signal-desktop-beta-bin

MEDIUM

maintainer captn3m0 44 votes scanned 2026-08-20 09:10:51.385725

View on AUR

Why flagged

The package downloads a prebuilt binary from a non-standard host (updates.signal.org, not a common forge or official CDN), which is unverifiable and could be silently swapped, constituting a supply-chain risk.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source=("https://updates.signal.org/desktop/apt/pool/s/signal-desktop-beta/signal-desktop-beta_${_pkgver}_amd64.deb")

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt binary from a non-standard host (updates.signal.org, not a common forge or official CDN), which is unverifiable and could be silently swapped, constituting a supply-chain risk.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Nemo <archlinux at captnemo dot in>
    
      2# Co-maintainer: Eduard T <edu4rdshl>
    
      3pkgname=signal-desktop-beta-bin
    
      4pkgrel=1
    
      5pkgdesc="Private messaging from your desktop"
    
      6arch=('x86_64')
    
      7url='https://signal.org'
    
      8license=('GPL3')
    
      9depends=('libnotify' 'libxtst' 'nss' 'xdg-utils' 'libxss')
    
      10options=('!strip' '!emptydirs')
    
      11provides=('signal-desktop-beta')
    
      12conflicts=('signal-desktop-beta')
    
      13_pkgver=8.25.0-beta.1
    
      14pkgver=${_pkgver/-/}
    
      15source=("https://updates.signal.org/desktop/apt/pool/s/signal-desktop-beta/signal-desktop-beta_${_pkgver}_amd64.deb")
    
      16sha256sums=('9809148b3adfd468b98e4314ab0ab0cd244129cbaf23e3ca03cf11dd857153e4')
    
      17
    
      18package(){
    
      19  # Extract package data
    
      20  tar xf data.tar.xz -C "${pkgdir}"
    
      21
    
      22  # Link to the binary
    
      23  install -d "${pkgdir}/usr/bin"
    
      24  ln -sf '/opt/Signal Beta/signal-desktop-beta' "${pkgdir}/usr/bin/signal-desktop-beta"
    
      25}
    
      26

Changes since previous scan

--- PKGBUILD @ 2026-08-14 00:03
+++ PKGBUILD @ 2026-08-20 09:10
@@ -10,10 +10,10 @@
 options=('!strip' '!emptydirs')
 provides=('signal-desktop-beta')
 conflicts=('signal-desktop-beta')
-_pkgver=8.24.0-beta.1
+_pkgver=8.25.0-beta.1
 pkgver=${_pkgver/-/}
 source=("https://updates.signal.org/desktop/apt/pool/s/signal-desktop-beta/signal-desktop-beta_${_pkgver}_amd64.deb")
-sha256sums=('424ddd0a5bac54a380e7fed39ec05e65d4cae8a197499b7dc92d98c2a37d6705')
+sha256sums=('9809148b3adfd468b98e4314ab0ab0cd244129cbaf23e3ca03cf11dd857153e4')
 
 package(){
   # Extract package data

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-20 09:10:51	Medium	2
2026-08-14 00:03:41	Clean	2
2026-08-13 19:26:43	Medium	1
2026-08-13 00:17:07	Medium	2
2026-08-12 00:27:08	Medium	2
2026-08-11 15:21:23	Medium	2
2026-07-17 00:06:16	Clean	2
2026-07-16 07:51:00	Medium	1
2026-07-14 00:09:48	Clean	2
2026-07-13 05:40:50	Medium	1
2026-07-13 00:19:36	Low	2
2026-07-12 00:27:26	Low	2
2026-07-11 00:25:18	Low	2
2026-07-10 00:20:30	Low	2
2026-07-09 00:22:38	Low	2
2026-07-08 00:26:52	Low	2
2026-07-07 00:22:52	Low	2
2026-07-06 00:10:58	Low	2
2026-07-05 00:27:08	Low	2
2026-07-04 00:27:25	Low	2