rkd-bin

MEDIUM

maintainer shjackal 0 votes scanned 2026-09-05 10:01:37.832542

View on AUR

Why flagged

Downloads and installs a prebuilt Electron/Chromium binary (.deb) from a personal/project-specific Forgejo instance (git.rkd.nanoya.biz) that is not an established official vendor domain; while the SHA256 checksum is present and the packaging logic is clean, the binary originates from infrastructure that an unrelated party could plausibly control or swap, making it an unverifiable prebuilt executable from a non-mainstream host.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:61 source=("$pkgname-$pkgver.deb::https://git.rkd.nanoya.biz/rkd/releases/releases/download/${_tag}/RKD-electron-rkd_${_pkgver}_amd64.deb")

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 65%): Downloads and installs a prebuilt Electron/Chromium binary (.deb) from a personal/project-specific Forgejo instance (git.rkd.nanoya.biz) that is not an established official vendor domain; while the SHA256 checksum is present and the packaging logic is clean, the binary originates from infrastructure that an unrelated party could plausibly control or swap, making it an unverifiable prebuilt executable from a non-mainstream host.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: RKD <no-reply@rkd.chat>
    
      2
    
      3# Tracks stable release.yml tags (git.rkd.nanoya.biz/rkd/releases), e.g.
    
      4# v0.2.0. Bumped automatically by aur-sync.yml's check-rkd-bin/sync-rkd-bin
    
      5# jobs once a stable (non-draft, non-prerelease) release is published — same
    
      6# polling pattern already used for rkd-dev-bin, see that workflow's header
    
      7# comment for why polling instead of chaining on release.yml's own publish
    
      8# job (#477 review round 3: a chained job would race a still-draft release).
    
      9#
    
      10# Placeholder values below (pkgver=0.0.0, _tag=v0.0.0-unreleased) until the
    
      11# first real stable tag exists — no v0.0.0 release will ever be published,
    
      12# so aur-sync.yml's "already tracks this tag" short-circuit can't falsely
    
      13# skip the first real bump (#485). This package has not been bootstrap-
    
      14# pushed to the AUR yet; that happens by hand once, at the same time as the
    
      15# first stable (0.2.0) release cut.
    
      16#
    
      17# Installs alongside rkd-dev-bin under a distinct path (/opt/rkd-bin) so
    
      18# both can coexist. The Electron build's WM class/binary internals still say
    
      19# "RKD" (baked in at build time by productName), so windows from rkd-bin and
    
      20# rkd-dev-bin won't be visually distinguishable beyond the launcher name/icon
    
      21# — acceptable, mirrors rkd-dev-bin's own PKGBUILD comment.
    
      22
    
      23pkgname=rkd-bin
    
      24pkgver=0.2.0
    
      25pkgrel=1
    
      26pkgdesc="RKD desktop client"
    
      27arch=(x86_64)
    
      28url="https://git.rkd.nanoya.biz/rkd/releases"
    
      29license=(LicenseRef-custom)
    
      30# Prebuilt vendor binaries (chrome-sandbox, libvulkan.so.1, ...) — stripping
    
      31# or gdb-add-index'ing them corrupts the setuid helper and wastes time on
    
      32# blobs that were never built with debug info to begin with.
    
      33options=(!strip !debug)
    
      34provides=(rkd)
    
      35conflicts=(rkd rkd-dev-bin)
    
      36depends=(
    
      37  alsa-lib
    
      38  at-spi2-core
    
      39  gtk3
    
      40  nss
    
      41  # Not linked directly by the rkd/Electron binary (namcap flags these as
    
      42  # "may not be needed") — Electron dlopen()s them at runtime instead:
    
      43  # libnotify (native notifications), libsecret (keytar-style credential
    
      44  # storage), libxss (idle/screensaver detection), libxtst (synthetic input
    
      45  # for global shortcuts), util-linux-libs (libuuid, used by Chromium's
    
      46  # base/), xdg-utils (xdg-open subprocess for external links).
    
