tenzen-studio-bin

MEDIUM

maintainer Felitendo 0 votes scanned 2026-09-19 19:33:49.767713

View on AUR

Why flagged

Installs a prebuilt proprietary Electron/Flatpak binary from downloads.tenzen.studio, a project-owned but non-whitelisted host with few votes and a recently uploaded package; the binary runs as a native executable and cannot be independently verified beyond the provided SHA256 checksum, making it a supply-chain risk if the host were compromised or swapped.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:20 source=("${_bundle}::https://downloads.tenzen.studio/desktop/stable/linux/${pkgver}/${_bundle}")

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): Installs a prebuilt proprietary Electron/Flatpak binary from downloads.tenzen.studio, a project-owned but non-whitelisted host with few votes and a recently uploaded package; the binary runs as a native executable and cannot be independently verified beyond the provided SHA256 checksum, making it a supply-chain risk if the host were compromised or swapped.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Felitendo
    
      2# This PKGBUILD is updated automatically:
    
      3# https://github.com/Felitendo/PKGBUILDS
    
      4
    
      5pkgname=tenzen-studio-bin
    
      6_pkgname=tenzen
    
      7pkgver=0.1.26
    
      8pkgrel=1
    
      9pkgdesc="Record and edit product demos: cut pauses, add zooms and captions (upstream Flatpak bundle)"
    
      10arch=('x86_64')
    
      11url="https://tenzen.studio"
    
      12license=('LicenseRef-proprietary')
    
      13depends=('gtk3' 'nss' 'alsa-lib' 'ffmpeg' 'python-xlib')
    
      14optdepends=('libpulse: record system audio')
    
      15makedepends=('ostree' 'asar')
    
      16provides=('tenzen-studio')
    
      17conflicts=('tenzen-studio')
    
      18options=('!strip' '!debug')
    
      19_bundle="Tenzen-${pkgver}-linux-x64.flatpak"
    
      20source=("${_bundle}::https://downloads.tenzen.studio/desktop/stable/linux/${pkgver}/${_bundle}")
    
      21noextract=("${_bundle}")
    
      22sha256sums=('172496d25807dc54bf0313594f198834ba4fa3df0c29ee5265b13f2fca07c093')
    
      23
    
      24prepare() {
    
      25  # A Flatpak bundle is an OSTree static delta carrying a single commit:
    
      26  # apply it to a throwaway repository and check that commit out.
    
      27  rm -rf repo flatpak
    
      28  ostree init --repo=repo --mode=bare-user-only
    
      29  ostree static-delta apply-offline --repo=repo "${_bundle}"
    
      30
    
      31  local _commit
    
      32  _commit="$(find repo/objects -name '*.commit')"
    
      33  _commit="$(basename "$(dirname "${_commit}")")$(basename "${_commit}" .commit)"
    
      34  ostree checkout --repo=repo --user-mode "${_commit}" flatpak
    
      35
    
      36  # the bundle exports no icon - the app's own is only inside app.asar
    
      37  asar extract-file flatpak/files/lib/com.tenzen.desktop/resources/app.asar \
    
      38    dist/assets/brand/icon.png
    
      39}
    
      40
    
      41package() {
    
      42  install -d "${pkgdir}/opt/${pkgname}"
    
      43  cp -a "${srcdir}/flatpak/files/lib/com.tenzen.desktop/." "${pkgdir}/opt/${pkgname}/"
    
      44
    
      45  install -d "${pkgdir}/usr/bin"
    
      46  ln -s "/opt/${pkgname}/${_pkgname}" "${pkgdir}/usr/bin/${_pkgname}"
    
      47
    
      48  # named after the app's desktopName, so windows are matched to the entry
    
      49  install -Dm644 "${srcdir}/flatpak/files/share/applications/com.tenzen.desktop.desktop" \
    
      50    "${pkgdir}/usr/share/applications/${_pkgname}.desktop"
    
      51  sed -i \
    
      52    -e "s|^Exec=.*|Exec=${_pkgname} %U|" \
    
      53    -e "s|^Icon=.*|Icon=${_pkgname}|" \
    
      54    "${pkgdir}/usr/share/applications/${_pkgname}.desktop"
    
      55
    
      56  # 1024x1024, which the hicolor theme has no directory for
    
      57  install -Dm644 "${srcdir}/icon.png" "${pkgdir}/usr/share/pixmaps/${_pkgname}.png"
    
      58}
    
      59

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-19 19:33:49	Medium	3
2026-09-19 19:30:45	Medium	2