roam-research
MEDIUM
maintainer neko_ayaya
6 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads a prebuilt Electron binary (.deb) from an S3 bucket, which is an unverifiable source; if compromised, an attacker could silently replace the binary with a malicious one, posing a supply-chain risk.
Triggered rules
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:13
"$_pkgname-$pkgver.tgz::https://roam-electron-deploy.s3.us-east-2.amazonaws.com/${_pkgname}_${pkgver}_amd64.deb"
Medium
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt Electron binary (.deb) from an S3 bucket, which is an unverifiable source; if compromised, an attacker could silently replace the binary with a malicious one, posing a supply-chain risk.
PKGBUILD
1 offending line(s) highlighted
1
_pkgname=roam-research
2
pkgname=roam-research
3
pkgver=0.0.38
4
pkgrel=1
5
pkgdesc="A note-taking tool for networked thought"
6
arch=('any')
7
url="https://roamresearch.com/"
8
license=('custom')
9
depends=()
10
# Prebuilt, already-stripped Electron binary — skip debug-symbol packaging and stripping.
11
options=(!debug !strip)
12
source=(
13
"$_pkgname-$pkgver.tgz::https://roam-electron-deploy.s3.us-east-2.amazonaws.com/${_pkgname}_${pkgver}_amd64.deb"
14
"LICENSE"
15
)
16
md5sums=('857803e964931235a77db69912d3212f'
17
'34234c4e196ceeaf00e4ee7f29b9fb63')
18
19
prepare() {
20
tar -xvf data.tar.xz
21
}
22
23
package() {
24
cd "$srcdir"
25
26
# Making paths work with a space is error-prone, so let's replace with a simpler kebab-case directory
27
sed -i "s/\/opt\/Roam Research/\/opt\/$_pkgname/" usr/share/applications/roam-research.desktop
28
29
# Install all the things
30
install -d "$pkgdir"/{opt/$_pkgname,usr/share,usr/bin}
31
cp -r opt/Roam\ Research/* -t "$pkgdir"/opt/$_pkgname
32
cp -r usr/share/* -t "$pkgdir"/usr/share
33
34
# Make the desktop icons available
35
# (not sure why they're under 0x0? Where is that used?)
36
install -d "$pkgdir"/usr/share/icons/hicolor/1024x1024
37
cp -r usr/share/icons/hicolor/256x256/* -t "$pkgdir"/usr/share/icons/hicolor/1024x1024
38
install -d "$pkgdir"/usr/share/pixmaps
39
install -D usr/share/icons/hicolor/256x256/apps/roam-research.png -t "$pkgdir"/usr/share/pixmaps
40
41
# Make the binary available in the $PATH
42
ln -s /opt/${_pkgname}/${_pkgname} "${pkgdir}"/usr/bin/${_pkgname}
43
44
# Add a license that links to the Terms and Conditions and Privacy Policy from https://roamresearch.com
45
install -Dm644 LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
46
}
47
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Medium | 2 |
| 2026-09-16 00:03:17 | Medium | 2 |
| 2026-09-15 00:25:31 | Medium | 2 |
| 2026-09-14 00:27:57 | Medium | 2 |
| 2026-09-13 00:19:54 | Medium | 2 |
| 2026-09-12 00:25:17 | Medium | 2 |
| 2026-09-11 00:19:22 | Medium | 2 |
| 2026-09-10 00:22:44 | Medium | 2 |
| 2026-09-09 00:04:09 | Medium | 2 |
| 2026-09-08 00:18:08 | Medium | 2 |
| 2026-09-07 00:30:15 | Medium | 2 |
| 2026-09-06 00:17:06 | Medium | 2 |
| 2026-09-05 00:16:27 | Medium | 2 |
| 2026-09-04 00:03:13 | Medium | 2 |
| 2026-09-03 00:15:47 | Medium | 2 |
| 2026-09-02 00:02:31 | Medium | 2 |
| 2026-09-01 00:11:19 | Medium | 2 |
| 2026-08-31 00:19:57 | Medium | 2 |
| 2026-08-30 00:04:14 | Medium | 2 |
| 2026-08-29 00:29:17 | Medium | 2 |