tenzen-studio-bin

LOW

maintainer Felitendo 0 votes scanned 2026-11-04 00:25:23.536954

View on AUR

Why flagged

The package downloads a Flatpak bundle from the project's official domain and extracts it; this is a standard build process for a binary application, and the source, while on a non-whitelisted host, is plausibly official and not executing unreviewed remote code.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a Flatpak bundle from the project's official domain and extracts it; this is a standard build process for a binary application, and the source, while on a non-whitelisted host, is plausibly official and not executing unreviewed remote code.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:20 source=("${_bundle}::https://downloads.tenzen.studio/desktop/stable/linux/${pkgver}/${_bundle}")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Felitendo
    
      2# This PKGBUILD is updated automatically:
    
      3# https://github.com/Felitendo/PKGBUILDS
    
      4
    
      5pkgname=tenzen-studio-bin
    
      6_pkgname=tenzen
    
      7pkgver=0.1.28
    
      8pkgrel=1
    
      9pkgdesc="Record and edit product demos: cut pauses, add zooms and captions (upstream Flatpak bundle)"
    
      10arch=('x86_64')
    
      11url="https://tenzen.studio"
    
      12license=('LicenseRef-proprietary')
    
      13depends=('gtk3' 'nss' 'alsa-lib' 'ffmpeg' 'python-xlib')
    
      14optdepends=('libpulse: record system audio')
    
      15makedepends=('ostree' 'asar')
    
      16provides=('tenzen-studio')
    
      17conflicts=('tenzen-studio')
    
      18options=('!strip' '!debug')
    
      19_bundle="Tenzen-${pkgver}-linux-x64.flatpak"
    
      20source=("${_bundle}::https://downloads.tenzen.studio/desktop/stable/linux/${pkgver}/${_bundle}")
    
      21noextract=("${_bundle}")
    
      22sha256sums=('e8dcf999ed417fabaa334e3ec9391f3127e301a1b9ade2e289e97ccacdeb572e')
    
      23
    
      24prepare() {
    
      25  # A Flatpak bundle is an OSTree static delta carrying a single commit:
    
      26  # apply it to a throwaway repository and check that commit out.
    
      27  rm -rf repo flatpak
    
      28  ostree init --repo=repo --mode=bare-user-only
    
      29  ostree static-delta apply-offline --repo=repo "${_bundle}"
    
      30
    
      31  local _commit
    
      32  _commit="$(find repo/objects -name '*.commit')"
    
      33  _commit="$(basename "$(dirname "${_commit}")")$(basename "${_commit}" .commit)"
    
      34  ostree checkout --repo=repo --user-mode "${_commit}" flatpak
    
      35
    
      36  # the bundle exports no icon - the app's own is only inside app.asar
    
      37  asar extract-file flatpak/files/lib/com.tenzen.desktop/resources/app.asar \
    
      38    dist/assets/brand/icon.png
    
      39}
    
      40
    
      41package() {
    
      42  install -d "${pkgdir}/opt/${pkgname}"
    
      43  cp -a "${srcdir}/flatpak/files/lib/com.tenzen.desktop/." "${pkgdir}/opt/${pkgname}/"
    
      44
    
      45  install -d "${pkgdir}/usr/bin"
    
      46  ln -s "/opt/${pkgname}/${_pkgname}" "${pkgdir}/usr/bin/${_pkgname}"
    
      47
    
      48  # named after the app's desktopName, so windows are matched to the entry
    
      49  install -Dm644 "${srcdir}/flatpak/files/share/applications/com.tenzen.desktop.desktop" \
    
      50    "${pkgdir}/usr/share/applications/${_pkgname}.desktop"
    
      51  sed -i \
    
      52    -e "s|^Exec=.*|Exec=${_pkgname} %U|" \
    
      53    -e "s|^Icon=.*|Icon=${_pkgname}|" \
    
      54    "${pkgdir}/usr/share/applications/${_pkgname}.desktop"
    
      55
    
      56  # 1024x1024, which the hicolor theme has no directory for
    
      57  install -Dm644 "${srcdir}/icon.png" "${pkgdir}/usr/share/pixmaps/${_pkgname}.png"
    
      58
    
      59  # A custom licence has to ship its terms. Upstream publishes none as a file,
    
      60  # so what goes in is the reference to the terms it is used under, next to
    
      61  # the notices for everything bundled with it, which the app dir does carry.
    
      62  install -Dm644 /dev/stdin "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE" <<'EOF'
    
      63Tenzen Studio is proprietary software, distributed by Tenzen Studio.
    
      64
    
      65It is not covered by a free-software licence: use is governed by the terms
    
      66of service the vendor publishes, and redistribution of the build this
    
      67package installs is not granted by them.
    
      68
    
      69Terms of service: https://tenzen.studio/legal/terms-of-service/
    
      70EOF
    
      71
    
      72  ln -s "/opt/${pkgname}/resources/THIRD_PARTY_NOTICES.txt" \
    
      73    "${pkgdir}/usr/share/licenses/${pkgname}/THIRD_PARTY_NOTICES.txt"
    
      74  ln -s "/opt/${pkgname}/LICENSE.electron.txt" \
    
      75    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.electron.txt"
    
      76  ln -s "/opt/${pkgname}/LICENSES.chromium.html" \
    
      77    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSES.chromium.html"
    
      78}
    
      79

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-04 00:25:23	Low	2
2026-11-03 00:01:00	Low	2
2026-11-02 00:26:00	Low	2
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 00:13:55	Low	2
2026-10-28 00:06:54	Low	2
2026-10-27 00:23:28	Low	2
2026-10-26 00:12:40	Low	2
2026-10-25 00:20:48	Low	2
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 00:13:10	Low	2
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2