pollis

MEDIUM

maintainer actuallydan 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads a prebuilt .deb from a non-standard host (cdn.pollis.com) which is not a major public forge or vendor CDN, creating a supply-chain risk if the host is compromised or the download is swapped.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:20 source=("https://cdn.pollis.com/releases/v${pkgver}/pollis-v${pkgver}-linux.deb")

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt .deb from a non-standard host (cdn.pollis.com) which is not a major public forge or vendor CDN, creating a supply-chain risk if the host is compromised or the download is swapped.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Pollis <hello@pollis.com>
    
      2# Generated by scripts/publish-aur.sh — do not edit by hand; the release
    
      3# pipeline overwrites this file on every release.
    
      4
    
      5pkgname=pollis
    
      6pkgver=1.12.0
    
      7pkgrel=1
    
      8pkgdesc="End-to-end encrypted messaging"
    
      9arch=('x86_64')
    
      10url="https://pollis.com"
    
      11license=('LicenseRef-proprietary')
    
      12depends=(
    
      13  'webkit2gtk-4.1'
    
      14  'gtk3'
    
      15  'libayatana-appindicator'
    
      16  'alsa-lib'
    
      17  'libpulse'
    
      18  'dbus'
    
      19)
    
      20source=("https://cdn.pollis.com/releases/v${pkgver}/pollis-v${pkgver}-linux.deb")
    
      21sha256sums=('60aacc18e3987454dfa770ba4524d5c969d73d4600e11ab1b932b66da787c2a7')
    
      22
    
      23package() {
    
      24  # The Tauri .deb already lays the app out under /usr (binary at
    
      25  # /usr/bin/pollis, capture helper at /usr/bin/pollis-capture-linux,
    
      26  # .desktop + icons under /usr/share) — extract it verbatim. No
    
      27  # /opt symlink: that is the Electron layout and would clobber the
    
      28  # real /usr/bin/pollis with a dangling link.
    
      29  bsdtar -xf data.tar.* -C "${pkgdir}/"
    
      30
    
      31  # Tauri's .desktop template emits a bare `Exec=pollis`, which the launcher
    
      32  # resolves through $PATH — so any binary named `pollis` ahead of /usr/bin
    
      33  # hijacks the menu entry. That is not hypothetical for Arch specifically:
    
      34  # website/install.sh picks .deb only when dpkg exists and .rpm only when
    
      35  # dnf/yum exists, so on Arch it always falls through to the AppImage branch,
    
      36  # which writes a launcher at ~/.local/bin/pollis and tells the user to put
    
      37  # that directory on their PATH. Anyone who ran install.sh before switching to
    
      38  # this package keeps launching the stale AppImage while pacman upgrades the
    
      39  # real binary underneath — and it fails silently, because the AppImage still
    
      40  # starts. Pin Exec to the path this package actually owns.
    
      41  local desktop pinned=0
    
      42  for desktop in "${pkgdir}"/usr/share/applications/*.desktop; do
    
      43    [ -e "$desktop" ] || continue
    
      44    sed -i -E 's|^Exec=pollis([[:space:]].*)?$|Exec=/usr/bin/pollis\1|' "$desktop"
    
      45    if grep -q '^Exec=/usr/bin/pollis' "$desktop"; then
    
      46      pinned=1
    
      47    fi
    
      48  done
    
      49  # Never ship a launcher that can still be hijacked: if the .deb's layout
    
      50  # changed under us, fail the build here rather than reintroduce the bug.
    
      51  if [ "$pinned" -ne 1 ]; then
    
      52    echo "No .desktop with an 'Exec=pollis' line under /usr/share/applications — refusing to package a hijackable launcher." >&2
    
      53    return 1
    
      54  fi
    
      55}
    
      56

Changes since previous scan

--- PKGBUILD @ 2026-09-15 00:25
+++ PKGBUILD @ 2026-09-17 00:27
@@ -3,7 +3,7 @@
 # pipeline overwrites this file on every release.
 
 pkgname=pollis
-pkgver=1.11.3
+pkgver=1.12.0
 pkgrel=1
 pkgdesc="End-to-end encrypted messaging"
 arch=('x86_64')
@@ -18,7 +18,7 @@
   'dbus'
 )
 source=("https://cdn.pollis.com/releases/v${pkgver}/pollis-v${pkgver}-linux.deb")
-sha256sums=('b426ecfc82df940c7ee3de45f368534f6bcc7e3a9fc303abfb22a85d2c364788')
+sha256sums=('60aacc18e3987454dfa770ba4524d5c969d73d4600e11ab1b932b66da787c2a7')
 
 package() {
   # The Tauri .deb already lays the app out under /usr (binary at

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 01:18:20	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 07:57:01	Medium	2
2026-09-04 01:55:41	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 23:55:21	Medium	2
2026-09-03 17:54:21	Medium	2
2026-09-03 00:15:47	Medium	2