proton-mail

MEDIUM

maintainer AlphaLynx 12 votes scanned 2026-10-23 07:37:02.440193

View on AUR

Why flagged

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

Triggered rules

Medium npm/yarn/pnpm install of an undeclared external package npm_install_external

PKGBUILD:36 pnpm install --frozen-lockfile --filter 'proton-inbox-desktop...' --ignore-scripts --trust-lockfile \

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: AlphaLynx <alphalynx at alphalynx dot dev>
    
      2# Contributor: Mark Wagie <mark dot wagie at proton dot me>
    
      3
    
      4pkgname=proton-mail
    
      5pkgver=1.16.0
    
      6pkgrel=1
    
      7pkgdesc='Proton official desktop application for Proton Mail and Proton Calendar'
    
      8arch=(any)
    
      9url='https://proton.me/mail'
    
      10license=(GPL-3.0-or-later)
    
      11_electron=electron43
    
      12depends=(bash $_electron hicolor-icon-theme)
    
      13makedepends=(git jq nodejs-lts-krypton pnpm)
    
      14source=(https://github.com/ProtonMail/WebClients/archive/proton-inbox-desktop@$pkgver/$pkgname-$pkgver.tar.gz
    
      15        proton-mail.desktop
    
      16        proton-mail.sh)
    
      17b2sums=('1128d601e74ff06163229dfb6598d345baed7129a99386d459f2ffd8fe236b6f54b12dca27fd9f8fb371f16ea5f7c9d077f63f9991300c1fd98d8fd0063ee4ee'
    
      18        'f0a2b4eca51362b204f487c6484e07080b2d953f38acb3b7ce81a05394fe2f57e5fd42f8806111c467aa528e539654a6b1adc3965328668c4734b3eecf3407e9'
    
      19        '45d089576f2260cc425b6c9bdde79e882b24c7dd4b8173f485fb67a0d0ccaf451dbba6f403f3bd8a0d622d99132d076da79984525ed8f89e97738557e8e23bad')
    
      20
    
      21prepare() {
    
      22    cd WebClients-proton-inbox-desktop-$pkgver
    
      23
    
      24    # Find out which major release of electron this version of proton-mail requires
    
      25    local _electron_major=$(jq --raw-output '.devDependencies.electron' < "applications/inbox-desktop/package.json" | sed 's/^[~^]\?\([0-9]\+\)\(\.[0-9]\+\)*$/\1/')
    
      26
    
      27    # Check if we depend on the correct electron version
    
      28    if [ "$_electron" != "electron$_electron_major" ] ; then
    
      29        echo "Error: Incorrect electron version detected. Please change the value of \"_electron\" from \"$_electron\" to \"electron$_electron_major\"."
    
      30        return 1
    
      31    fi
    
      32
    
      33    # Specify electron version in launcher
    
      34    sed -i "s|@ELECTRON@|$_electron|" "$srcdir/proton-mail.sh"
    
      35
    
      36    pnpm install --frozen-lockfile --filter 'proton-inbox-desktop...' --ignore-scripts --trust-lockfile \
    
      37        --config.@protontech:registry=https://registry.npmjs.org/ \
    
      38        --config.@proton-meet:registry=https://registry.npmjs.org/ \
    
      39        --store-dir "$srcdir/.pnpm-store"
    
      40}
    
      41
    
      42build() {
    
      43    cd WebClients-proton-inbox-desktop-$pkgver
    
      44    pnpm --filter proton-inbox-desktop run package
    
      45}
    
      46
    
      47check() {
    
      48    cd WebClients-proton-inbox-desktop-$pkgver
    
      49    pnpm --filter proton-inbox-desktop run test
    
      50}
    
      51
    
      52package() {
    
      53    install -Dm755 $pkgname.sh "$pkgdir/usr/bin/$pkgname"
    
      54    install -Dm644 $pkgname.desktop -t "$pkgdir/usr/share/applications"
    
      55
    
      56    cd WebClients-proton-inbox-desktop-$pkgver/applications/inbox-desktop
    
      57    install -d "$pkgdir/usr/share/$pkgname"
    
