prettyzap-bin

maintainer prettyletto · 0 votes · scanned 2026-08-18 00:03:42.021799

LOW

Why flagged The package installs a prebuilt AppImage from the project's official GitHub releases, which is normal for such packages; the low severity is due to the AppImage being a binary blob with unverifiable contents, but it comes from a legitimate project source and no malicious behavior is evident.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 90%): The package installs a prebuilt AppImage from the project's official GitHub releases, which is normal for such packages; the low severity is due to the AppImage being a binary blob with unverifiable contents, but it comes from a legitimate project source and no malicious behavior is evident.

PKGBUILD

      1# Maintainer: PrettyZap contributors
    
      2#
    
      3# This package intentionally installs the upstream AppImage contents instead
    
      4# of depending on Arch's moving Electron runtime. That keeps the WhatsApp Web
    
      5# shell on the Electron version it was tested with across Arch derivatives.
    
      6
    
      7pkgname=prettyzap-bin
    
      8pkgver=0.2.0
    
      9pkgrel=2
    
      10pkgdesc='Keyboard-first Electron shell around WhatsApp Web'
    
      11arch=('x86_64')
    
      12url='https://github.com/prettyletto/prettyzap'
    
      13license=('MIT')
    
      14depends=('alsa-lib' 'at-spi2-core' 'cairo' 'dbus' 'expat' 'fontconfig'
    
      15         'glib2' 'gtk3' 'libdrm' 'libx11' 'libxcb' 'libxcomposite'
    
      16         'libxdamage' 'libxext' 'libxfixes' 'libxkbcommon' 'libxrandr'
    
      17         'mesa' 'nss' 'pango' 'wayland' 'xdg-utils')
    
      18optdepends=('libsecret: keyring integration for Chromium credentials'
    
      19            'pipewire: desktop audio integration')
    
      20options=('!strip')
    
      21source=("PrettyZap-${pkgver}.AppImage::https://github.com/prettyletto/prettyzap/releases/download/v${pkgver}/PrettyZap-${pkgver}.AppImage"
    
      22        'prettyzap.svg'
    
      23        'prettyzap.desktop'
    
      24        'LICENSE')
    
      25sha256sums=('73978745e29bd58479f26c1ed406909e29f04ab0a7fe9b518ad4c0326a08f873'
    
      26           'dc32d09b142dec2ace99bafae3f9e374e863c70d64e529ad815ac6ba51eb605a'
    
      27           '4a8aa9bd6ce4b408c04553cc4984bd6bf64c5a2e726d8f5af3e8b50efffc6d99'
    
      28           'e1353e4dde193ae18c47ba11139aad7e907f4609ae23e866d206e1d01e9f37b3')
    
      29
    
      30prepare() {
    
      31  chmod 0755 "PrettyZap-${pkgver}.AppImage"
    
      32}
    
      33
    
      34package() {
    
      35  "${srcdir}/PrettyZap-${pkgver}.AppImage" --appimage-extract >/dev/null
    
      36
    
      37  install -d "${pkgdir}/opt/prettyzap"
    
      38  cp -a "${srcdir}/squashfs-root/." "${pkgdir}/opt/prettyzap/"
    
      39  rm -f "${pkgdir}/opt/prettyzap/.DirIcon"
    
      40  # AppImage extraction preserves its source-owner-only permissions. The
    
      41  # package is installed system-wide, so normalize traversal/read permissions
    
      42  # and retain executable bits for AppRun and Electron helper binaries.
    
      43  chmod -R a+rX "${pkgdir}/opt/prettyzap"
    
      44
    
      45  install -Dm0755 /dev/stdin "${pkgdir}/usr/bin/prettyzap" <<'EOF'
    
      46#!/bin/sh
    
      47exec /opt/prettyzap/AppRun "$@"
    
      48EOF
    
      49
    
      50  install -Dm0644 "${srcdir}/prettyzap.svg" \
    
      51    "${pkgdir}/usr/share/icons/hicolor/scalable/apps/prettyzap.svg"
    
      52  install -Dm0644 "${srcdir}/prettyzap.svg" \
    
      53    "${pkgdir}/usr/share/pixmaps/prettyzap.svg"
    
      54  install -Dm0644 "${srcdir}/prettyzap.desktop" \
    
      55    "${pkgdir}/usr/share/applications/prettyzap.desktop"
    
      56  install -Dm0644 "${srcdir}/LICENSE" \
    
      57    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      58}
    
      59

Changes since previous scan

--- PKGBUILD @ 2026-08-17 05:35
+++ PKGBUILD @ 2026-08-18 00:03
@@ -6,7 +6,7 @@
 
 pkgname=prettyzap-bin
 pkgver=0.2.0
-pkgrel=1
+pkgrel=2
 pkgdesc='Keyboard-first Electron shell around WhatsApp Web'
 arch=('x86_64')
 url='https://github.com/prettyletto/prettyzap'
@@ -37,6 +37,10 @@
   install -d "${pkgdir}/opt/prettyzap"
   cp -a "${srcdir}/squashfs-root/." "${pkgdir}/opt/prettyzap/"
   rm -f "${pkgdir}/opt/prettyzap/.DirIcon"
+  # AppImage extraction preserves its source-owner-only permissions. The
+  # package is installed system-wide, so normalize traversal/read permissions
+  # and retain executable bits for AppRun and Electron helper binaries.
+  chmod -R a+rX "${pkgdir}/opt/prettyzap"
 
   install -Dm0755 /dev/stdin "${pkgdir}/usr/bin/prettyzap" <<'EOF'
 #!/bin/sh

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	LOW	2
2026-08-17 19:37:23	LOW	2
2026-08-17 05:35:16	LOW	2
2026-08-17 03:35:16	LOW	2