proton-pass-bin

maintainer DodoGTA · 45 votes · scanned 2026-08-18 00:03:42.021799

MEDIUM

Why flagged The package downloads a prebuilt .deb binary from a non-whitelisted host (proton.me), which is not a standard code or release hosting platform, creating a supply-chain risk if the source were compromised or swapped.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:18 source=("https://proton.me/download/PassDesktop/linux/x64/proton-pass_${pkgver}_amd64.deb")

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt .deb binary from a non-whitelisted host (proton.me), which is not a standard code or release hosting platform, creating a supply-chain risk if the source were compromised or swapped.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Echo J. <aidas957 at gmail dot com>
    
      2# Contributor: Mysti
    
      3
    
      4pkgname=proton-pass-bin
    
      5pkgver=1.39.1
    
      6pkgrel=1
    
      7pkgdesc="Open-source password manager for effortless protection. Securely store, share and auto-login your accounts with Proton Pass, using end-to-end encryption trusted by millions."
    
      8arch=("x86_64")
    
      9url="https://proton.me/pass"
    
      10license=('MIT') # Bundled Electron
    
      11license+=('GPL-3.0-or-later') # The Proton Pass code itself (https://github.com/ProtonMail/WebClients#license)
    
      12groups=("ProtonPass")
    
      13depends=('alsa-lib' 'at-spi2-core' 'cairo' 'dbus' 'expat' 'glib2' 'glibc' 'gtk3' 'libcups'
    
      14		 'libgcc' 'libudev.so' 'libx11' 'libxcb' 'libxcomposite' 'libxdamage' 'libxext'
    
      15		 'libxfixes' 'libxrandr' 'libxkbcommon' 'mesa' 'nspr' 'nss' 'pango') # Bundled Electron dependencies
    
      16provides=('proton-pass' 'protonpass')
    
      17conflicts=('proton-pass' 'protonpass')
    
      18source=("https://proton.me/download/PassDesktop/linux/x64/proton-pass_${pkgver}_amd64.deb")
    
      19sha512sums=('2212b0607aed6fa92d4502764d55e67fe381ccbe9c44db431050f5561a82796f25ca0c712016997779e66d815c4d420bebcdb7a07facafa77c2f84e90a1772f8')
    
      20
    
      21package() {
    
      22	tar -xvf data.tar.xz -C "$pkgdir/"
    
      23
    
      24	install -dm755 "$pkgdir"/opt
    
      25	mv "$pkgdir"/usr/lib/proton-pass "$pkgdir"/opt
    
      26	rmdir "$pkgdir"/usr/lib
    
      27
    
      28	ln -sf "/opt/proton-pass/Proton Pass" "$pkgdir"/usr/bin/proton-pass
    
      29
    
      30	# Remove world-writable bit from some files
    
      31	chmod -R o-w "$pkgdir"/opt/proton-pass/resources/assets
    
      32
    
      33	# Install bundled Electron license
    
      34	install -Dm644 "$pkgdir"/usr/share/doc/proton-pass/copyright "$pkgdir"/usr/share/licenses/"$pkgname"/copyright
    
      35
    
      36	rm -rf "$pkgdir"/usr/share/{doc,lintian}
    
      37}
    
      38

Changes since previous scan

--- PKGBUILD @ 2026-07-14 00:09
+++ PKGBUILD @ 2026-08-18 00:03
@@ -2,7 +2,7 @@
 # Contributor: Mysti
 
 pkgname=proton-pass-bin
-pkgver=1.37.0
+pkgver=1.39.1
 pkgrel=1
 pkgdesc="Open-source password manager for effortless protection. Securely store, share and auto-login your accounts with Proton Pass, using end-to-end encryption trusted by millions."
 arch=("x86_64")
@@ -10,13 +10,13 @@
 license=('MIT') # Bundled Electron
 license+=('GPL-3.0-or-later') # The Proton Pass code itself (https://github.com/ProtonMail/WebClients#license)
 groups=("ProtonPass")
-depends=('alsa-lib' 'at-spi2-core' 'cairo' 'dbus' 'expat' 'gcc-libs' 'glib2' 'glibc' 'gtk3'
-		 'libcups' 'libudev.so' 'libx11' 'libxcb' 'libxcomposite' 'libxdamage' 'libxext'
+depends=('alsa-lib' 'at-spi2-core' 'cairo' 'dbus' 'expat' 'glib2' 'glibc' 'gtk3' 'libcups'
+		 'libgcc' 'libudev.so' 'libx11' 'libxcb' 'libxcomposite' 'libxdamage' 'libxext'
 		 'libxfixes' 'libxrandr' 'libxkbcommon' 'mesa' 'nspr' 'nss' 'pango') # Bundled Electron dependencies
 provides=('proton-pass' 'protonpass')
 conflicts=('proton-pass' 'protonpass')
 source=("https://proton.me/download/PassDesktop/linux/x64/proton-pass_${pkgver}_amd64.deb")
-sha256sums=('30b26f1402abeb3d03479e20613830abdb1e6f91e4e616ce7fff52780571076d')
+sha512sums=('2212b0607aed6fa92d4502764d55e67fe381ccbe9c44db431050f5561a82796f25ca0c712016997779e66d815c4d420bebcdb7a07facafa77c2f84e90a1772f8')
 
 package() {
 	tar -xvf data.tar.xz -C "$pkgdir/"

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	MEDIUM	2
2026-08-17 00:18:29	MEDIUM	2
2026-08-16 00:03:42	MEDIUM	2
2026-08-15 00:26:13	MEDIUM	2
2026-08-14 00:03:41	MEDIUM	2
2026-08-13 00:17:07	MEDIUM	2
2026-08-12 00:27:08	MEDIUM	2
2026-08-11 15:21:23	MEDIUM	2
2026-07-14 00:09:48	CLEAN	2
2026-07-13 15:42:03	MEDIUM	1
2026-06-20 16:03:41	CLEAN	2
2026-06-20 00:50:07	MEDIUM	2
2026-06-20 00:18:46	MEDIUM	2
2026-06-19 23:51:18	MEDIUM	2
2026-06-19 19:07:35	MEDIUM	2
2026-06-18 16:11:54	MEDIUM	1