proton-mail-bin
LOW
maintainer AlphaLynx
47 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads a prebuilt .deb from proton.me, the official project domain, which is a legitimate source for Proton Mail's desktop app;虽 host not whitelisted, it is the official vendor site, and the payload is verified via checksums, making the risk low.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt .deb from proton.me, the official project domain, which is a legitimate source for Proton Mail's desktop app;虽 host not whitelisted, it is the official vendor site, and the payload is verified via checksums, making the risk low.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:16
source=($_name-$pkgver.deb::https://proton.me/download/mail/linux/$pkgver/ProtonMail-desktop-beta.deb
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: AlphaLynx <alphalynx at alphalynx dot dev>
2
# Contributor: Mark Wagie <mark dot wagie at proton dot me>
3
4
pkgname=proton-mail-bin
5
_name=${pkgname%-bin}
6
pkgver=1.13.4
7
pkgrel=1
8
pkgdesc='Proton official desktop application for Proton Mail and Proton Calendar'
9
arch=(any)
10
url='https://proton.me/mail'
11
license=(GPL-3.0-or-later)
12
_electron=electron40
13
depends=(bash $_electron hicolor-icon-theme)
14
provides=($_name)
15
conflicts=($_name)
16
source=($_name-$pkgver.deb::https://proton.me/download/mail/linux/$pkgver/ProtonMail-desktop-beta.deb
17
$_name.sh)
18
sha512sums=('3497f9efdaa76ea3bcbde7e30a997a272b3dbd20145131be6113195ececfab0bc9c1466dd09e42d4cff7e1b0b9dddc1d91bed03c90ce6e33f37d6eccc88f4f40'
19
'd8304e653256b917f9ef607e3d0085020c3f8ceaf86f438a411e517622806b8ea5014fb77d96683dfd6be396ebf2cd50443630512debb17b20abdf1447de0616')
20
b2sums=('1e542a15a2222f5e34e76256b2527d3f819a90fcbc7243fcc2cd25cdf82518883269711dc3cbf1bf323458d738012aa5f8fb3692a999f7017033136fc6e22c60'
21
'45d089576f2260cc425b6c9bdde79e882b24c7dd4b8173f485fb67a0d0ccaf451dbba6f403f3bd8a0d622d99132d076da79984525ed8f89e97738557e8e23bad')
22
23
prepare() {
24
# Extract only the files we need
25
tar -xf data.tar.xz \
26
"./usr/lib/$_name/resources/" \
27
"./usr/lib/$_name/version" \
28
"./usr/share/applications/$_name.desktop" \
29
"./usr/share/pixmaps/$_name.png"
30
31
# Find out which major release of electron this version of proton-mail requires
32
local _electron_major=$(cat "usr/lib/$_name/version" | sed 's/^[~^]\?\([0-9]\+\)\(\.[0-9]\+\)*$/\1/')
33
34
# Check if we depend on the correct electron version
35
if [ "$_electron" != "electron$_electron_major" ] ; then
36
echo "Error: Incorrect electron version detected. Please change the value of \"_electron\" from \"$_electron\" to \"electron$_electron_major\"."
37
return 1
38
fi
39
40
# Specify electron version in launcher
41
sed -i "s|@ELECTRON@|$_electron|" "$srcdir/proton-mail.sh"
42
}
43
44
package() {
45
install -Dm755 $_name.sh "$pkgdir/usr/bin/$_name"
46
47
install -d "$pkgdir/usr/share/$_name"
48
cp usr/lib/proton-mail/resources/* "$pkgdir/usr/share/$_name/"
49
50
install -Dm644 usr/share/applications/$_name.desktop -t "$pkgdir/usr/share/applications"
51
install -Dm644 usr/share/pixmaps/$_name.png "$pkgdir/usr/share/icons/hicolor/scalable/apps/$_name.svg"
52
}
53
Changes since previous scan
--- PKGBUILD @ 2026-09-12 00:25+++ PKGBUILD @ 2026-09-17 00:27@@ -3,7 +3,7 @@ pkgname=proton-mail-bin _name=${pkgname%-bin}-pkgver=1.13.3+pkgver=1.13.4 pkgrel=1 pkgdesc='Proton official desktop application for Proton Mail and Proton Calendar' arch=(any)@@ -15,9 +15,9 @@ conflicts=($_name) source=($_name-$pkgver.deb::https://proton.me/download/mail/linux/$pkgver/ProtonMail-desktop-beta.deb $_name.sh)-sha512sums=('8700c4f3f765cc6e473fc2e25d65f36248ecc19510c6443fc9184372f6ca1a32d7d5764f3cddd6cd97a4355b22909ece084e568d67739273d181671250c46ce3'+sha512sums=('3497f9efdaa76ea3bcbde7e30a997a272b3dbd20145131be6113195ececfab0bc9c1466dd09e42d4cff7e1b0b9dddc1d91bed03c90ce6e33f37d6eccc88f4f40' 'd8304e653256b917f9ef607e3d0085020c3f8ceaf86f438a411e517622806b8ea5014fb77d96683dfd6be396ebf2cd50443630512debb17b20abdf1447de0616')-b2sums=('21e64a95175db4fa658eef58bdf8121fa00f7d697cd25eb5a87009cf380587f1eb93cf877b82c6613b5dad84aaaca87ba6d23c58b9d6522729f96b14391e4008'+b2sums=('1e542a15a2222f5e34e76256b2527d3f819a90fcbc7243fcc2cd25cdf82518883269711dc3cbf1bf323458d738012aa5f8fb3692a999f7017033136fc6e22c60' '45d089576f2260cc425b6c9bdde79e882b24c7dd4b8173f485fb67a0d0ccaf451dbba6f403f3bd8a0d622d99132d076da79984525ed8f89e97738557e8e23bad') prepare() {Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 05:10:45 | Medium | 1 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |