proton-mail-bin

maintainer AlphaLynx · 47 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a prebuilt .deb from proton.me, the official project domain, which is trustworthy; installing proprietary binaries from the vendor's own release infrastructure is standard for AUR packages and poses no inherent supply-chain risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt .deb from proton.me, the official project domain, which is trustworthy; installing proprietary binaries from the vendor's own release infrastructure is standard for AUR packages and poses no inherent supply-chain risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source=($_name-$pkgver.deb::https://proton.me/download/mail/linux/$pkgver/ProtonMail-desktop-beta.deb

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: AlphaLynx <alphalynx at alphalynx dot dev>
    
      2# Contributor: Mark Wagie <mark dot wagie at proton dot me>
    
      3
    
      4pkgname=proton-mail-bin
    
      5_name=${pkgname%-bin}
    
      6pkgver=1.13.3
    
      7pkgrel=1
    
      8pkgdesc='Proton official desktop application for Proton Mail and Proton Calendar'
    
      9arch=(any)
    
      10url='https://proton.me/mail'
    
      11license=(GPL-3.0-or-later)
    
      12_electron=electron40
    
      13depends=(bash $_electron hicolor-icon-theme)
    
      14provides=($_name)
    
      15conflicts=($_name)
    
      16source=($_name-$pkgver.deb::https://proton.me/download/mail/linux/$pkgver/ProtonMail-desktop-beta.deb
    
      17        $_name.sh)
    
      18sha512sums=('8700c4f3f765cc6e473fc2e25d65f36248ecc19510c6443fc9184372f6ca1a32d7d5764f3cddd6cd97a4355b22909ece084e568d67739273d181671250c46ce3'
    
      19            'd8304e653256b917f9ef607e3d0085020c3f8ceaf86f438a411e517622806b8ea5014fb77d96683dfd6be396ebf2cd50443630512debb17b20abdf1447de0616')
    
      20b2sums=('21e64a95175db4fa658eef58bdf8121fa00f7d697cd25eb5a87009cf380587f1eb93cf877b82c6613b5dad84aaaca87ba6d23c58b9d6522729f96b14391e4008'
    
      21        '45d089576f2260cc425b6c9bdde79e882b24c7dd4b8173f485fb67a0d0ccaf451dbba6f403f3bd8a0d622d99132d076da79984525ed8f89e97738557e8e23bad')
    
      22
    
      23prepare() {
    
      24    # Extract only the files we need
    
      25    tar -xf data.tar.xz \
    
      26        "./usr/lib/$_name/resources/" \
    
      27        "./usr/lib/$_name/version" \
    
      28        "./usr/share/applications/$_name.desktop" \
    
      29        "./usr/share/pixmaps/$_name.png"
    
      30
    
      31    # Find out which major release of electron this version of proton-mail requires
    
      32    local _electron_major=$(cat "usr/lib/$_name/version" | sed 's/^[~^]\?\([0-9]\+\)\(\.[0-9]\+\)*$/\1/')
    
      33
    
      34    # Check if we depend on the correct electron version
    
      35    if [ "$_electron" != "electron$_electron_major" ] ; then
    
      36        echo "Error: Incorrect electron version detected. Please change the value of \"_electron\" from \"$_electron\" to \"electron$_electron_major\"."
    
      37        return 1
    
      38    fi
    
      39
    
      40    # Specify electron version in launcher
    
      41    sed -i "s|@ELECTRON@|$_electron|" "$srcdir/proton-mail.sh"
    
      42}
    
      43
    
      44package() {
    
      45    install -Dm755 $_name.sh "$pkgdir/usr/bin/$_name"
    
      46
    
      47    install -d "$pkgdir/usr/share/$_name"
    
      48    cp usr/lib/proton-mail/resources/* "$pkgdir/usr/share/$_name/"
    
      49
    
      50    install -Dm644 usr/share/applications/$_name.desktop -t "$pkgdir/usr/share/applications"
    
      51    install -Dm644 usr/share/pixmaps/$_name.png "$pkgdir/usr/share/icons/hicolor/scalable/apps/$_name.svg"
    
      52}
    
      53

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 05:17:13	MEDIUM	1
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2