
    
      22sha256sums_x86_64=('f103fe650e26e81732914540679a83a0e68461134688482a21770ff0ec5e42a6')
    
      23sha256sums_aarch64=('85e5decf36fe20479e44d0ca70baf7dacc3fc4360d3e7818619519fa5e073b70')
    
      24
    
      25prepare() {
    
      26  mkdir -p deb
    
      27  bsdtar -xOf "${_pkgname}-${pkgver}-${CARCH}.deb" 'data.tar.*' | bsdtar -xf - -C deb
    
      28}
    
      29
    
      30package() {
    
      31  install -dm755 "${pkgdir}/opt"
    
      32  cp -a deb/opt/PI-Desktop "${pkgdir}/opt/${_pkgname}"
    
      33
    
      34  # Arch kernels support unprivileged user namespaces; no SUID sandbox needed
    
      35  chmod 0755 "${pkgdir}/opt/${_pkgname}/chrome-sandbox"
    
      36
    
      37  install -dm755 "${pkgdir}/usr/bin"
    
      38  ln -s "/opt/${_pkgname}/${_pkgname}" "${pkgdir}/usr/bin/${_pkgname}"
    
      39
    
      40  install -Dm644 deb/usr/share/applications/${_pkgname}.desktop \
    
      41    "${pkgdir}/usr/share/applications/${_pkgname}.desktop"
    
      42  sed -i "s|^Exec=.*|Exec=${_pkgname} %U|" "${pkgdir}/usr/share/applications/${_pkgname}.desktop"
    
      43
    
      44  install -Dm644 deb/usr/share/icons/hicolor/512x512/apps/${_pkgname}.png \
    
      45    "${pkgdir}/usr/share/icons/hicolor/512x512/apps/${_pkgname}.png"
    
      46
    
      47  install -Dm644 "LICENSE-${pkgver}" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      48}
    
      49

Changes since previous scan

--- PKGBUILD @ 2026-10-14 00:06
+++ PKGBUILD @ 2026-10-17 00:21
@@ -2,7 +2,7 @@
 
 pkgname=pi-desktop-bin
 _pkgname=pi-desktop
-pkgver=0.18.0
+pkgver=0.19.1
 pkgrel=1
 pkgdesc="Local-first AI coding agent desktop: Electron + Rust host core + pi Agent Harness + user-installable plugins"
 arch=('x86_64' 'aarch64')
@@ -19,8 +19,8 @@
 source_aarch64=("${_pkgname}-${pkgver}-aarch64.deb::${url}/releases/download/v${pkgver}/${_pkgname}_${pkgver}_arm64.deb")
 noextract=("${_pkgname}-${pkgver}-x86_64.deb" "${_pkgname}-${pkgver}-aarch64.deb")
 sha256sums=('e3a994d82e644b03a792a930f574002658412f62407f5fee083f2555c5f23118')
-sha256sums_x86_64=('b303bc164366cfe91b885906e261d80cc3b2ed9bae2aa057b4362965b80d4c35')
-sha256sums_aarch64=('97a2c657d46aaa9a9fd69c2b513921faf55b30a3d34472ccc10d631d82feedb3')
+sha256sums_x86_64=('f103fe650e26e81732914540679a83a0e68461134688482a21770ff0ec5e42a6')
+sha256sums_aarch64=('85e5decf36fe20479e44d0ca70baf7dacc3fc4360d3e7818619519fa5e073b70')
 
 prepare() {
   mkdir -p deb

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Medium	2
2026-10-16 00:12:47	Medium	2
2026-10-15 00:28:05	Medium	2
2026-10-14 13:20:15	Medium	2
2026-10-14 00:06:47	Medium	2
2026-10-13 13:16:52	Medium	2
2026-10-13 00:23:45	Medium	2
2026-10-12 13:13:52	Medium	2