      58    cp out/"Proton Mail"-linux-*/resources/* "$pkgdir/usr/share/$pkgname/"
    
      59
    
      60    cd assets
    
      61    install -Dm644 icons/icon.png "$pkgdir/usr/share/icons/hicolor/512x512/apps/$pkgname.png"
    
      62    install -Dm644 icons/icon@2x.png "$pkgdir/usr/share/icons/hicolor/1024x1024/apps/$pkgname.png"
    
      63    install -Dm644 linux/icon.svg "$pkgdir/usr/share/icons/hicolor/scalable/apps/$pkgname.svg"
    
      64}
    
      65

Changes since previous scan

--- PKGBUILD @ 2026-10-10 00:12
+++ PKGBUILD @ 2026-10-23 07:37
@@ -2,19 +2,19 @@
 # Contributor: Mark Wagie <mark dot wagie at proton dot me>
 
 pkgname=proton-mail
-pkgver=1.15.1
-pkgrel=2
+pkgver=1.16.0
+pkgrel=1
 pkgdesc='Proton official desktop application for Proton Mail and Proton Calendar'
 arch=(any)
 url='https://proton.me/mail'
 license=(GPL-3.0-or-later)
 _electron=electron43
 depends=(bash $_electron hicolor-icon-theme)
-makedepends=(git jq nodejs-lts-jod yarn)
+makedepends=(git jq nodejs-lts-krypton pnpm)
 source=(https://github.com/ProtonMail/WebClients/archive/proton-inbox-desktop@$pkgver/$pkgname-$pkgver.tar.gz
         proton-mail.desktop
         proton-mail.sh)
-b2sums=('d355399571deaf871c8a8d88ad73dce221bcf45326ab90db7d63f750b91fa74dbe61653787d35e9ffda0f2f37d17e3450748db6c55911cdb31f4904b20b4f8f8'
+b2sums=('1128d601e74ff06163229dfb6598d345baed7129a99386d459f2ffd8fe236b6f54b12dca27fd9f8fb371f16ea5f7c9d077f63f9991300c1fd98d8fd0063ee4ee'
         'f0a2b4eca51362b204f487c6484e07080b2d953f38acb3b7ce81a05394fe2f57e5fd42f8806111c467aa528e539654a6b1adc3965328668c4734b3eecf3407e9'
         '45d089576f2260cc425b6c9bdde79e882b24c7dd4b8173f485fb67a0d0ccaf451dbba6f403f3bd8a0d622d99132d076da79984525ed8f89e97738557e8e23bad')
 
@@ -33,22 +33,20 @@
     # Specify electron version in launcher
     sed -i "s|@ELECTRON@|$_electron|" "$srcdir/proton-mail.sh"
 
-    # Configure Yarn workspaces to build only inbox-desktop (proton-mail) instead of all applications
-    sed -i 's/"applications\/\*",/"applications\/inbox-desktop",/' package.json
-
-    export YARN_CACHE_FOLDER="$srcdir/.yarn-cache"
-    export SENTRYCLI_SKIP_DOWNLOAD=1
-    yarn install
+    pnpm install --frozen-lockfile --filter 'proton-inbox-desktop...' --ignore-scripts --trust-lockfile \
+        --config.@protontech:registry=https://registry.npmjs.org/ \
+        --config.@proton-meet:registry=https://registry.npmjs.org/ \
+        --store-dir "$srcdir/.pnpm-store"
 }
 
 build() {
     cd WebClients-proton-inbox-desktop-$pkgver
-    yarn workspace proton-inbox-desktop package
+    pnpm --filter proton-inbox-desktop run package
 }
 
 check() {
     cd WebClients-proton-inbox-desktop-$pkgver
-    yarn workspace proton-inbox-desktop test
+    pnpm --filter proton-inbox-desktop run test
 }
 
 package() {

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-23 07:37:02	Medium	1
2026-10-10 00:12:40	Clean	0
2026-10-05 23:40:58	Clean	0
2026-09-23 01:39:21	Clean	0
2026-09-12 05:10:45	Clean	0
2026-07-31 05:17:13	Clean	0
2026-06-18 16:11:54	Clean	0