slack-desktop

LOW

maintainer ogarcia 640 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads a prebuilt .deb from Slack's official release domain (slack-edge.com), which is plausibly the project's own infrastructure; despite the static analyzer flag for a non-whitelisted host, this is a standard and expected source for Slack Desktop, and the rest of the PKGBUILD performs normal repackaging steps without executing remote code or introducing additional risks.

Triggered rules

Low AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is LOW (confidence 95%): The package downloads a prebuilt .deb from Slack's official release domain (slack-edge.com), which is plausibly the project's own infrastructure; despite the static analyzer flag for a non-whitelisted host, this is a standard and expected source for Slack Desktop, and the rest of the PKGBUILD performs normal repackaging steps without executing remote code or introducing additional risks.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source=("https://downloads.slack-edge.com/desktop-releases/linux/x64/${pkgver}/${pkgname}-${pkgver}-amd64.deb"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: "Amhairghin" Oscar Garcia Amor (https://ogarcia.me)
    
      2# Contributor: Simon Gomizelj <simongmzlj(at)gmail(dot)com>
    
      3# Contributor: Kyle Manna <kyle(at)kylemanna(dot)com>
    
      4
    
      5pkgname=slack-desktop
    
      6pkgver=4.51.191
    
      7pkgrel=1
    
      8pkgdesc="Slack Desktop (Beta) for Linux"
    
      9arch=('x86_64')
    
      10url="https://slack.com/downloads"
    
      11license=('custom')
    
      12depends=('gtk3' 'libsecret' 'libxss' 'nss' 'xdg-utils')
    
      13optdepends=('libappindicator-gtk3: Systray indicator support'
    
      14            'org.freedesktop.secrets: Keyring password store support')
    
      15options=('!debug')
    
      16source=("https://downloads.slack-edge.com/desktop-releases/linux/x64/${pkgver}/${pkgname}-${pkgver}-amd64.deb"
    
      17        "${pkgname}.patch")
    
      18noextract=("${pkgname}-${pkgver}-amd64.deb")
    
      19b2sums=('d06a3a0880f776ccf702481bd0009da0ec60d250811ded0c7cc654678b0bcfe97c2d8e75f9e2d54938ff1b4d04d741a7afb4f19714e885de06ed6dbb116d8dcf'
    
      20        '103447636acd7ac2789d7d89008483a2077d862a51a64427a66c51e64dc9eac588de187f13df2778ccb7b24110a36c259b33c0074ff69c9bab3f89283a1efaf1')
    
      21
    
      22package() {
    
      23    bsdtar -O -xf "slack-desktop-${pkgver}"*.deb data.tar.xz | bsdtar -C "${pkgdir}" -xJf -
    
      24
    
      25    # Fix hardcoded icon path in .desktop file
    
      26    patch -d "${pkgdir}" -p1 <"${pkgname}".patch
    
      27
    
      28    # Permission fix
    
      29    find "${pkgdir}" -type d -exec chmod 755 {} +
    
      30
    
      31    # Remove all unnecessary stuff
    
      32    rm -rf "${pkgdir}/etc"
    
      33    rm -rf "${pkgdir}/usr/lib/slack/src"
    
      34    rm -rf "${pkgdir}/usr/share/lintian"
    
      35    rm -rf "${pkgdir}/usr/share/doc"
    
      36
    
      37    # Move license
    
      38    install -dm755 "${pkgdir}/usr/share/licenses/${pkgname}"
    
      39    mv "${pkgdir}/usr/lib/slack/LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}"
    
      40    ln -s "/usr/share/licenses/${pkgname}/LICENSE" "${pkgdir}/usr/lib/slack/LICENSE"
    
      41}
    
      42

Changes since previous scan

--- PKGBUILD @ 2026-09-05 00:16
+++ PKGBUILD @ 2026-09-17 00:27
@@ -3,7 +3,7 @@
 # Contributor: Kyle Manna <kyle(at)kylemanna(dot)com>
 
 pkgname=slack-desktop
-pkgver=4.51.180
+pkgver=4.51.191
 pkgrel=1
 pkgdesc="Slack Desktop (Beta) for Linux"
 arch=('x86_64')
@@ -16,7 +16,7 @@
 source=("https://downloads.slack-edge.com/desktop-releases/linux/x64/${pkgver}/${pkgname}-${pkgver}-amd64.deb"
         "${pkgname}.patch")
 noextract=("${pkgname}-${pkgver}-amd64.deb")
-b2sums=('2393045a2f0171e283f16c66cc5c9e13acbc6b40d0a0b39305f04ee28232c85847a985aa762a9063adf5d85241b2d480af5c5f0fcda1bc9b2789d292578eb92d'
+b2sums=('d06a3a0880f776ccf702481bd0009da0ec60d250811ded0c7cc654678b0bcfe97c2d8e75f9e2d54938ff1b4d04d741a7afb4f19714e885de06ed6dbb116d8dcf'
         '103447636acd7ac2789d7d89008483a2077d862a51a64427a66c51e64dc9eac588de187f13df2778ccb7b24110a36c259b33c0074ff69c9bab3f89283a1efaf1')
 
 package() {

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 09:59:47	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2