scratch3-bin
maintainer jasongodev
· 7 votes
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The package downloads a prebuilt Electron executable from the official Scratch domain, which is a legitimate source; the build process unpacks and modifies it safely, and no untrusted remote code execution occurs.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt Electron executable from the official Scratch domain, which is a legitimate source; the build process unpacks and modifies it safely, and no untrusted remote code execution occurs.
2 higher static findings superseded - not the current verdict (shown for transparency)
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:16
source=("https://downloads.scratch.mit.edu/desktop/Scratch%20$pkgver%20Setup.exe"
MEDIUM
Recently orphaned & re-adopted
orphaned_readopted
This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Taboon Egon <te451 -_AT_- netcourrier -_DOT_- com>
2
# Contributor: relrel <relrelbachar@gmail.com>
3
4
pkgname=scratch3-bin
5
_pkgname=scratch3
6
conflicts=("scratch3")
7
pkgver=3.29.1
8
pkgrel=2
9
pkgdesc="Scratch 3.0 as a self-contained electron desktop application"
10
arch=("x86_64" "i686" "aarch64" "arm7h")
11
url="https://scratch.mit.edu"
12
license=("custom:BSD-3-Clause")
13
depends=("c-ares" "ffmpeg" "flac" "gtk3" "libevent" "libxslt" "minizip" "nss" "re2" "snappy")
14
optdepends=("xdg-utils: open URLs with desktop's default (xdg-email, xdg-open)")
15
makedepends=('electron13-bin' 'p7zip' 'asar')
16
source=("https://downloads.scratch.mit.edu/desktop/Scratch%20$pkgver%20Setup.exe"
17
"https://raw.githubusercontent.com/LLK/scratch-desktop/develop/LICENSE"
18
"${_pkgname}.desktop"
19
"${_pkgname}-icons.tar.gz"
20
"${_pkgname}.xml")
21
noextract=("Scratch%20$pkgver%20Setup.exe")
22
sha256sums=('dfca2f1a842aea69a2b0a22ca66fa7852f86259e3da4f576f8ae7fa16f1e9134'
23
'8486a10c4393cee1c25392769ddd3b2d6c242d6ec7928e1414efff7dfb2f07ef'
24
'0f4f25e55b988e45a2f240487c35b18c96bbbce0f6be60bbe204b33f6d77d6da'
25
'1445107a18b05cee3db8d6cd59e57b9a0468f70d9aceffefd0a1f24196f8b2da'
26
'86c8e16d9316dcbe21c19928381a498f5198708cae0ed25bfa3c09371d02deaf')
27
28
prepare() {
29
cd "$srcdir/"
30
# Extract files from "Scratch%20$pkgver%20Setup.exe" only what is needed with 7za
31
7za x -aoa -y "Scratch%20$pkgver%20Setup.exe" resources/ -o$pkgname/
32
33
# Adjust folder's attributes
34
chmod 755 $pkgname/resources/{,static/{,assets/}}
35
36
# Copy the electron files needed for scratch and rename the executable
37
cp -rf /usr/lib/electron13/* $srcdir/$pkgname/
38
mv $pkgname/electron $pkgname/$_pkgname
39
40
# All license files in one place
41
#mv $pkgname/LICENSE LICENSE-electron
42
#mv $pkgname/LICENSES.chromium.html LICENSES.chromium.html
43
# Temporary fix for using electron13-bin
44
cp /usr/share/licenses/electron13-bin/LICENSE LICENSE-electron
45
cp /usr/share/licenses/electron13-bin/LICENSES.chromium.html LICENSES.chromium.html
46
47
# This file is useless
48
rm $pkgname/resources/default_app.asar
49
50
# We don't need, if any, windows/dos file executables, remove them.
51
find $srcdir/$pkgname/ -type f -name "*.exe" -delete
52
find $srcdir/$pkgname/ -type f -name "*.dll" -delete
53
54
# Hack to make scratch3 work with electron > 11 (Credit: unphysicalix)
55
tmpdir=$(mktemp -d -p ${srcdir})
56
asar extract ${srcdir}/$pkgname/resources/app.asar $tmpdir
57
sed -i "s@nodeIntegration: true@nodeIntegration: true,\\\n contextIsolation: false@" ${tmpdir}/main.js
58
asar pack $tmpdir ${srcdir}/$pkgname/resources/app.asar
59
rm -rf $tmpdir
60
}
61
62
package() {
63
install -dm755 ${pkgdir}/usr/bin
64
ln -sf /opt/${pkgname}/${_pkgname} ${pkgdir}/usr/bin/${_pkgname}
65
66
install -Dm644 "${_pkgname}.desktop" $pkgdir/usr/share/applications/${_pkgname}.desktop
67
install -Dm644 "ScratchDesktop.svg" $pkgdir/usr/share/icons/hicolor/scalable/apps/${_pkgname}.svg
68
install -Dm644 "cathead.svg" $pkgdir/usr/share/icons/hicolor/scalable/mimetypes/x-scratch3-sprite.svg
69
install -Dm644 "${_pkgname}.xml" $pkgdir/usr/share/mime/packages/${_pkgname}.xml
70
install -Dm644 LICENS* -t "$pkgdir/usr/share/licenses/$pkgname"
71
72
install -dm755 "${pkgdir}/opt/$pkgname"
73
cp -r $srcdir/$pkgname -t "$pkgdir/opt"
74
}
75
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 3 |
| 2026-08-02 00:16:08 | LOW | 3 |
| 2026-08-01 00:11:18 | LOW | 3 |
| 2026-07-31 00:14:10 | LOW | 3 |
| 2026-07-30 00:17:23 | LOW | 3 |
| 2026-07-29 00:25:53 | LOW | 3 |
| 2026-07-28 00:07:28 | LOW | 3 |
| 2026-07-27 00:24:32 | LOW | 3 |
| 2026-07-26 00:07:32 | LOW | 3 |
| 2026-07-25 00:13:44 | LOW | 3 |
| 2026-07-24 00:02:28 | LOW | 3 |
| 2026-07-23 00:14:47 | LOW | 3 |
| 2026-07-22 00:29:32 | LOW | 3 |
| 2026-07-21 00:24:15 | LOW | 3 |
| 2026-07-20 00:19:49 | LOW | 3 |
| 2026-07-19 00:17:08 | LOW | 3 |
| 2026-07-18 00:14:48 | LOW | 3 |
| 2026-07-17 00:06:16 | LOW | 3 |
| 2026-07-16 00:05:41 | LOW | 3 |
| 2026-07-15 00:09:25 | LOW | 3 |