rkd-dev-bin

maintainer shjackal · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package installs a prebuilt .deb binary from a non-standard, non-whitelisted host (git.rkd.nanoya.biz) which could be swapped with malicious code, constituting a supply-chain risk despite being from the project's own domain.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:55 source=("$pkgname-$pkgver.deb::https://git.rkd.nanoya.biz/rkd/releases/releases/download/${_tag}/RKD-electron-rkd_${_pkgver}_amd64.deb")

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package installs a prebuilt .deb binary from a non-standard, non-whitelisted host (git.rkd.nanoya.biz) which could be swapped with malicious code, constituting a supply-chain risk despite being from the project's own domain.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: RKD <rkd@users.noreply.github.com>
    
      2
    
      3# Tracks beta-release.yml tags (git.rkd.nanoya.biz/rkd/releases), e.g.
    
      4# v0.2.0-beta.14. No fixed "latest beta" URL exists (unlike the stable
    
      5# channel's /releases/latest tag pointer), so pkgver/_pkgver/_tag below are
    
      6# bumped by hand on every new beta and pushed to the AUR git repo — there is
    
      7# no CI auto-push yet (#433).
    
      8#
    
      9# Installs alongside rkd-bin under a distinct path (/opt/rkd-dev-bin) so both
    
      10# can coexist. The Electron build's WM class/binary internals still say
    
      11# "RKD" (baked in at build time by productName), so windows from rkd-bin and
    
      12# rkd-dev-bin won't be visually distinguishable beyond the launcher name/icon
    
      13# — acceptable for a beta-tracking package.
    
      14
    
      15pkgname=rkd-dev-bin
    
      16pkgver=0.2.0_beta.17
    
      17pkgrel=1
    
      18pkgdesc="RKD desktop client (beta/development channel)"
    
      19arch=(x86_64)
    
      20url="https://git.rkd.nanoya.biz/rkd/releases"
    
      21license=(LicenseRef-custom)
    
      22# Prebuilt vendor binaries (chrome-sandbox, libvulkan.so.1, ...) — stripping
    
      23# or gdb-add-index'ing them corrupts the setuid helper and wastes time on
    
      24# blobs that were never built with debug info to begin with.
    
      25options=(!strip !debug)
    
      26provides=(rkd)
    
      27conflicts=(rkd rkd-bin)
    
      28depends=(
    
      29  alsa-lib
    
      30  at-spi2-core
    
      31  gtk3
    
      32  nss
    
      33  # Not linked directly by the rkd/Electron binary (namcap flags these as
    
      34  # "may not be needed") — Electron dlopen()s them at runtime instead:
    
      35  # libnotify (native notifications), libsecret (keytar-style credential
    
      36  # storage), libxss (idle/screensaver detection), libxtst (synthetic input
    
      37  # for global shortcuts), util-linux-libs (libuuid, used by Chromium's
    
      38  # base/), xdg-utils (xdg-open subprocess for external links).
    
      39  libnotify
    
      40  libsecret
    
      41  libxss
    
      42  libxtst
    
      43  util-linux-libs
    
      44  xdg-utils
    
      45)
    
      46optdepends=('libayatana-appindicator: tray icon support')
    
      47
    
      48# _pkgver: raw semver as it appears in the .deb filename (electron-builder
    
      49# uses the hyphenated form there even though the .deb's own control file
    
      50# reports a tilde per Debian pre-release convention).
    
      51# _tag: the Forgejo release tag the asset was uploaded under.
    
      52_pkgver=0.2.0-beta.17
    
      53_tag=v0.2.0-beta.17
    
      54
    
      55source=("$pkgname-$pkgver.deb::https://git.rkd.nanoya.biz/rkd/releases/releases/download/${_tag}/RKD-electron-rkd_${_pkgver}_amd64.deb")
    
      56sha256sums=('119388cbe4e7a5b9dc86b3319b2d9ef0e22b29754d09de98ed447ae0ba5ef02e')
    
      57noextract=("$pkgname-$pkgver.deb")
    
      58
    
      59package() {
    
      60  bsdtar -xf "$pkgname-$pkgver.deb" -C "$srcdir"
    
      61  bsdtar -xf "$srcdir/data.tar.xz" -C "$pkgdir"
    
      62
    
      63  mv "$pkgdir/opt/RKD" "$pkgdir/opt/$pkgname"
    
      64
    
      65  # chrome-sandbox needs the setuid bit to sandbox renderers without
    
      66  # CAP_SYS_ADMIN/unprivileged userns; fakeroot preserves this bit into the
    
      67  # package archive and pacman applies it for real on install (as root).
    
