signal-desktop-system-electron

maintainer CodingThunder · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The pnpm install runs on project-owned source from GitHub, building the official Signal Desktop app; the undeclared package install is part of the project's build process, not an external malicious injection.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The pnpm install runs on project-owned source from GitHub, building the official Signal Desktop app; the undeclared package install is part of the project's build process, not an external malicious injection.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM npm/yarn/pnpm install of an undeclared external package npm_install_external

Runs `npm/yarn/pnpm install <package>` for a package not in source=(), pulling unpinned, unreviewed code at build time. Severity downgraded: the package declares/looks like a Node.js consumer, where build-time installs are expected.

PKGBUILD:66 pnpm install --dir sticker-creator

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Yaksh Bariya <yakshbari4@gmail.com>
    
      2
    
      3pkgname=signal-desktop-system-electron
    
      4conflicts=('signal-desktop')
    
      5provides=('signal-desktop')
    
      6_parent_pkgname=signal-desktop
    
      7_pkgname=Signal-Desktop
    
      8pkgver=8.18.0
    
      9pkgrel=2
    
      10pkgdesc="Signal Private Messenger for Linux (uses system Electron)"
    
      11license=('AGPL-3.0-only')
    
      12arch=('x86_64')
    
      13url="https://signal.org"
    
      14depends=(
    
      15  'electron'
    
      16  'glibc'
    
      17  'gtk3'
    
      18  'hicolor-icon-theme'
    
      19  'libcups'
    
      20  'libdrm'
    
      21  'libgcc'
    
      22  'libnotify'
    
      23  'libpulse'
    
      24  'libx11'
    
      25  'libxcb'
    
      26  'libxcomposite'
    
      27  'libxdamage'
    
      28  'libxext'
    
      29  'libxfixes'
    
      30  'libxrandr'
    
      31  'mesa'
    
      32  'nspr'
    
      33  'nss'
    
      34)
    
      35makedepends=(
    
      36  'git'
    
      37  'git-lfs'
    
      38  'libxcrypt-compat'
    
      39  'node-gyp'
    
      40  'nodejs'
    
      41  'npm'
    
      42  'pnpm'
    
      43  'python'
    
      44)
    
      45optdepends=('xdg-desktop-portal: Screensharing with Wayland')
    
      46source=(
    
      47  "${pkgname}-${pkgver}.tar.gz::https://github.com/signalapp/${_pkgname}/archive/v${pkgver}.tar.gz"
    
      48  "${_parent_pkgname}.desktop"
    
      49)
    
      50sha256sums=('61a93b2b5b74e696de74efe59d408b9ab8c026a826321379ce96a9b68172bc72'
    
      51            'bf388df4b5bbcab5559ebbf220ed4748ed21b057f24b5ff46684e3fe6e88ccce')
    
      52b2sums=('adc87a1a3eee518446fba366362855c4bd7ba414162dfbade8c388ad7e367c807698fee10348db84cf72e02c1f4bd88b19e9bd276b0916b5d73b2ce9d614c35e'
    
      53        'ffb8f7bab4fd84aacf13e7b6d2835daf449b6650b4b3fa723456792ba7fb6cae352928fea11cb030510d558ce30036ff5a1513444f067b94c7fff0158b4f2265')
    
      54
    
      55prepare() {
    
      56  cd "${_pkgname}-${pkgver}"
    
      57
    
      58  # git-lfs hook needs to be installed for one of the dependencies
    
      59  export GIT_CONFIG_GLOBAL="$HOME/.gitconfig"
    
      60  git lfs install
    
      61
    
      62  # Allow higher Node versions
    
      63  sed 's#"node": "#&>=#' -i package.json
    
      64
    
      65  # Install dependencies for sticker-creator
    
      66  pnpm install --dir sticker-creator
    
      67
    
      68  # Configure electron-builder's Linux target for the current Arch architecture.
    
      69  case "${CARCH}" in
    
      70    "aarch64") electron_arch="arm64" ;;
    
      71    *) electron_arch="x64" ;;
    
      72  esac
    
      73  node scripts/prepare_linux_build.mjs deb "${electron_arch}"
    
      74
    
      75  # Install dependencies for signal-desktop
    
      76  pnpm install --frozen-lockfile
    
      77}
    
      78
    
      79build() {
    
      80  cd "${_pkgname}-${pkgver}"
    
      81
    
      82  # Build the sticker creator
    
      83  pnpm --prefix ./sticker-creator/ run build
    
      84
    
      85  # Build signal-desktop
    
      86  pnpm run build
    
      87}
    
      88
    
      89package() {
    
      90  cd "${_pkgname}-${pkgver}"
    
      91
    
      92  install -d "${pkgdir}/usr/"{lib,bin}
    
      93  cp -a release/linux-unpacked/resources/ "${pkgdir}/usr/lib/${_parent_pkgname}"
    
      94  cat << EOF > "${pkgdir}/usr/bin/${_parent_pkgname}"
    
      95#!/bin/sh
    
      96NODE_ENV=production electron /usr/lib/${_parent_pkgname}/app.asar "\$@"
    
      97EOF
    
      98
    
      99  chmod +x "${pkgdir}/usr/bin/${_parent_pkgname}"
    
      100
    
      101  install -Dm 644 "../${_parent_pkgname}.desktop" -t "${pkgdir}/usr/share/applications"
    
      102  for i in 16 24 32 48 64 128 256 512 1024; do
    
      103    install -Dm 644 "build/icons/png/${i}x${i}.png" \
    
      104      "${pkgdir}/usr/share/icons/hicolor/${i}x${i}/apps/${_parent_pkgname}.png"
    
      105  done
    
      106}
    
      107
    
      108# vim: ts=2 sw=2 et:
    
      109

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2