rkd-dev-bin
MEDIUM
maintainer shjackal
0 votes
scanned 2026-09-17 01:24:19.570146
Why flagged
The package downloads a prebuilt .deb from a non-standard, non-whitelisted host (git.rkd.nanoya.biz) which could be swapped with a malicious version, posing a supply-chain risk despite being part of the project's own release infrastructure.
Triggered rules
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:66
source=("$pkgname-$pkgver.deb::https://git.rkd.nanoya.biz/rkd/releases/releases/download/${_tag}/RKD-electron-rkd_${_pkgver}_amd64.deb")
Medium
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads a prebuilt .deb from a non-standard, non-whitelisted host (git.rkd.nanoya.biz) which could be swapped with a malicious version, posing a supply-chain risk despite being part of the project's own release infrastructure.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: RKD <no-reply@rkd.chat>
2
3
# Tracks beta-release.yml tags (git.rkd.nanoya.biz/rkd/releases), e.g.
4
# v0.2.0-beta.14. No fixed "latest beta" URL exists (unlike the stable
5
# channel's /releases/latest tag pointer), so pkgver/_pkgver/_tag below are
6
# bumped by hand on every new beta and pushed to the AUR git repo — there is
7
# no CI auto-push yet (#433).
8
#
9
# Installs alongside rkd-bin under a distinct path (/opt/rkd-dev-bin) — real
10
# coexistence (#822): main.ts gives this channel its own Electron app name
11
# (own ~/.config data dir, so it can't clobber rkd-bin's settings/auth
12
# tokens) and its own .desktop identity (this file, installed as
13
# rkd-dev.desktop rather than the shared rkd.desktop rkd-bin uses — sharing
14
# that path was the actual reason these two used to `conflicts=`). The
15
# .deb's own auto-generated rkd.desktop is still baked from the shared
16
# `productName: RKD` in electron-builder.yml, so it's deleted below rather
17
# than left in place — otherwise it would collide with rkd-bin's own
18
# rkd.desktop the moment both packages are installed together.
19
#
20
# Window-switcher-level distinction (a WM_CLASS the OS window manager can
21
# tell apart, e.g. via StartupWMClass) is NOT included — Electron's actual
22
# WM_CLASS derivation from app.setName() wasn't verified live before this
23
# shipped, and a wrong guess here is worse than the field's absence (a
24
# missing StartupWMClass just falls back to heuristic matching, the same
25
# degraded-but-working state this package shipped with before #822).
26
27
pkgname=rkd-dev-bin
28
pkgver=0.2.0_beta.22
29
pkgrel=1
30
pkgdesc="RKD desktop client (beta/development channel)"
31
arch=(x86_64)
32
url="https://git.rkd.nanoya.biz/rkd/releases"
33
license=(LicenseRef-custom)
34
# Prebuilt vendor binaries (chrome-sandbox, libvulkan.so.1, ...) — stripping
35
# or gdb-add-index'ing them corrupts the setuid helper and wastes time on
36
# blobs that were never built with debug info to begin with.
37
options=(!strip !debug)
38
provides=(rkd)
39
depends=(
40
alsa-lib
41
at-spi2-core
42
gtk3
43
nss
44
# Not linked directly by the rkd/Electron binary (namcap flags these as
45
# "may not be needed") — Electron dlopen()s them at runtime instead:
46
# libnotify (native notifications), libsecret (keytar-style credential
47
# storage), libxss (idle/screensaver detection), libxtst (synthetic input
48
# for global shortcuts), util-linux-libs (libuuid, used by Chromium's
49
# base/), xdg-utils (xdg-open subprocess for external links).
50
libnotify
51
libsecret
52
libxss
53
libxtst
54
util-linux-libs
55
xdg-utils
56
)
57
optdepends=('libayatana-appindicator: tray icon support')
