rkd-dev-bin
LOW
maintainer shjackal
0 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The package downloads a prebuilt .deb from the project's own domain (git.rkd.nanoya.biz), which is plausibly the official source; while the host is not a standard forge, it is project-specific and the binary is repackaged locally, posing minimal supply-chain risk.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt .deb from the project's own domain (git.rkd.nanoya.biz), which is plausibly the official source; while the host is not a standard forge, it is project-specific and the binary is repackaged locally, posing minimal supply-chain risk.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:68
source=("$pkgname-$pkgver.deb::https://git.rkd.nanoya.biz/rkd/releases/releases/download/${_tag}/RKD-electron-rkd_${_pkgver}_amd64.deb")
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: RKD <no-reply@rkd.chat>
2
3
# Tracks beta-release.yml tags (git.rkd.nanoya.biz/rkd/releases), e.g.
4
# v0.2.0-beta.14. No fixed "latest beta" URL exists (unlike the stable
5
# channel's /releases/latest tag pointer), so pkgver/_pkgver/_tag below are
6
# bumped by hand on every new beta and pushed to the AUR git repo — there is
7
# no CI auto-push yet (#433).
8
#
9
# Installs alongside rkd-bin under a distinct path (/opt/rkd-dev-bin) — real
10
# coexistence (#822): main.ts gives this channel its own Electron app name
11
# (own ~/.config data dir, so it can't clobber rkd-bin's settings/auth
12
# tokens) and its own .desktop identity (this file, installed as
13
# rkd-dev.desktop rather than the shared rkd.desktop rkd-bin uses — sharing
14
# that path was the actual reason these two used to `conflicts=`). Betas
15
# before #1210 ship the .deb's binary, icon and .desktop as `rkd`, like
16
# stable, so that rkd.desktop is deleted below rather than left in place —
17
# otherwise it would collide with rkd-bin's own rkd.desktop the moment both
18
# packages are installed together. From #1210 on the beta .deb names all
19
# three `rkd-dev` (electron-builder.cjs `linux.executableName`); package()
20
# takes either.
21
#
22
# Window-switcher-level distinction (a WM_CLASS the OS window manager can
23
# tell apart, e.g. via StartupWMClass) is NOT included — Electron's actual
24
# WM_CLASS derivation from app.setName() wasn't verified live before this
25
# shipped, and a wrong guess here is worse than the field's absence (a
26
# missing StartupWMClass just falls back to heuristic matching, the same
27
# degraded-but-working state this package shipped with before #822).
28
29
pkgname=rkd-dev-bin
30
pkgver=0.4.0_beta.14
31
pkgrel=1
32
pkgdesc="RKD desktop client (beta/development channel)"
33
arch=(x86_64)
34
url="https://git.rkd.nanoya.biz/rkd/releases"
35
license=(LicenseRef-custom)
36
# Prebuilt vendor binaries (chrome-sandbox, libvulkan.so.1, ...) — stripping
37
# or gdb-add-index'ing them corrupts the setuid helper and wastes time on
38
# blobs that were never built with debug info to begin with.
39
options=(!strip !debug)
40
provides=(rkd)
41
depends=(
42
alsa-lib
43
at-spi2-core
44
gtk3
45
nss
46
# Not linked directly by the rkd/Electron binary (namcap flags these as
47
# "may not be needed") — Electron dlopen()s them at runtime instead:
48
# libnotify (native notifications), libsecret (keytar-style credential
49
# storage), libxss (idle/screensaver detection), libxtst (synthetic input
50
# for global shortcuts), util-linux-libs (libuuid, used by Chromium's
51
# base/), xdg-utils (xdg-open subprocess for external links).
52
libnotify
53
libsecret
54
libxss
55
libxtst
56
util-linux-libs
57
xdg-utils
58
)
59
optdepends=('libayatana-appindicator: tray icon support')
60
61
# _pkgver: raw semver as it appears in the .deb filename (electron-builder
62
# uses the hyphenated form there even though the .deb's own control file
63
# reports a tilde per Debian pre-release convention).
64
# _tag: the Forgejo release tag the asset was uploaded under.
65
_pkgver=0.4.0-beta.14
66
_tag=v0.4.0-beta.14
67
68
source=("$pkgname-$pkgver.deb::https://git.rkd.nanoya.biz/rkd/releases/releases/download/${_tag}/RKD-electron-rkd_${_pkgver}_amd64.deb")
69
sha256sums=('155ad96017b29f782185e865e272db1c24b42e0e86b6eb1caf131581005b45be')
70
noextract=("$pkgname-$pkgver.deb")
