senden-bin

MEDIUM

maintainer PandaDEV 0 votes scanned 2026-10-28 01:51:06.267873

View on AUR

Why flagged

Prebuilt binary Electron app downloaded from a non-standard object storage host (eplg.cloud) unrelated to the project's own domain (senden.chat); checksums are present which mitigates swap risk, but the release infrastructure is an unverifiable third-party cloud bucket rather than an official project domain or well-known forge.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:20 source_x86_64=("senden-${pkgver}-x86_64.zip::https://senden-releases.objects.eplg.cloud/desktop/senden-electron-${pkgver}.zip")

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): Prebuilt binary Electron app downloaded from a non-standard object storage host (eplg.cloud) unrelated to the project's own domain (senden.chat); checksums are present which mitigates swap risk, but the release infrastructure is an unverifiable third-party cloud bucket rather than an official project domain or well-known forge.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: PandaDEV <contact@pandadev.net>
    
      2pkgname=senden-bin
    
      3pkgver=0.1.127
    
      4pkgrel=1
    
      5pkgdesc='Desktop client for Senden, the chat platform'
    
      6arch=('x86_64' 'aarch64')
    
      7url='https://senden.chat'
    
      8license=('LicenseRef-custom')
    
      9depends=('glibc' 'gcc-libs' 'glib2' 'gtk3' 'nss' 'nspr' 'alsa-lib' 'at-spi2-core' 'libcups'
    
      10         'dbus' 'cairo' 'pango' 'libx11' 'libxcomposite' 'libxdamage' 'libxext' 'libxfixes'
    
      11         'libxrandr' 'libxcb' 'libxkbcommon' 'libxtst' 'libxss' 'mesa' 'expat' 'systemd-libs'
    
      12         'libnotify' 'libsecret' 'xdg-utils' 'hicolor-icon-theme')
    
      13optdepends=('libpipewire: screen share audio capture'
    
      14            'libpulse: screen share audio capture'
    
      15            'libappindicator-gtk3: tray icon')
    
      16provides=("senden=${pkgver}")
    
      17conflicts=('senden')
    
      18options=('!strip' '!debug')
    
      19noextract=("senden-${pkgver}-x86_64.zip" "senden-${pkgver}-aarch64.zip")
    
      20source_x86_64=("senden-${pkgver}-x86_64.zip::https://senden-releases.objects.eplg.cloud/desktop/senden-electron-${pkgver}.zip")
    
      21source_aarch64=("senden-${pkgver}-aarch64.zip::https://senden-releases.objects.eplg.cloud/desktop/senden-electron-${pkgver}-arm64.zip")
    
      22sha256sums_x86_64=('4e133dc6174c6e21c7aec05fa56b08a095292138be1c5a1923a349fbec94a126')
    
      23sha256sums_aarch64=('3262e54dc85a0e54700c8ee9416b0e5ce5df2ce2393231e4b541dc9ab6c13103')
    
      24
    
      25package() {
    
      26    install -dm755 "${pkgdir}/opt/senden"
    
      27    bsdtar -xf "${srcdir}/senden-${pkgver}-${CARCH}.zip" -C "${pkgdir}/opt/senden"
    
      28    chmod 755 "${pkgdir}/opt/senden/senden-electron" "${pkgdir}/opt/senden/chrome-sandbox"
    
      29
    
      30    install -dm755 "${pkgdir}/usr/bin"
    
      31    ln -s /opt/senden/senden-electron "${pkgdir}/usr/bin/senden-electron"
    
      32    ln -s /opt/senden/senden-electron "${pkgdir}/usr/bin/senden"
    
      33
    
      34    install -Dm644 /dev/stdin "${pkgdir}/usr/share/applications/senden-electron.desktop" <<DESKTOP
    
      35[Desktop Entry]
    
      36Name=Senden
    
      37Exec=/usr/bin/senden-electron %U
    
      38Terminal=false
    
      39Type=Application
    
      40Icon=senden-electron
    
      41StartupWMClass=Senden
    
      42Categories=Network;
    
      43DESKTOP
    
      44
    
      45    install -Dm644 "${pkgdir}/opt/senden/resources/icon.png" \
    
      46        "${pkgdir}/usr/share/icons/hicolor/512x512/apps/senden-electron.png"
    
      47
    
      48    install -dm755 "${pkgdir}/usr/share/licenses/${pkgname}"
    
      49    mv "${pkgdir}/opt/senden/LICENSE.electron.txt" "${pkgdir}/opt/senden/LICENSES.chromium.html" \
    
      50        "${pkgdir}/usr/share/licenses/${pkgname}/"
    
      51}
    
      52

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-28 01:51:06	Medium	3
2026-10-28 01:49:03	Medium	3