todoist-wrapper-bin
MEDIUM
maintainer zxp19821005
1 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The package downloads a prebuilt RPM from a GitHub release, which is an unverifiable executable artifact; if the source were swapped, it could lead to arbitrary code execution, though the host (github.com) is generally trusted.
Triggered rules
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:23
"${pkgname%-bin}.svg::https://simpleicons.org/icons/todoist.svg"
Medium
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 85%): The package downloads a prebuilt RPM from a GitHub release, which is an unverifiable executable artifact; if the source were swapped, it could lead to arbitrary code execution, though the host (github.com) is generally trusted.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2
pkgname=todoist-wrapper-bin
3
_pkgname=Todoist
4
pkgver=4.20261028045900
5
_electronversion=41
6
pkgrel=1
7
pkgdesc="A lightweight Electron wrapper for Todoist that provides a native desktop experience on Linux with full Wayland support."
8
arch=('x86_64')
9
url="https://github.com/conjfrnk/todoist-wrapper"
10
license=('GPL-3.0-only')
11
provides=("${pkgname%-bin}=${pkgver}")
12
conflicts=("${pkgname%-bin}")
13
depends=(
14
"electron${_electronversion}"
15
'nodejs'
16
)
17
options=(
18
'!emptydirs'
19
'!strip'
20
)
21
source=(
22
"${pkgname%-bin}-${pkgver}.rpm::${url}/releases/download/v${pkgver}/${pkgname%-bin}-${pkgver}-1.${CARCH}.rpm"
23
"${pkgname%-bin}.svg::https://simpleicons.org/icons/todoist.svg"
24
"LICENSE-${pkgver}::https://raw.githubusercontent.com/conjfrnk/todoist-wrapper/v${pkgver}/LICENSE"
25
"${pkgname%-bin}.js"
26
"${pkgname%-bin}.sh"
27
)
28
sha256sums=('c918d2518935189e897c83aa44f1fed682d7d5ae0fefb6469851104352866ebc'
29
'112b8e04327007cf75839bee7547718f334908c27700f9d5f5211062258510fe'
30
'3972dc9744f6499f0f9b2dbf76696f2ae7ad8af9b23dde66d6af86c9dfb36986'
31
'562897be8a17076176f8d985c0d7bc1c685f2e7c9b3a932339ce015963243627'
32
'0f4675ddc96a032accf82723c7b6b66007bafd18aa8d919b61e983a68fd25328')
33
_get_app_dir() {
34
find "${srcdir}" -type f -name "resources.pak" ! -path "*/node_modules/*" -printf '%h\n' 2>/dev/null \
35
| while read -r d; do [[ -d "${d}/resources" ]] && { echo "$d"; return 0; }; done
36
}
37
_check_electron_version() {
38
local _v=$(strings "$(find "$(_get_app_dir)" -maxdepth 1 -type f \
39
-executable -printf '%s %p\n' | sort -nr | head -1 | cut -d' ' -f2-)" \
40
| grep -oP 'Electron/\K[0-9]+' | head -1)
41
[[ -z "$_v" ]] && { echo -e "\033[1;33mNote: Could not check version.\033[0m"; return; }
42
(( _v == _electronversion )) && c=32 || c=31
43
echo -e "Electron version: \033[1;${c}m$_v$([[ $c -eq 31 ]] && echo " (expected $_electronversion)")\033[0m"
44
}
45
prepare() {
46
sed -i -e "
47
s/@electronversion@/${_electronversion}/g
48
s/@appname@/${pkgname%-bin}/g
49
" "${srcdir}/${pkgname%-bin}.sh" "${srcdir}/${pkgname%-bin}.js"
50
_check_electron_version
51
find "$(_get_app_dir)/resources/app/node_modules" -type f \( -name "*darwin*" -o -name "*arm64*" \) -exec rm -rf {} +
52
}
53
package() {
54
install -Dm755 "${srcdir}/${pkgname%-bin}.sh" "${pkgdir}/usr/bin/${pkgname%-bin}"
55
install -Dm644 "${srcdir}/${pkgname%-bin}.js" -t "${pkgdir}/usr/lib/${pkgname%-bin}"
56
cp -a "$(_get_app_dir)/resources/." "${pkgdir}/usr/lib/${pkgname%-bin}/"
57
install -Dm644 "${srcdir}/${pkgname%-bin}.svg" -t "${pkgdir}/usr/share/icons/hicolor/scalable/apps/"
58
install -Dm644 "${srcdir}/LICENSE-${pkgver}" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
59
install -Dm644 "${srcdir}/usr/share/applications/${pkgname%-bin}.desktop" -t "${pkgdir}/usr/share/applications"
60
}
61
Changes since previous scan
--- PKGBUILD @ 2026-10-29 00:13+++ PKGBUILD @ 2026-11-01 00:21@@ -1,7 +1,7 @@ # Maintainer: zxp19821005 <zxp19821005 at 163 dot com> pkgname=todoist-wrapper-bin _pkgname=Todoist-pkgver=4.20261026040823+pkgver=4.20261028045900 _electronversion=41 pkgrel=1 pkgdesc="A lightweight Electron wrapper for Todoist that provides a native desktop experience on Linux with full Wayland support."@@ -25,7 +25,7 @@ "${pkgname%-bin}.js" "${pkgname%-bin}.sh" )-sha256sums=('1f73a535fc184d2d45593dd04f5e54b672e167c67120d45bb5fc6835b8f72660'+sha256sums=('c918d2518935189e897c83aa44f1fed682d7d5ae0fefb6469851104352866ebc' '112b8e04327007cf75839bee7547718f334908c27700f9d5f5211062258510fe' '3972dc9744f6499f0f9b2dbf76696f2ae7ad8af9b23dde66d6af86c9dfb36986' '562897be8a17076176f8d985c0d7bc1c685f2e7c9b3a932339ce015963243627'Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Medium | 2 |
| 2026-10-31 00:07:41 | Medium | 2 |
| 2026-10-30 05:55:14 | Medium | 2 |
| 2026-10-30 00:29:30 | Medium | 2 |
| 2026-10-29 05:51:59 | Medium | 2 |
| 2026-10-29 00:13:55 | Medium | 2 |
| 2026-10-28 00:06:54 | Medium | 2 |
| 2026-10-27 00:23:28 | Medium | 2 |
| 2026-10-26 23:46:04 | Medium | 2 |
| 2026-10-26 00:12:40 | Medium | 2 |
| 2026-10-25 00:20:48 | Medium | 2 |
| 2026-10-24 00:14:55 | Medium | 2 |
| 2026-10-23 00:02:19 | Medium | 2 |
| 2026-10-22 03:33:54 | Medium | 2 |
| 2026-10-22 00:13:10 | Medium | 2 |
| 2026-10-21 00:12:50 | Medium | 2 |
| 2026-10-20 00:10:31 | Medium | 2 |
| 2026-10-19 07:24:05 | Medium | 2 |
| 2026-10-19 00:03:55 | Medium | 2 |
| 2026-10-18 00:06:55 | Medium | 2 |