rkd-bin
MEDIUM
maintainer shjackal
0 votes
scanned 2026-10-20 00:10:31.152894
Why flagged
The package downloads a prebuilt .deb binary from a non-standard, non-whitelisted host (git.rkd.nanoya.biz), which is not a major forge or official vendor domain, creating a supply-chain risk if the host were compromised or the release assets silently swapped.
Triggered rules
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:61
source=("$pkgname-$pkgver.deb::https://git.rkd.nanoya.biz/rkd/releases/releases/download/${_tag}/RKD-electron-rkd_${_pkgver}_amd64.deb")
Medium
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads a prebuilt .deb binary from a non-standard, non-whitelisted host (git.rkd.nanoya.biz), which is not a major forge or official vendor domain, creating a supply-chain risk if the host were compromised or the release assets silently swapped.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: RKD <no-reply@rkd.chat>
2
3
# Tracks stable release.yml tags (git.rkd.nanoya.biz/rkd/releases), e.g.
4
# v0.2.0. Bumped automatically by aur-sync.yml's check-rkd-bin/sync-rkd-bin
5
# jobs once a stable (non-draft, non-prerelease) release is published — same
6
# polling pattern already used for rkd-dev-bin, see that workflow's header
7
# comment for why polling instead of chaining on release.yml's own publish
8
# job (#477 review round 3: a chained job would race a still-draft release).
9
#
10
# Placeholder values below (pkgver=0.0.0, _tag=v0.0.0-unreleased) until the
11
# first real stable tag exists — no v0.0.0 release will ever be published,
12
# so aur-sync.yml's "already tracks this tag" short-circuit can't falsely
13
# skip the first real bump (#485). This package has not been bootstrap-
14
# pushed to the AUR yet; that happens by hand once, at the same time as the
15
# first stable (0.2.0) release cut.
16
#
17
# Installs alongside rkd-dev-bin under a distinct path (/opt/rkd-bin) — real
18
# coexistence (#822): this is the channel that keeps the original app
19
# identity unchanged (Electron app name "RKD", .desktop filename rkd.desktop)
20
# so existing installs/data aren't disrupted; rkd-dev-bin moved to its own
21
# name and rkd-dev.desktop instead of sharing this one. See that PKGBUILD's
22
# header comment for the coexistence rationale in full.
23
24
pkgname=rkd-bin
25
pkgver=0.3.1
26
pkgrel=1
27
pkgdesc="RKD desktop client"
28
arch=(x86_64)
29
url="https://git.rkd.nanoya.biz/rkd/releases"
30
license=(LicenseRef-custom)
31
# Prebuilt vendor binaries (chrome-sandbox, libvulkan.so.1, ...) — stripping
32
# or gdb-add-index'ing them corrupts the setuid helper and wastes time on
33
# blobs that were never built with debug info to begin with.
34
options=(!strip !debug)
35
provides=(rkd)
36
depends=(
37
alsa-lib
38
at-spi2-core
39
gtk3
40
nss
41
# Not linked directly by the rkd/Electron binary (namcap flags these as
42
# "may not be needed") — Electron dlopen()s them at runtime instead:
43
# libnotify (native notifications), libsecret (keytar-style credential
44
# storage), libxss (idle/screensaver detection), libxtst (synthetic input
45
# for global shortcuts), util-linux-libs (libuuid, used by Chromium's
46
# base/), xdg-utils (xdg-open subprocess for external links).
47
libnotify
48
libsecret
49
libxss
50
libxtst
51
util-linux-libs
52
xdg-utils
53
)
54
optdepends=('libayatana-appindicator: tray icon support')
55
56
# _pkgver: raw semver as it appears in the .deb filename.
57
# _tag: the Forgejo release tag the asset was uploaded under.
58
_pkgver=0.3.1
59
_tag=v0.3.1
60
61
source=("$pkgname-$pkgver.deb::https://git.rkd.nanoya.biz/rkd/releases/releases/download/${_tag}/RKD-electron-rkd_${_pkgver}_amd64.deb")
62
sha256sums=('1d83f673b599451bdd45a4630da08488a2e467aad0b35aac026b4e04814e919a')
63
noextract=("$pkgname-$pkgver.deb")