58
59
# _pkgver: raw semver as it appears in the .deb filename (electron-builder
60
# uses the hyphenated form there even though the .deb's own control file
61
# reports a tilde per Debian pre-release convention).
62
# _tag: the Forgejo release tag the asset was uploaded under.
63
_pkgver=0.2.0-beta.22
64
_tag=v0.2.0-beta.22
65
66
source=("$pkgname-$pkgver.deb::https://git.rkd.nanoya.biz/rkd/releases/releases/download/${_tag}/RKD-electron-rkd_${_pkgver}_amd64.deb")
67
sha256sums=('e6e4fdd2d20ab90f45476350378f2608f450da717a6d33ef3c5a1b73a07ec15a')
68
noextract=("$pkgname-$pkgver.deb")
69
70
package() {
71
bsdtar -xf "$pkgname-$pkgver.deb" -C "$srcdir"
72
bsdtar -xf "$srcdir/data.tar.xz" -C "$pkgdir"
73
74
mv "$pkgdir/opt/RKD" "$pkgdir/opt/$pkgname"
75
76
# chrome-sandbox needs the setuid bit to sandbox renderers without
77
# CAP_SYS_ADMIN/unprivileged userns; fakeroot preserves this bit into the
78
# package archive and pacman applies it for real on install (as root).
79
chmod 4755 "$pkgdir/opt/$pkgname/chrome-sandbox"
80
81
install -d "$pkgdir/usr/bin"
82
ln -s "/opt/$pkgname/rkd" "$pkgdir/usr/bin/$pkgname"
83
84
# Installed as rkd-dev.desktop (#822) — matches main.ts's
85
# app.setDesktopName("rkd-dev") for the beta-version-stamped build, which
86
# is what Chromium's GetXdgAppId() reports for the notification
87
# desktop-entry hint (#570); has to match the installed filename exactly
88
# for OS notification history to resolve this app's identity. Delete the
89
# .deb's own auto-generated rkd.desktop first — coexisting with rkd-bin
90
# now means that path is rkd-bin's alone, and leaving this package's copy
91
# in place too would collide the moment both are installed together (that
92
# collision is exactly what `conflicts=` used to paper over).
93
rm -f "$pkgdir/usr/share/applications/rkd.desktop"
94
install -Dm644 /dev/stdin "$pkgdir/usr/share/applications/rkd-dev.desktop" <<EOF
95
[Desktop Entry]
96
Name=RKD (Dev)
97
Comment=RKD desktop client (beta/development channel)
98
Exec=/opt/$pkgname/rkd %U
99
Terminal=false
100
Type=Application
101
Icon=$pkgname
102
Categories=Network;
103
EOF
104
105
mv "$pkgdir/usr/share/icons/hicolor/512x512/apps/rkd.png" \
106
"$pkgdir/usr/share/icons/hicolor/512x512/apps/$pkgname.png"
107
108
install -Dm644 "$pkgdir/opt/$pkgname/LICENSE.electron.txt" \
109
"$pkgdir/usr/share/licenses/$pkgname/LICENSE.electron.txt"
110
install -Dm644 "$pkgdir/opt/$pkgname/LICENSES.chromium.html" \
111
"$pkgdir/usr/share/licenses/$pkgname/LICENSES.chromium.html"
112
113
rm -rf "$pkgdir/usr/share/doc/rkd"
114
}
115
Changes since previous scan
--- PKGBUILD @ 2026-09-17 00:27+++ PKGBUILD @ 2026-09-17 01:24@@ -6,14 +6,26 @@ # bumped by hand on every new beta and pushed to the AUR git repo — there is # no CI auto-push yet (#433). #-# Installs alongside rkd-bin under a distinct path (/opt/rkd-dev-bin) so both-# can coexist. The Electron build's WM class/binary internals still say-# "RKD" (baked in at build time by productName), so windows from rkd-bin and-# rkd-dev-bin won't be visually distinguishable beyond the launcher name/icon-# — acceptable for a beta-tracking package.+# Installs alongside rkd-bin under a distinct path (/opt/rkd-dev-bin) — real+# coexistence (#822): main.ts gives this channel its own Electron app name+# (own ~/.config data dir, so it can't clobber rkd-bin's settings/auth+# tokens) and its own .desktop identity (this file, installed as+# rkd-dev.desktop rather than the shared rkd.desktop rkd-bin uses — sharing+# that path was the actual reason these two used to `conflicts=`). The+# .deb's own auto-generated rkd.desktop is still baked from the shared+# `productName: RKD` in electron-builder.yml, so it's deleted below rather+# than left in place — otherwise it would collide with rkd-bin's own+# rkd.desktop the moment both packages are installed together.