todoist-wrapper-bin
MEDIUM
maintainer zxp19821005
1 votes
scanned 2026-09-17 03:24:22.735270
Why flagged
The package downloads a prebuilt RPM from a GitHub release, which is an unverifiable binary artifact; if the source were swapped, it could deliver malicious code, constituting a supply-chain risk.
Triggered rules
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:23
"${pkgname%-bin}.svg::https://simpleicons.org/icons/todoist.svg"
Medium
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 85%): The package downloads a prebuilt RPM from a GitHub release, which is an unverifiable binary artifact; if the source were swapped, it could deliver malicious code, constituting a supply-chain risk.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2
pkgname=todoist-wrapper-bin
3
_pkgname=Todoist
4
pkgver=4.20260910040207
5
_electronversion=41
6
pkgrel=1
7
pkgdesc="A lightweight Electron wrapper for Todoist that provides a native desktop experience on Linux with full Wayland support."
8
arch=('x86_64')
9
url="https://github.com/conjfrnk/todoist-wrapper"
10
license=('GPL-3.0-only')
11
provides=("${pkgname%-bin}=${pkgver}")
12
conflicts=("${pkgname%-bin}")
13
depends=(
14
"electron${_electronversion}"
15
'nodejs'
16
)
17
options=(
18
'!emptydirs'
19
'!strip'
20
)
21
source=(
22
"${pkgname%-bin}-${pkgver}.rpm::${url}/releases/download/v${pkgver}/${pkgname%-bin}-${pkgver}-1.${CARCH}.rpm"
23
"${pkgname%-bin}.svg::https://simpleicons.org/icons/todoist.svg"
24
"LICENSE-${pkgver}::https://raw.githubusercontent.com/conjfrnk/todoist-wrapper/v${pkgver}/LICENSE"
25
"${pkgname%-bin}.sh"
26
)
27
sha256sums=('8ed961923bc2dd58c36d7c81e066d7c7b1c0efdf5c92523626e178f8fb5d5068'
28
'112b8e04327007cf75839bee7547718f334908c27700f9d5f5211062258510fe'
29
'3972dc9744f6499f0f9b2dbf76696f2ae7ad8af9b23dde66d6af86c9dfb36986'
30
'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
31
_get_app_dir() {
32
find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1
33
}
34
_check_electron_version() {
35
echo "Verifying Electron version..."
36
local _main_exe=$(find "$(_get_app_dir)" -maxdepth 1 -type f -executable -printf '%s %p\n' | sort -nr | head -1 | cut -d' ' -f2-)
37
[[ -z "${_main_exe}" ]] && echo -e "\033[1;33mNote: Could not find Electron binary.\033[0m" && return
38
local _elec_ver=$(strings "${_main_exe}" | grep -oP 'Electron/\K[0-9]+' | head -1)
39
[[ -z "${_elec_ver}" ]] && echo -e "\033[1;33mNote: Could not determine Electron version.\033[0m" && return
40
[[ "${_elec_ver}" != "${_electronversion}" ]] &&
41
echo -e "\033[1;31mWarning: Electron version mismatch! Detected: ${_elec_ver}, Expected: ${_electronversion}\033[0m" ||
42
echo -e "Electron version verified: \033[1;31m${_elec_ver}\033[0m"
43
}
44
prepare() {
45
sed -i -e "
46
s/@electronversion@/${_electronversion}/g
47
s/@appname@/${pkgname%-bin}/g
48
s/@runname@/app/g
49
s/@cfgdirname@/${_pkgname}/g
50
" "${srcdir}/${pkgname%-bin}.sh"
51
_check_electron_version
52
local _app_dir=$(_get_app_dir)
53
find "${_app_dir}/resources/app/node_modules" -type f \( -name "*darwin*" -o -name "*arm64*" \) -exec rm -rf {} +
54
}
55
package() {
56
install -Dm755 "${srcdir}/${pkgname%-bin}.sh" "${pkgdir}/usr/bin/${pkgname%-bin}"
57
install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-bin}"
58
local _app_dir=$(_get_app_dir)
59
cp -a "${_app_dir}/resources/"* "${pkgdir}/usr/lib/${pkgname%-bin}/"
60
install -Dm644 "${srcdir}/${pkgname%-bin}.svg" -t "${pkgdir}/usr/share/icons/hicolor/scalable/apps/"
61
install -Dm644 "${srcdir}/LICENSE-${pkgver}" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
62
install -Dm644 "${srcdir}/usr/share/applications/${pkgname%-bin}.desktop" -t "${pkgdir}/usr/share/applications"
63
}
64
Changes since previous scan
--- PKGBUILD @ 2026-09-17 00:27+++ PKGBUILD @ 2026-09-17 03:24@@ -1,10 +1,10 @@ # Maintainer: zxp19821005 <zxp19821005 at 163 dot com> pkgname=todoist-wrapper-bin _pkgname=Todoist-pkgver=4.20260909040345+pkgver=4.20260910040207 _electronversion=41 pkgrel=1-pkgdesc="Electron Wrapper for Todoist on Linux.(Prebuilt version.Use system-wide electron)"+pkgdesc="A lightweight Electron wrapper for Todoist that provides a native desktop experience on Linux with full Wayland support." arch=('x86_64') url="https://github.com/conjfrnk/todoist-wrapper" license=('GPL-3.0-only')@@ -24,7 +24,7 @@ "LICENSE-${pkgver}::https://raw.githubusercontent.com/conjfrnk/todoist-wrapper/v${pkgver}/LICENSE" "${pkgname%-bin}.sh" )-sha256sums=('63b8251c1c3c3655191140e75c07fd83a6ee36e71297133454140f551b1576ef'+sha256sums=('8ed961923bc2dd58c36d7c81e066d7c7b1c0efdf5c92523626e178f8fb5d5068' '112b8e04327007cf75839bee7547718f334908c27700f9d5f5211062258510fe' '3972dc9744f6499f0f9b2dbf76696f2ae7ad8af9b23dde66d6af86c9dfb36986' 'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')@@ -61,3 +61,4 @@ install -Dm644 "${srcdir}/LICENSE-${pkgver}" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE" install -Dm644 "${srcdir}/usr/share/applications/${pkgname%-bin}.desktop" -t "${pkgdir}/usr/share/applications" }+Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 03:24:22 | Medium | 2 |
| 2026-09-17 00:27:14 | Medium | 2 |
| 2026-09-16 00:03:17 | Medium | 2 |
| 2026-09-15 00:25:31 | Medium | 2 |
| 2026-09-14 00:27:57 | Medium | 2 |
| 2026-09-13 00:19:54 | Medium | 2 |
| 2026-09-12 00:25:17 | Medium | 2 |
| 2026-09-11 00:19:22 | Medium | 2 |
| 2026-09-10 13:20:36 | Medium | 2 |
| 2026-09-10 03:20:13 | Medium | 2 |
| 2026-09-10 00:22:44 | Medium | 2 |
| 2026-09-09 00:04:09 | Medium | 2 |
| 2026-09-08 00:18:08 | Medium | 2 |
| 2026-09-07 05:13:32 | Medium | 2 |
| 2026-09-07 00:30:15 | Medium | 2 |
| 2026-09-06 00:17:06 | Medium | 2 |
| 2026-09-05 00:16:27 | Medium | 2 |
| 2026-09-04 00:03:13 | Medium | 2 |
| 2026-09-03 00:15:47 | Medium | 2 |
| 2026-09-02 01:49:31 | Medium | 2 |