proton-mail-bin
LOW
maintainer AlphaLynx
46 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The package downloads a prebuilt .deb from Proton's official domain (proton.me), which is the project's legitimate source; the binary is unpacked and only necessary resources are installed, posing no execution of remote code or supply-chain risk beyond trusting Proton's official release.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt .deb from Proton's official domain (proton.me), which is the project's legitimate source; the binary is unpacked and only necessary resources are installed, posing no execution of remote code or supply-chain risk beyond trusting Proton's official release.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:16
source=($_name-$pkgver.deb::https://proton.me/download/mail/linux/$pkgver/ProtonMail-desktop-beta.deb
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: AlphaLynx <alphalynx at alphalynx dot dev>
2
# Contributor: Mark Wagie <mark dot wagie at proton dot me>
3
4
pkgname=proton-mail-bin
5
_name=${pkgname%-bin}
6
pkgver=1.15.1
7
pkgrel=1
8
pkgdesc='Proton official desktop application for Proton Mail and Proton Calendar'
9
arch=(any)
10
url='https://proton.me/mail'
11
license=(GPL-3.0-or-later)
12
_electron=electron43
13
depends=(bash $_electron hicolor-icon-theme)
14
provides=($_name)
15
conflicts=($_name)
16
source=($_name-$pkgver.deb::https://proton.me/download/mail/linux/$pkgver/ProtonMail-desktop-beta.deb
17
$_name.sh)
18
sha512sums=('a80ce2a1e0549267f39241a808c62c0dc633ba70a474b837d9e5072ea8dfc2cf891549e3fb82e5dd697abaa2c320750837bd38f7229b2aead7c0f438de873344'
19
'd8304e653256b917f9ef607e3d0085020c3f8ceaf86f438a411e517622806b8ea5014fb77d96683dfd6be396ebf2cd50443630512debb17b20abdf1447de0616')
20
b2sums=('708c35ad3f191cf70da89894f2df0c31564a64f6048af0dffc11b49cb31a9cdc447486d9bfc7a5d8950ca7f3af9c706d189382bd49617bd3d11a051d84e3f885'
21
'45d089576f2260cc425b6c9bdde79e882b24c7dd4b8173f485fb67a0d0ccaf451dbba6f403f3bd8a0d622d99132d076da79984525ed8f89e97738557e8e23bad')
22
23
prepare() {
24
# Extract only the files we need
25
tar -xf data.tar.xz \
26
"./usr/lib/$_name/resources/" \
27
"./usr/lib/$_name/version" \
28
"./usr/share/applications/$_name.desktop" \
29
"./usr/share/pixmaps/$_name.png"
30
31
# Find out which major release of electron this version of proton-mail requires
32
local _electron_major=$(cat "usr/lib/$_name/version" | sed 's/^[~^]\?\([0-9]\+\)\(\.[0-9]\+\)*$/\1/')
33
34
# Check if we depend on the correct electron version
35
if [ "$_electron" != "electron$_electron_major" ] ; then
36
echo "Error: Incorrect electron version detected. Please change the value of \"_electron\" from \"$_electron\" to \"electron$_electron_major\"."
37
return 1
38
fi
39
40
# Specify electron version in launcher
41
sed -i "s|@ELECTRON@|$_electron|" "$srcdir/proton-mail.sh"
42
}
43
44
package() {
45
install -Dm755 $_name.sh "$pkgdir/usr/bin/$_name"
46
47
install -d "$pkgdir/usr/share/$_name"
48
cp usr/lib/proton-mail/resources/* "$pkgdir/usr/share/$_name/"
49
50
install -Dm644 usr/share/applications/$_name.desktop -t "$pkgdir/usr/share/applications"
51
install -Dm644 usr/share/pixmaps/$_name.png "$pkgdir/usr/share/icons/hicolor/scalable/apps/$_name.svg"
52
}
53
Changes since previous scan
--- PKGBUILD @ 2026-10-23 00:02+++ PKGBUILD @ 2026-11-01 00:21@@ -3,21 +3,21 @@ pkgname=proton-mail-bin _name=${pkgname%-bin}-pkgver=1.14.0+pkgver=1.15.1 pkgrel=1 pkgdesc='Proton official desktop application for Proton Mail and Proton Calendar' arch=(any) url='https://proton.me/mail' license=(GPL-3.0-or-later)-_electron=electron42+_electron=electron43 depends=(bash $_electron hicolor-icon-theme) provides=($_name) conflicts=($_name) source=($_name-$pkgver.deb::https://proton.me/download/mail/linux/$pkgver/ProtonMail-desktop-beta.deb $_name.sh)-sha512sums=('5908632fe34e3d40b698c9459bb774428a5b6aedd7c89ed9ff68394b90227c689a5a03ee719f9b3a4e20c7c4a69ce67fe40ab12e0f344359e9005c7be839d818'+sha512sums=('a80ce2a1e0549267f39241a808c62c0dc633ba70a474b837d9e5072ea8dfc2cf891549e3fb82e5dd697abaa2c320750837bd38f7229b2aead7c0f438de873344' 'd8304e653256b917f9ef607e3d0085020c3f8ceaf86f438a411e517622806b8ea5014fb77d96683dfd6be396ebf2cd50443630512debb17b20abdf1447de0616')-b2sums=('c20d236b959b2b1f32c56c2036dc366a7d38975abaefedf8b2c8eda5aa917b46a9bbf9060a0af51a09ac2fba7fd47be91db324dce462be14620130e6f267c9fd'+b2sums=('708c35ad3f191cf70da89894f2df0c31564a64f6048af0dffc11b49cb31a9cdc447486d9bfc7a5d8950ca7f3af9c706d189382bd49617bd3d11a051d84e3f885' '45d089576f2260cc425b6c9bdde79e882b24c7dd4b8173f485fb67a0d0ccaf451dbba6f403f3bd8a0d622d99132d076da79984525ed8f89e97738557e8e23bad') prepare() {Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 00:13:55 | Low | 2 |
| 2026-10-28 00:06:54 | Low | 2 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 07:37:02 | Medium | 1 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |
| 2026-10-14 00:06:47 | Low | 2 |