64
# Tells whoever removes the package how to remove the rkd-activity user
65
# service the app may have installed (#1145); root can't reach user units.
66
install=$pkgname.install
67
68
package() {
69
bsdtar -xf "$pkgname-$pkgver.deb" -C "$srcdir"
70
bsdtar -xf "$srcdir/data.tar.xz" -C "$pkgdir"
71
72
mv "$pkgdir/opt/RKD" "$pkgdir/opt/$pkgname"
73
74
# chrome-sandbox needs the setuid bit to sandbox renderers without
75
# CAP_SYS_ADMIN/unprivileged userns; fakeroot preserves this bit into the
76
# package archive and pacman applies it for real on install (as root).
77
chmod 4755 "$pkgdir/opt/$pkgname/chrome-sandbox"
78
79
install -d "$pkgdir/usr/bin"
80
ln -s "/opt/$pkgname/rkd" "$pkgdir/usr/bin/$pkgname"
81
82
# Installed as rkd.desktop, matching main.ts's app.setDesktopName("rkd.desktop")
83
# for the stable (non-beta-stamped) build — that's what Chromium's
84
# GetXdgAppId() reports for the notification desktop-entry hint, and it
85
# has to match the installed filename exactly for OS notification history
86
# to resolve this app's identity (#570). rkd-dev-bin installs its own
87
# rkd-dev.desktop instead (#822), so this filename is this package's
88
# alone now, not shared. Overwrites the .deb's own auto-generated
89
# rkd.desktop outright (install -Dm644 doesn't need it removed first) —
90
# that one's Exec= points at /opt/RKD, wrong for this renamed
91
# /opt/$pkgname install.
92
install -Dm644 /dev/stdin "$pkgdir/usr/share/applications/rkd.desktop" <<EOF
93
[Desktop Entry]
94
Name=RKD
95
Comment=RKD desktop client
96
Exec=/opt/$pkgname/rkd %U
97
Terminal=false
98
Type=Application
99
Icon=$pkgname
100
StartupWMClass=Rkd
101
Categories=Network;
102
# rkd-terminal pair's link (#1185); per channel, so the two never share it.
103
MimeType=x-scheme-handler/rkd;
104
EOF
105
106
mv "$pkgdir/usr/share/icons/hicolor/512x512/apps/rkd.png" \
107
"$pkgdir/usr/share/icons/hicolor/512x512/apps/$pkgname.png"
108
109
install -Dm644 "$pkgdir/opt/$pkgname/LICENSE.electron.txt" \
110
"$pkgdir/usr/share/licenses/$pkgname/LICENSE.electron.txt"
111
install -Dm644 "$pkgdir/opt/$pkgname/LICENSES.chromium.html" \
112
"$pkgdir/usr/share/licenses/$pkgname/LICENSES.chromium.html"
113
114
rm -rf "$pkgdir/usr/share/doc/rkd"
115
}
116
Changes since previous scan
--- PKGBUILD @ 2026-10-12 00:18+++ PKGBUILD @ 2026-10-20 00:10@@ -14,14 +14,15 @@ # pushed to the AUR yet; that happens by hand once, at the same time as the # first stable (0.2.0) release cut. #-# Installs alongside rkd-dev-bin under a distinct path (/opt/rkd-bin) so-# both can coexist. The Electron build's WM class/binary internals still say-# "RKD" (baked in at build time by productName), so windows from rkd-bin and-# rkd-dev-bin won't be visually distinguishable beyond the launcher name/icon-# — acceptable, mirrors rkd-dev-bin's own PKGBUILD comment.+# Installs alongside rkd-dev-bin under a distinct path (/opt/rkd-bin) — real+# coexistence (#822): this is the channel that keeps the original app+# identity unchanged (Electron app name "RKD", .desktop filename rkd.desktop)+# so existing installs/data aren't disrupted; rkd-dev-bin moved to its own+# name and rkd-dev.desktop instead of sharing this one. See that PKGBUILD's+# header comment for the coexistence rationale in full. pkgname=rkd-bin-pkgver=0.2.0+pkgver=0.3.1 pkgrel=1 pkgdesc="RKD desktop client" arch=(x86_64)@@ -32,7 +33,6 @@ # blobs that were never built with debug info to begin with. options=(!strip !debug) provides=(rkd)-conflicts=(rkd rkd-dev-bin) depends=( alsa-lib at-spi2-core@@ -55,12 +55,15 @@ # _pkgver: raw semver as it appears in the .deb filename. # _tag: the Forgejo release tag the asset was uploaded under.