protonmail-bridge-free-bin-git

maintainer aisuneko · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary artifact from nightly.link (a GitHub Actions artifact proxy for the mnixry/proton-bridge fork, not the official ProtonMail/proton-bridge repository) with `sha256sums=('SKIP')`, meaning no integrity verification is performed. Two concerns: (1) nightly.link is a third-party service proxying GitHub Actions artifacts — while generally reliable, it is not official release infrastructure and the artifact could change without notice; (2) more importantly, this is a *fork* (mnixry/proton-bridge) rather than the official ProtonMail upstream, so the binaries being installed are built from an unofficial fork's CI pipeline with no checksum pinning. The installed files are executed binaries (bridge-gui, bridge) placed in /usr/lib and symlinked to /usr/bin. The combination of an unofficial fork's CI artifacts + no integrity check constitutes a genuine supply-chain risk, justifying MEDIUM. The systemd service file is fetched from a pinned Arch Linux GitLab commit with a proper sha256sum, which is fine.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source=("https://nightly.link/mnixry/proton-bridge/workflows/build-multi-platform/master/build-ubuntu-latest.zip"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 75%): The PKGBUILD downloads a prebuilt binary artifact from nightly.link (a GitHub Actions artifact proxy for the mnixry/proton-bridge fork, not the official ProtonMail/proton-bridge repository) with `sha256sums=('SKIP')`, meaning no integrity verification is performed. Two concerns: (1) nightly.link is a third-party service proxying GitHub Actions artifacts — while generally reliable, it is not official release infrastructure and the artifact could change without notice; (2) more importantly, this is a *fork* (mnixry/proton-bridge) rather than the official ProtonMail upstream, so the binaries being installed are built from an unofficial fork's CI pipeline with no checksum pinning. The installed files are executed binaries (bridge-gui, bridge) placed in /usr/lib and symlinked to /usr/bin. The combination of an unofficial fork's CI artifacts + no integrity check constitutes a genuine supply-chain risk, justifying MEDIUM. The systemd service file is fetched from a pinned Arch Linux GitLab commit with a proper sha256sum, which is fine.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: aisuneko icecat <iceneko@protonmail.ch>
    
      2pkgbase=protonmail-bridge-free-bin-git
    
      3pkgname=(protonmail-bridge-free-bin-git protonmail-bridge-free-core-bin-git)
    
      4pkgver=3.23.0.r1.33882e1
    
      5_pkgver=3.23.0
    
      6pkgrel=1
    
      7pkgdesc="Integrate ProtonMail account with any program that supports IMAP and SMTP (Git prebuilt binary)"
    
      8arch=(x86_64)
    
      9url="https://github.com/mnixry/proton-bridge"
    
      10license=('GPL-3.0-only')
    
      11depends=('qt6-base' 'qt6-declarative' 'qt6-svg' 'libfido2' 'libsecret')
    
      12source=("https://nightly.link/mnixry/proton-bridge/workflows/build-multi-platform/master/build-ubuntu-latest.zip"
    
      13		"https://gitlab.archlinux.org/archlinux/packaging/packages/protonmail-bridge/-/raw/03d60b89cfb30580ad1bb8bc5c86e28348fa6ad2/protonmail-bridge.service")
    
      14sha256sums=("SKIP"
    
      15			'5d273f1245fec8549a3daa3fe76e22bb6c23957cf5bcb51c24f878e19c7a5692')
    
      16pkgver() {
    
      17  cd "$pkgname"
    
      18  ( set -o pipefail
    
      19    git describe --long --abbrev=7 2>/dev/null | sed 's/\([^-]*-g\)/r\1/;s/-/./g' ||
    
      20    printf "${_pkgver}.r%s.%s" "$(git rev-list --count HEAD)" "$(git rev-parse --short=7 HEAD)"
    
      21  )
    
      22}
    
      23
    
      24prepare(){
    
      25	cd "$srcdir"
    
      26	unzip build-ubuntu-latest.zip
    
      27	mkdir -p "$pkgbase"
    
      28	tgz_file=$(find . -maxdepth 1 -name "*.tgz" -type f | head -n 1)
    
      29    tar -xzf "$tgz_file" -C "$pkgbase"
    
      30}
    
      31
    
      32package_protonmail-bridge-free-bin-git() {
    
      33	pkgdesc="$pkgdesc (Qt desktop application)"
    
      34	depends=(protonmail-bridge-free-core-bin-git abseil-cpp gcc-libs glibc grpc hicolor-icon-theme protobuf qt6-base qt6-declarative qt6-svg sentry-native)
    
      35	provides=("protonmail-bridge-free-bin-git")
    
      36	conflicts=("protonmail-bridge-free")
    
      37
    
      38	cd "$srcdir/$pkgbase"
    
      39	install -Dm644 proton-bridge.desktop "$pkgdir/usr/share/applications/proton-bridge.desktop"
    
      40	install -Dm644 logo.svg "$pkgdir/usr/share/icons/hicolor/scalable/apps/protonmail-bridge.svg"
    
      41
    
      42	install -Dm755 bridge-gui "$pkgdir/usr/lib/protonmail/bridge/bridge-gui"
    
      43	install -dm755 "$pkgdir/usr/bin"
    
      44	ln -s /usr/lib/protonmail/bridge/bridge-gui "$pkgdir/usr/bin/protonmail-bridge"
    
      45}
    
      46
    
      47package_protonmail-bridge-free-core-bin-git() {
    
      48	pkgdesc="$pkgdesc (core executable and daemon)"
    
      49	depends=(glib2 glibc libsecret)
    
      50	optdepends=(
    
      51	'gnome-keyring: gnome-keyring support'
    
      52	'org.freedesktop.secrets: Applications that support Freedesktop secrets api'
    
      53	'pass: pass support'
    
      54	)
    
      55	provides=("protonmail-bridge-free-core-bin-git")
    
      56	conflicts=("protonmail-bridge-free-core")
    
      57
    
      58	cd "$srcdir/$pkgbase"
    
      59	install -Dm644 -t "$pkgdir/usr/share/doc/$pkgname" ./*.md
    
      60	install -Dm644 -t "$pkgdir/usr/lib/systemd/user" "$srcdir/protonmail-bridge.service"
    
      61
    
      62	install -Dm755 bridge "$pkgdir/usr/lib/protonmail/bridge/bridge"
    
      63	install -dm755 "$pkgdir/usr/bin"
    
      64	ln -s /usr/lib/protonmail/bridge/bridge "$pkgdir/usr/bin/protonmail-bridge-core"
    
      65}
    
      66

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2