      68  chmod 4755 "$pkgdir/opt/$pkgname/chrome-sandbox"
    
      69
    
      70  install -d "$pkgdir/usr/bin"
    
      71  ln -s "/opt/$pkgname/rkd" "$pkgdir/usr/bin/$pkgname"
    
      72
    
      73  rm -f "$pkgdir/usr/share/applications/rkd.desktop"
    
      74  install -Dm644 /dev/stdin "$pkgdir/usr/share/applications/$pkgname.desktop" <<EOF
    
      75[Desktop Entry]
    
      76Name=RKD (Dev)
    
      77Comment=RKD desktop client (beta/development channel)
    
      78Exec=/opt/$pkgname/rkd %U
    
      79Terminal=false
    
      80Type=Application
    
      81Icon=$pkgname
    
      82StartupWMClass=RKD
    
      83Categories=Network;
    
      84EOF
    
      85
    
      86  mv "$pkgdir/usr/share/icons/hicolor/512x512/apps/rkd.png" \
    
      87     "$pkgdir/usr/share/icons/hicolor/512x512/apps/$pkgname.png"
    
      88
    
      89  install -Dm644 "$pkgdir/opt/$pkgname/LICENSE.electron.txt" \
    
      90    "$pkgdir/usr/share/licenses/$pkgname/LICENSE.electron.txt"
    
      91  install -Dm644 "$pkgdir/opt/$pkgname/LICENSES.chromium.html" \
    
      92    "$pkgdir/usr/share/licenses/$pkgname/LICENSES.chromium.html"
    
      93
    
      94  rm -rf "$pkgdir/usr/share/doc/rkd"
    
      95}
    
      96

Changes since previous scan

--- PKGBUILD @ 2026-07-27 00:24
+++ PKGBUILD @ 2026-08-03 00:08
@@ -13,7 +13,7 @@
 # — acceptable for a beta-tracking package.
 
 pkgname=rkd-dev-bin
-pkgver=0.2.0_beta.16
+pkgver=0.2.0_beta.17
 pkgrel=1
 pkgdesc="RKD desktop client (beta/development channel)"
 arch=(x86_64)
@@ -49,11 +49,11 @@
 # uses the hyphenated form there even though the .deb's own control file
 # reports a tilde per Debian pre-release convention).
 # _tag: the Forgejo release tag the asset was uploaded under.
-_pkgver=0.2.0-beta.16
-_tag=v0.2.0-beta.16
+_pkgver=0.2.0-beta.17
+_tag=v0.2.0-beta.17
 
 source=("$pkgname-$pkgver.deb::https://git.rkd.nanoya.biz/rkd/releases/releases/download/${_tag}/RKD-electron-rkd_${_pkgver}_amd64.deb")
-sha256sums=('c1217119c509e64cb7b127c33225e2a3aadd295437e8023737683d7375ac6ece')
+sha256sums=('119388cbe4e7a5b9dc86b3319b2d9ef0e22b29754d09de98ed447ae0ba5ef02e')
 noextract=("$pkgname-$pkgver.deb")
 
 package() {

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	3
2026-07-28 00:07:28	MEDIUM	3
2026-07-27 17:35:03	MEDIUM	3
2026-07-27 00:24:32	MEDIUM	3
2026-07-26 00:07:32	MEDIUM	3
2026-07-25 00:13:44	MEDIUM	3
2026-07-24 00:02:28	MEDIUM	3
2026-07-23 00:14:47	MEDIUM	3
2026-07-22 00:29:32	MEDIUM	3
2026-07-21 19:17:41	MEDIUM	3
2026-07-21 00:24:15	MEDIUM	3
2026-07-20 00:19:49	MEDIUM	3
2026-07-19 21:12:02	MEDIUM	3
2026-07-19 00:17:08	MEDIUM	3
2026-07-18 00:14:48	MEDIUM	3