pollis

maintainer actuallydan · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt .deb from a non-standard host (cdn.pollis.com) which is not a widely recognized or whitelisted domain; if compromised, this could deliver a malicious payload since the binary is extracted and installed directly.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:20 source=("https://cdn.pollis.com/releases/v${pkgver}/pollis-v${pkgver}-linux.deb")

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt .deb from a non-standard host (cdn.pollis.com) which is not a widely recognized or whitelisted domain; if compromised, this could deliver a malicious payload since the binary is extracted and installed directly.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Pollis <hello@pollis.com>
    
      2# Generated by .github/workflows/desktop-release.yml — do not edit
    
      3# by hand; the workflow overwrites this file on every release.
    
      4
    
      5pkgname=pollis
    
      6pkgver=1.8.1
    
      7pkgrel=1
    
      8pkgdesc="End-to-end encrypted messaging"
    
      9arch=('x86_64')
    
      10url="https://pollis.com"
    
      11license=('LicenseRef-proprietary')
    
      12depends=(
    
      13  'webkit2gtk-4.1'
    
      14  'gtk3'
    
      15  'libayatana-appindicator'
    
      16  'alsa-lib'
    
      17  'libpulse'
    
      18  'dbus'
    
      19)
    
      20source=("https://cdn.pollis.com/releases/v${pkgver}/pollis-v${pkgver}-linux.deb")
    
      21sha256sums=('53955c7d8fa1bbe3f3651439380c3b4a5e510c0efbc2c206a7c56498fca00d52')
    
      22
    
      23package() {
    
      24  # The Tauri .deb already lays the app out under /usr (binary at
    
      25  # /usr/bin/pollis, capture helper at /usr/bin/pollis-capture-linux,
    
      26  # .desktop + icons under /usr/share) — extract it verbatim. No
    
      27  # /opt symlink: that is the Electron layout and would clobber the
    
      28  # real /usr/bin/pollis with a dangling link.
    
      29  bsdtar -xf data.tar.* -C "${pkgdir}/"
    
      30}
    
      31

Changes since previous scan

--- PKGBUILD @ 2026-07-30 00:17
+++ PKGBUILD @ 2026-08-03 00:08
@@ -3,7 +3,7 @@
 # by hand; the workflow overwrites this file on every release.
 
 pkgname=pollis
-pkgver=1.7.0
+pkgver=1.8.1
 pkgrel=1
 pkgdesc="End-to-end encrypted messaging"
 arch=('x86_64')
@@ -18,7 +18,7 @@
   'dbus'
 )
 source=("https://cdn.pollis.com/releases/v${pkgver}/pollis-v${pkgver}-linux.deb")
-sha256sums=('5ac255495dbc318c003ac86a30922a4cc535daeed8cd9cb69cfbe345e5fd178e')
+sha256sums=('53955c7d8fa1bbe3f3651439380c3b4a5e510c0efbc2c206a7c56498fca00d52')
 
 package() {
   # The Tauri .deb already lays the app out under /usr (binary at

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 05:17:13	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 19:16:23	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 19:39:35	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 01:34:00	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 17:30:22	MEDIUM	2
2026-07-25 05:29:17	MEDIUM	2
2026-07-25 01:28:35	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 17:21:24	MEDIUM	2