slack-desktop-wayland-jetm
LOW
maintainer jetm
0 votes
scanned 2026-08-21 17:18:51.182500
Why flagged
Downloads a prebuilt Slack .deb from downloads.slack-edge.com, which is Slack's own official CDN; the binary is vendor-supplied and the b2sum checksum is present, making this a normal repackaging of an official proprietary release rather than a supply-chain risk.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 85%): Downloads a prebuilt Slack .deb from downloads.slack-edge.com, which is Slack's own official CDN; the binary is vendor-supplied and the b2sum checksum is present, making this a normal repackaging of an official proprietary release rather than a supply-chain risk.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:46
source=("https://downloads.slack-edge.com/desktop-releases/linux/x64/${pkgver}/${_debname}-${pkgver}-amd64.deb")
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Javier Tia <floss@jetm.me>
2
# Contributor: Chris Speck <chris.speck(at)annalise(dot)ai>
3
# Contributor: "Amhairghin" Oscar Garcia Amor (https://ogarcia.me)
4
5
# Fork of the AUR `slack-desktop-wayland`, which trails upstream by several
6
# releases. The -jetm suffix is what keeps this installable: `provides` and
7
# `conflicts` alone still let a `slack-desktop-wayland` upgrade take the slot.
8
pkgname=slack-desktop-wayland-jetm
9
_debname=slack-desktop
10
pkgver=4.51.191
11
pkgrel=1
12
pkgdesc='Slack Desktop (Beta) for Linux, launched as a native Wayland client'
13
arch=('x86_64')
14
url='https://slack.com/downloads'
15
license=('LicenseRef-Slack')
16
17
# Direct DT_NEEDED of the shipped binary, minus what gtk3 already pulls
18
# transitively (cairo, pango, glib2, at-spi2-core, mesa, libcups, dbus, expat,
19
# systemd-libs and the libX* stack). libsecret, libnotify and libpipewire carry
20
# no NEEDED entry - Electron dlopen()s all three, so they appear only as
21
# literal sonames inside the binary.
22
#
23
# xdg-desktop-portal is what separates this package from plain `slack-desktop`:
24
# under Wayland both the screen picker and the file chooser go through it.
25
depends=('alsa-lib' 'gtk3' 'libnotify' 'libpipewire' 'libsecret' 'nss'
26
'xdg-desktop-portal' 'xdg-utils')
27
optdepends=('libappindicator-gtk3: system tray icon'
28
'org.freedesktop.secrets: keyring password store'
29
'pipewire: PipeWire daemon, required for screen sharing'
30
'xdg-desktop-portal-gnome: portal backend for GNOME'
31
'xdg-desktop-portal-gtk: portal backend for GNOME and GTK'
32
'xdg-desktop-portal-hyprland: portal backend for Hyprland'
33
'xdg-desktop-portal-kde: portal backend for KDE'
34
'xdg-desktop-portal-lxqt: portal backend for LXQt'
35
'xdg-desktop-portal-wlr: portal backend for wlroots compositors')
36
37
provides=("slack-desktop=${pkgver}")
38
conflicts=('slack-desktop' 'slack-desktop-wayland' 'slack-electron')
39
replaces=('slack-desktop-wayland')
40
41
# Repackaging a prebuilt vendor binary: stripping Slack's bundled Electron and
42
# *.node modules can break them and buys nothing here. This also suppresses the
43
# debug package on its own - makepkg gates that on `debug` AND `strip`.
44
options=('!strip')
45
46
source=("https://downloads.slack-edge.com/desktop-releases/linux/x64/${pkgver}/${_debname}-${pkgver}-amd64.deb")
47
noextract=("${_debname}-${pkgver}-amd64.deb")
48
b2sums=('d06a3a0880f776ccf702481bd0009da0ec60d250811ded0c7cc654678b0bcfe97c2d8e75f9e2d54938ff1b4d04d741a7afb4f19714e885de06ed6dbb116d8dcf')
49
50
package() {
51
# Match data.tar.* rather than data.tar.xz: Debian tooling has been moving
52
# payloads to zstd, and a hardcoded suffix would turn that into an empty
53
# package rather than a build failure. makepkg does not set pipefail, so a
54
# failure in the first bsdtar is invisible here too - the native-module check
55
# below is what catches both.
56
bsdtar -O -xf "${srcdir}/${_debname}-${pkgver}-amd64.deb" 'data.tar.*' |
57
bsdtar -C "${pkgdir}" -xf -
58
59
# Refuse to ship a headless package. With the unpacked native modules
60
# missing, Slack starts, draws no window, registers no tray icon and logs
61
# nothing - a failure that only surfaces after install.
62
local _natmod="${pkgdir}/usr/lib/slack/resources/app.asar.unpacked/node_modules/@tinyspeck/slack-desktop-utils/lib/binding/napi-v8/slackdesktoputils.node"
63
if [[ ! -f $_natmod ]]; then
64
echo 'error: native modules missing under app.asar.unpacked after extraction' >&2
65
return 1
66
fi
67
68
# Rewrite the launcher in place instead of carrying a context diff, which
69
# breaks every time upstream reflows this file. The grep restores the
70
# fail-loud property a patch would have given, since sed exits 0 when it
71
# matches nothing.
72
#
73
# --ozone-platform=wayland is the entire reason this package exists. Slack's
74
# Electron build ships neither --ozone-platform-hint nor
75
# ELECTRON_OZONE_PLATFORM_HINT, so with no switch it lands on XWayland.
76
#
77
# Icon=slack rather than the absolute /usr/share/pixmaps path upstream ships,
78
# so an icon theme can override it.
79
local _desktop="${pkgdir}/usr/share/applications/slack.desktop"
80
local _exec='Exec=/usr/bin/slack --ozone-platform=wayland -s %U'
81
sed -i -e "s|^Exec=.*|${_exec}|" -e 's|^Icon=.*|Icon=slack|' "$_desktop"
82
if ! grep -qxF "$_exec" "$_desktop" || ! grep -qxF 'Icon=slack' "$_desktop"; then
83
echo 'error: slack.desktop rewrite did not apply' >&2
84
return 1
85
fi
86
87
# The deb ships some directories 0700.
88
find "${pkgdir}" -type d -exec chmod 755 {} +
89
90
# /etc holds an apt sources.list.d entry; src/ is Slack's own build tree.
91
rm -rf "${pkgdir}/etc" \
92
"${pkgdir}/usr/lib/slack/src" \
93
"${pkgdir}/usr/share/lintian" \
94
"${pkgdir}/usr/share/doc"
95
96
install -dm755 "${pkgdir}/usr/share/licenses/${pkgname}"
97
mv "${pkgdir}/usr/lib/slack/LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/"
98
ln -s "/usr/share/licenses/${pkgname}/LICENSE" "${pkgdir}/usr/lib/slack/LICENSE"
99
}
100
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-21 17:18:51 | Low | 3 |
| 2026-08-21 17:15:19 | Medium | 3 |