71
# Tells whoever removes the package how to remove the rkd-activity user
72
# service the app may have installed (#1145); root can't reach user units.
73
install=$pkgname.install
74
75
package() {
76
bsdtar -xf "$pkgname-$pkgver.deb" -C "$srcdir"
77
bsdtar -xf "$srcdir/data.tar.xz" -C "$pkgdir"
78
79
mv "$pkgdir/opt/RKD" "$pkgdir/opt/$pkgname"
80
81
# chrome-sandbox needs the setuid bit to sandbox renderers without
82
# CAP_SYS_ADMIN/unprivileged userns; fakeroot preserves this bit into the
83
# package archive and pacman applies it for real on install (as root).
84
chmod 4755 "$pkgdir/opt/$pkgname/chrome-sandbox"
85
86
# The binary's name in the .deb: rkd-dev from #1210 on, rkd before.
87
local _bin=rkd-dev
88
[ -e "$pkgdir/opt/$pkgname/$_bin" ] || _bin=rkd
89
90
install -d "$pkgdir/usr/bin"
91
ln -s "/opt/$pkgname/$_bin" "$pkgdir/usr/bin/$pkgname"
92
93
# Installed as rkd-dev.desktop (#822) — matches main.ts's
94
# app.setDesktopName("rkd-dev.desktop") for the beta-version-stamped build, which
95
# is what Chromium's GetXdgAppId() reports for the notification
96
# desktop-entry hint (#570); has to match the installed filename exactly
97
# for OS notification history to resolve this app's identity. Delete the
98
# .deb's own auto-generated rkd.desktop first — coexisting with rkd-bin
99
# now means that path is rkd-bin's alone, and leaving this package's copy
100
# in place too would collide the moment both are installed together (that
101
# collision is exactly what `conflicts=` used to paper over).
102
rm -f "$pkgdir/usr/share/applications/rkd.desktop"
103
install -Dm644 /dev/stdin "$pkgdir/usr/share/applications/rkd-dev.desktop" <<EOF
104
[Desktop Entry]
105
Name=RKD Dev
106
Comment=RKD desktop client (beta/development channel)
107
Exec=/opt/$pkgname/$_bin %U
108
Terminal=false
109
Type=Application
110
Icon=$pkgname
111
Categories=Network;
112
# rkd-terminal pair's link (#1185); per channel, so the two never share it.
113
MimeType=x-scheme-handler/rkd-dev;
114
EOF
115
116
mv "$pkgdir/usr/share/icons/hicolor/512x512/apps/$_bin.png" \
117
"$pkgdir/usr/share/icons/hicolor/512x512/apps/$pkgname.png"
118
119
install -Dm644 "$pkgdir/opt/$pkgname/LICENSE.electron.txt" \
120
"$pkgdir/usr/share/licenses/$pkgname/LICENSE.electron.txt"
121
install -Dm644 "$pkgdir/opt/$pkgname/LICENSES.chromium.html" \
122
"$pkgdir/usr/share/licenses/$pkgname/LICENSES.chromium.html"
123
124
rm -rf "$pkgdir/usr/share/doc/rkd"
125
}
126
Changes since previous scan
--- PKGBUILD @ 2026-10-29 00:13+++ PKGBUILD @ 2026-11-01 00:21@@ -27,7 +27,7 @@ # degraded-but-working state this package shipped with before #822). pkgname=rkd-dev-bin-pkgver=0.4.0_beta.13+pkgver=0.4.0_beta.14 pkgrel=1 pkgdesc="RKD desktop client (beta/development channel)" arch=(x86_64)@@ -62,11 +62,11 @@ # uses the hyphenated form there even though the .deb's own control file # reports a tilde per Debian pre-release convention). # _tag: the Forgejo release tag the asset was uploaded under.-_pkgver=0.4.0-beta.13-_tag=v0.4.0-beta.13+_pkgver=0.4.0-beta.14+_tag=v0.4.0-beta.14 source=("$pkgname-$pkgver.deb::https://git.rkd.nanoya.biz/rkd/releases/releases/download/${_tag}/RKD-electron-rkd_${_pkgver}_amd64.deb")-sha256sums=('b832604aa32bad66e6eb0ee922fce79a29abd03d1d12ecc216a7216692be4952')+sha256sums=('155ad96017b29f782185e865e272db1c24b42e0e86b6eb1caf131581005b45be') noextract=("$pkgname-$pkgver.deb") # Tells whoever removes the package how to remove the rkd-activity user # service the app may have installed (#1145); root can't reach user units.Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 23:54:04 | Medium | 1 |
| 2026-10-29 00:13:55 | Low | 2 |
| 2026-10-28 00:06:54 | Low | 2 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 23:38:30 | Medium | 1 |
| 2026-10-23 21:38:30 | Medium | 1 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 01:20:44 | Medium | 1 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 13:18:05 | Medium | 1 |