spawn-desktop

MEDIUM

maintainer quest 0 votes scanned 2026-10-20 00:10:31.152894

View on AUR

Why flagged

Installs a prebuilt proprietary binary extracted from a .deb downloaded from 'spawnfile.io', a non-official-looking host unrelated to the project's main domain (spawn.co), making it unverifiable and potentially swappable; however a sha512 checksum is provided, partially mitigating the risk.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:21 source=("$pkgname-$pkgver.deb::https://spawnfile.io/desktop/releases/Spawn-$pkgver.deb")

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): Installs a prebuilt proprietary binary extracted from a .deb downloaded from 'spawnfile.io', a non-official-looking host unrelated to the project's main domain (spawn.co), making it unverifiable and potentially swappable; however a sha512 checksum is provided, partially mitigating the risk.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: quest
    
      2pkgname=spawn-desktop
    
      3pkgver=0.7.40
    
      4pkgrel=1
    
      5pkgdesc="Spawn desktop app with Discord Rich Presence"
    
      6arch=('x86_64')
    
      7url="https://www.spawn.co/"
    
      8license=('LicenseRef-proprietary')
    
      9depends=('at-spi2-core'
    
      10         'gtk3'
    
      11         'hicolor-icon-theme'
    
      12         'libnotify'
    
      13         'libsecret'
    
      14         'libxss'
    
      15         'libxtst'
    
      16         'nss'
    
      17         'util-linux-libs'
    
      18         'xdg-utils')
    
      19optdepends=('libappindicator-gtk3: tray icon support')
    
      20options=('!strip' '!debug')
    
      21source=("$pkgname-$pkgver.deb::https://spawnfile.io/desktop/releases/Spawn-$pkgver.deb")
    
      22sha512sums=('ea5ce31953c225cafec183810edc088e0f1d6f81d02d6126ba930f10406b6b36f16914c5100721eb4cd14c0a7eb8211bdd67a0fe23abd86cfe01331af576affc')
    
      23
    
      24package() {
    
      25    bsdtar -xOf "$pkgname-$pkgver.deb" data.tar.xz | bsdtar -xf - -C "$pkgdir"
    
      26
    
      27    # Debian packaging cruft
    
      28    rm -r "$pkgdir/usr/share/doc"
    
      29
    
      30    install -d "$pkgdir/usr/bin"
    
      31    ln -s /opt/Spawn/spawn-desktop "$pkgdir/usr/bin/spawn-desktop"
    
      32
    
      33    # SUID sandbox fallback for kernels without unprivileged user
    
      34    # namespaces (e.g. linux-hardened); matches Arch's chromium package.
    
      35    chmod 4755 "$pkgdir/opt/Spawn/chrome-sandbox"
    
      36}
    
      37

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-20 00:10:31	Medium	3
2026-10-19 23:28:38	Medium	3
2026-10-19 23:26:39	Medium	3