      47  libnotify
    
      48  libsecret
    
      49  libxss
    
      50  libxtst
    
      51  util-linux-libs
    
      52  xdg-utils
    
      53)
    
      54optdepends=('libayatana-appindicator: tray icon support')
    
      55
    
      56# _pkgver: raw semver as it appears in the .deb filename.
    
      57# _tag: the Forgejo release tag the asset was uploaded under.
    
      58_pkgver=0.2.0
    
      59_tag=v0.2.0
    
      60
    
      61source=("$pkgname-$pkgver.deb::https://git.rkd.nanoya.biz/rkd/releases/releases/download/${_tag}/RKD-electron-rkd_${_pkgver}_amd64.deb")
    
      62sha256sums=('a1bfbaef744f961011ae49231bd52f9b87a470dab3f8bdb71d73b4d88b65162f')
    
      63noextract=("$pkgname-$pkgver.deb")
    
      64
    
      65package() {
    
      66  bsdtar -xf "$pkgname-$pkgver.deb" -C "$srcdir"
    
      67  bsdtar -xf "$srcdir/data.tar.xz" -C "$pkgdir"
    
      68
    
      69  mv "$pkgdir/opt/RKD" "$pkgdir/opt/$pkgname"
    
      70
    
      71  # chrome-sandbox needs the setuid bit to sandbox renderers without
    
      72  # CAP_SYS_ADMIN/unprivileged userns; fakeroot preserves this bit into the
    
      73  # package archive and pacman applies it for real on install (as root).
    
      74  chmod 4755 "$pkgdir/opt/$pkgname/chrome-sandbox"
    
      75
    
      76  install -d "$pkgdir/usr/bin"
    
      77  ln -s "/opt/$pkgname/rkd" "$pkgdir/usr/bin/$pkgname"
    
      78
    
      79  # Installed as the shared rkd.desktop filename (not $pkgname.desktop) so
    
      80  # it matches main.ts's app.setDesktopName("rkd") across every channel —
    
      81  # that's what Chromium's GetXdgAppId() reports for the notification
    
      82  # desktop-entry hint, and it has to match the installed filename exactly
    
      83  # for OS notification history to resolve this app's identity (#570).
    
      84  # Name=/Icon=/Exec= below stay per-channel; only the filename is shared —
    
      85  # rkd-bin and rkd-dev-bin already conflicts= each other, so only one is
    
      86  # ever actually installed at a time, no real collision here. Overwrites
    
      87  # the .deb's own auto-generated rkd.desktop outright (install -Dm644
    
      88  # doesn't need it removed first) — that one's Exec= points at /opt/RKD,
    
      89  # wrong for this renamed /opt/$pkgname install.
    
      90  install -Dm644 /dev/stdin "$pkgdir/usr/share/applications/rkd.desktop" <<EOF
    
      91[Desktop Entry]
    
      92Name=RKD
    
      93Comment=RKD desktop client
    
      94Exec=/opt/$pkgname/rkd %U
    
      95Terminal=false
    
      96Type=Application
    
      97Icon=$pkgname
    
      98StartupWMClass=Rkd
    
      99Categories=Network;
    
      100EOF
    
      101
    
      102  mv "$pkgdir/usr/share/icons/hicolor/512x512/apps/rkd.png" \
    
      103     "$pkgdir/usr/share/icons/hicolor/512x512/apps/$pkgname.png"
    
      104
    
      105  install -Dm644 "$pkgdir/opt/$pkgname/LICENSE.electron.txt" \
    
      106    "$pkgdir/usr/share/licenses/$pkgname/LICENSE.electron.txt"
    
      107  install -Dm644 "$pkgdir/opt/$pkgname/LICENSES.chromium.html" \
    
      108    "$pkgdir/usr/share/licenses/$pkgname/LICENSES.chromium.html"
    
      109
    
      110  rm -rf "$pkgdir/usr/share/doc/rkd"
    
      111}
    
      112

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-05 10:01:37	Medium	3
2026-09-05 09:59:47	Medium	3