+#+# Window-switcher-level distinction (a WM_CLASS the OS window manager can+# tell apart, e.g. via StartupWMClass) is NOT included — Electron's actual+# WM_CLASS derivation from app.setName() wasn't verified live before this+# shipped, and a wrong guess here is worse than the field's absence (a+# missing StartupWMClass just falls back to heuristic matching, the same+# degraded-but-working state this package shipped with before #822). pkgname=rkd-dev-bin-pkgver=0.2.0_beta.21+pkgver=0.2.0_beta.22 pkgrel=1 pkgdesc="RKD desktop client (beta/development channel)" arch=(x86_64)@@ -24,7 +36,6 @@ # blobs that were never built with debug info to begin with. options=(!strip !debug) provides=(rkd)-conflicts=(rkd rkd-bin) depends=( alsa-lib at-spi2-core@@ -49,11 +60,11 @@ # uses the hyphenated form there even though the .deb's own control file # reports a tilde per Debian pre-release convention). # _tag: the Forgejo release tag the asset was uploaded under.-_pkgver=0.2.0-beta.21-_tag=v0.2.0-beta.21+_pkgver=0.2.0-beta.22+_tag=v0.2.0-beta.22 source=("$pkgname-$pkgver.deb::https://git.rkd.nanoya.biz/rkd/releases/releases/download/${_tag}/RKD-electron-rkd_${_pkgver}_amd64.deb")-sha256sums=('253b4e0eb73be66857ab034a59cbe32b630f9b604016d92da7d67dc87001f7e4')+sha256sums=('e6e4fdd2d20ab90f45476350378f2608f450da717a6d33ef3c5a1b73a07ec15a') noextract=("$pkgname-$pkgver.deb") package() {@@ -70,18 +81,17 @@ install -d "$pkgdir/usr/bin" ln -s "/opt/$pkgname/rkd" "$pkgdir/usr/bin/$pkgname" - # Installed as the shared rkd.desktop filename (not $pkgname.desktop) so- # it matches main.ts's app.setDesktopName("rkd") across every channel —- # that's what Chromium's GetXdgAppId() reports for the notification- # desktop-entry hint, and it has to match the installed filename exactly- # for OS notification history to resolve this app's identity (#570).- # Name=/Icon=/Exec= below stay per-channel; only the filename is shared —- # rkd-bin and rkd-dev-bin already conflicts= each other, so only one is- # ever actually installed at a time, no real collision here. Overwrites- # the .deb's own auto-generated rkd.desktop outright (install -Dm644- # doesn't need it removed first) — that one's Exec= points at /opt/RKD,- # wrong for this renamed /opt/$pkgname install.- install -Dm644 /dev/stdin "$pkgdir/usr/share/applications/rkd.desktop" <<EOF+ # Installed as rkd-dev.desktop (#822) — matches main.ts's+ # app.setDesktopName("rkd-dev") for the beta-version-stamped build, which+ # is what Chromium's GetXdgAppId() reports for the notification+ # desktop-entry hint (#570); has to match the installed filename exactly+ # for OS notification history to resolve this app's identity. Delete the+ # .deb's own auto-generated rkd.desktop first — coexisting with rkd-bin+ # now means that path is rkd-bin's alone, and leaving this package's copy+ # in place too would collide the moment both are installed together (that+ # collision is exactly what `conflicts=` used to paper over).+ rm -f "$pkgdir/usr/share/applications/rkd.desktop"+ install -Dm644 /dev/stdin "$pkgdir/usr/share/applications/rkd-dev.desktop" <<EOF [Desktop Entry] Name=RKD (Dev) Comment=RKD desktop client (beta/development channel)@@ -89,7 +99,6 @@ Terminal=false Type=Application Icon=$pkgname-StartupWMClass=Rkd Categories=Network; EOF Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 01:24:19 | Medium | 2 |
| 2026-09-17 00:27:14 | Medium | 2 |
| 2026-09-16 00:03:17 | Medium | 2 |
| 2026-09-15 00:25:31 | Medium | 2 |
| 2026-09-14 00:27:57 | Medium | 2 |
| 2026-09-13 00:19:54 | Medium | 2 |
| 2026-09-12 00:25:17 | Medium | 2 |
| 2026-09-11 00:19:22 | Medium | 2 |
| 2026-09-10 00:22:44 | Medium | 2 |
| 2026-09-09 00:04:09 | Medium | 2 |
| 2026-09-08 00:18:08 | Medium | 2 |
| 2026-09-07 00:30:15 | Medium | 2 |
| 2026-09-06 00:17:06 | Medium | 2 |
| 2026-09-05 00:16:27 | Medium | 2 |
| 2026-09-04 17:58:35 | Medium | 2 |
| 2026-09-04 00:03:13 | Medium | 2 |
| 2026-09-03 00:15:47 | Medium | 2 |
| 2026-09-02 00:02:31 | Medium | 2 |
| 2026-09-01 00:11:19 | Medium | 2 |
| 2026-08-31 00:19:57 | Medium | 2 |