remarkable-client

maintainer orphaned · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt .deb binary from Google Drive (a personal/unofficial file-sharing host, not the vendor's official distribution channel) and installs an executable binary (reMarkable) and a shared library (libpdfium.so.1) directly onto the system. Google Drive links are mutable — the file ID can be reassigned or the file replaced silently by whoever controls the account, making the sha256sum the only integrity check. While a sha256sum is present, it only protects against accidental corruption, not against the host owner replacing the file with a new one at the same URL. The original reMarkable Linux client was indeed discontinued and never had an official Linux release, so there is no authoritative upstream to compare against. Installing an unverified prebuilt binary and shared library from a personal Google Drive constitutes a genuine supply-chain risk (executed code from an unofficial host), which is the definition of medium severity.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 source=('remarkable-linux-client.deb::https://drive.google.com/uc?id=1x_KhRp0_qufjnOO-pyDM1MAhRjeQeJTK')

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads a prebuilt .deb binary from Google Drive (a personal/unofficial file-sharing host, not the vendor's official distribution channel) and installs an executable binary (reMarkable) and a shared library (libpdfium.so.1) directly onto the system. Google Drive links are mutable — the file ID can be reassigned or the file replaced silently by whoever controls the account, making the sha256sum the only integrity check. While a sha256sum is present, it only protects against accidental corruption, not against the host owner replacing the file with a new one at the same URL. The original reMarkable Linux client was indeed discontinued and never had an official Linux release, so there is no authoritative upstream to compare against. Installing an unverified prebuilt binary and shared library from a personal Google Drive constitutes a genuine supply-chain risk (executed code from an unofficial host), which is the definition of medium severity.

PKGBUILD

1 offending line(s) highlighted

      1#Maintainer: Lukas Erhard <luerhard@googlemail.com>
    
      2
    
      3pkgname=remarkable-client
    
      4pkgver=1.0.0
    
      5pkgrel=1
    
      6arch=("any")
    
      7license=("unknown")
    
      8url="https://remarkablewiki.com/tips/client?s[]=linux"
    
      9pkgdesc="This is a Linux version of the reMarkable Desktop Client. As far as I know, the development has been discontinued, but it still works. Adding files is as simple as dragging them onto the window."
    
      10
    
      11depends=('qt5-svg' 'qt5-websockets' 'karchive' 'qt5-quickcontrols' 'qt5-quickcontrols2' 'qt5-graphicaleffects')
    
      12#depends=('libqt5quick5')
    
      13source=('remarkable-linux-client.deb::https://drive.google.com/uc?id=1x_KhRp0_qufjnOO-pyDM1MAhRjeQeJTK')
    
      14sha256sums=('ecc6df114778e6d757fd5c2b9516f23ada56f6a3cd4153a8b967688dbbc8d805')
    
      15
    
      16prepare() {
    
      17    ar x remarkable-linux-client.deb data.tar.xz
    
      18    tar -xf data.tar.xz
    
      19    DESKTOP_ENTRY="[Desktop Entry]
    
      20    Name=ReMarkable Client
    
      21    Version=1.0
    
      22    Comment=Unofficial reMarkable tablet linux Client
    
      23    Exec=/usr/bin/reMarkable
    
      24    Terminal=false
    
      25    Type=Application
    
      26    Categories=Science;Office;Utility
    
      27    "
    
      28    echo "$DESKTOP_ENTRY" > remarkable.desktop
    
      29}
    
      30
    
      31package() {
    
      32
    
      33    install -D -m664 "${srcdir}/remarkable.desktop" "${pkgdir}/usr/share/applications/remarkable.desktop"
    
      34    install -D -m755 "${srcdir}/usr/bin/reMarkable" "${pkgdir}/usr/bin/reMarkable"
    
      35    install -D -m755 "${srcdir}/usr/lib/libpdfium.so.1" "${pkgdir}/usr/lib/libpdfium.so.1"
    
      36}
    
      37

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2