-_pkgver=0.2.0-_tag=v0.2.0+_pkgver=0.3.1+_tag=v0.3.1 source=("$pkgname-$pkgver.deb::https://git.rkd.nanoya.biz/rkd/releases/releases/download/${_tag}/RKD-electron-rkd_${_pkgver}_amd64.deb")-sha256sums=('a1bfbaef744f961011ae49231bd52f9b87a470dab3f8bdb71d73b4d88b65162f')+sha256sums=('1d83f673b599451bdd45a4630da08488a2e467aad0b35aac026b4e04814e919a') noextract=("$pkgname-$pkgver.deb")+# Tells whoever removes the package how to remove the rkd-activity user+# service the app may have installed (#1145); root can't reach user units.+install=$pkgname.install package() { bsdtar -xf "$pkgname-$pkgver.deb" -C "$srcdir"@@ -76,17 +79,16 @@ install -d "$pkgdir/usr/bin" ln -s "/opt/$pkgname/rkd" "$pkgdir/usr/bin/$pkgname" - # Installed as the shared rkd.desktop filename (not $pkgname.desktop) so- # it matches main.ts's app.setDesktopName("rkd") across every channel —- # that's what Chromium's GetXdgAppId() reports for the notification- # desktop-entry hint, and it has to match the installed filename exactly- # for OS notification history to resolve this app's identity (#570).- # Name=/Icon=/Exec= below stay per-channel; only the filename is shared —- # rkd-bin and rkd-dev-bin already conflicts= each other, so only one is- # ever actually installed at a time, no real collision here. Overwrites- # the .deb's own auto-generated rkd.desktop outright (install -Dm644- # doesn't need it removed first) — that one's Exec= points at /opt/RKD,- # wrong for this renamed /opt/$pkgname install.+ # Installed as rkd.desktop, matching main.ts's app.setDesktopName("rkd.desktop")+ # for the stable (non-beta-stamped) build — that's what Chromium's+ # GetXdgAppId() reports for the notification desktop-entry hint, and it+ # has to match the installed filename exactly for OS notification history+ # to resolve this app's identity (#570). rkd-dev-bin installs its own+ # rkd-dev.desktop instead (#822), so this filename is this package's+ # alone now, not shared. Overwrites the .deb's own auto-generated+ # rkd.desktop outright (install -Dm644 doesn't need it removed first) —+ # that one's Exec= points at /opt/RKD, wrong for this renamed+ # /opt/$pkgname install. install -Dm644 /dev/stdin "$pkgdir/usr/share/applications/rkd.desktop" <<EOF [Desktop Entry] Name=RKD@@ -97,6 +99,8 @@ Icon=$pkgname StartupWMClass=Rkd Categories=Network;+# rkd-terminal pair's link (#1185); per channel, so the two never share it.+MimeType=x-scheme-handler/rkd; EOF mv "$pkgdir/usr/share/icons/hicolor/512x512/apps/rkd.png" \Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-10-20 00:10:31 | Medium | 2 |
| 2026-10-19 00:03:55 | Medium | 2 |
| 2026-10-18 00:06:55 | Medium | 2 |
| 2026-10-17 00:21:55 | Medium | 2 |
| 2026-10-16 00:12:47 | Medium | 2 |
| 2026-10-15 00:28:05 | Medium | 2 |
| 2026-10-14 00:06:47 | Medium | 2 |
| 2026-10-13 00:23:45 | Medium | 2 |
| 2026-10-12 09:12:50 | Medium | 2 |
| 2026-10-12 00:18:51 | Medium | 2 |
| 2026-10-11 00:26:05 | Medium | 2 |
| 2026-10-10 00:11:52 | Medium | 2 |
| 2026-10-09 00:05:33 | Medium | 2 |
| 2026-10-08 00:28:03 | Medium | 2 |
| 2026-10-07 00:21:34 | Medium | 2 |
| 2026-10-06 00:13:36 | Medium | 2 |
| 2026-10-05 23:40:58 | Medium | 1 |
| 2026-10-05 00:08:03 | Medium | 2 |
| 2026-10-04 00:18:08 | Medium | 2 |
| 2026-10-03 00:23:04 | Medium | 2 |