todoist-wrapper-bin
maintainer zxp19821005
· 1 votes
· scanned 2026-08-03 00:08:14.047287
MEDIUM
View on AUR ↗
Why flagged
The package downloads a prebuilt RPM from a GitHub release and a logo from doist.com; while GitHub is generally trustworthy, the unverifiable prebuilt binary from an unofficial wrapper project poses a moderate supply-chain risk if the source were compromised.
Triggered rules
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:23
"${pkgname%-bin}-logo.zip::https://doist.com/brand-assets/todoist-logo.zip"
MEDIUM
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 85%): The package downloads a prebuilt RPM from a GitHub release and a logo from doist.com; while GitHub is generally trustworthy, the unverifiable prebuilt binary from an unofficial wrapper project poses a moderate supply-chain risk if the source were compromised.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2
pkgname=todoist-wrapper-bin
3
_pkgname=Todoist
4
pkgver=4.20260731032829
5
_electronversion=41
6
pkgrel=1
7
pkgdesc="Electron Wrapper for Todoist on Linux.(Prebuilt version.Use system-wide electron)"
8
arch=('x86_64')
9
url="https://github.com/conjfrnk/todoist-wrapper"
10
license=('GPL-3.0-only')
11
provides=("${pkgname%-bin}=${pkgver}")
12
conflicts=("${pkgname%-bin}")
13
depends=(
14
"electron${_electronversion}"
15
'nodejs'
16
)
17
options=(
18
'!emptydirs'
19
'!strip'
20
)
21
source=(
22
"${pkgname%-bin}-${pkgver}.rpm::${url}/releases/download/v${pkgver}/${pkgname%-bin}-${pkgver}-1.${CARCH}.rpm"
23
"${pkgname%-bin}-logo.zip::https://doist.com/brand-assets/todoist-logo.zip"
24
"LICENSE-${pkgver}::https://raw.githubusercontent.com/conjfrnk/todoist-wrapper/v${pkgver}/LICENSE"
25
"${pkgname%-bin}.sh"
26
)
27
sha256sums=('25b493007fbe39935d6180c2e4f23f27ae67cc86b40a5ebba6a489ed32370037'
28
'b0ac98d0108e481f0717413ec594ea09f654eede762d4b0425d0974d0b2bec6a'
29
'3972dc9744f6499f0f9b2dbf76696f2ae7ad8af9b23dde66d6af86c9dfb36986'
30
'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
31
_get_app_dir() {
32
find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1
33
}
34
_check_electron_version() {
35
echo "Verifying Electron version..."
36
local _main_exe=$(find "$(_get_app_dir)" -maxdepth 1 -type f -executable -printf '%s %p\n' | sort -nr | head -1 | cut -d' ' -f2-)
37
[[ -z "${_main_exe}" ]] && echo -e "\033[1;33mNote: Could not find Electron binary.\033[0m" && return
38
local _elec_ver=$(strings "${_main_exe}" | grep -oP 'Electron/\K[0-9]+' | head -1)
39
[[ -z "${_elec_ver}" ]] && echo -e "\033[1;33mNote: Could not determine Electron version.\033[0m" && return
40
[[ "${_elec_ver}" != "${_electronversion}" ]] &&
41
echo -e "\033[1;31mWarning: Electron version mismatch! Detected: ${_elec_ver}, Expected: ${_electronversion}\033[0m" ||
42
echo -e "Electron version verified: \033[1;31m${_elec_ver}\033[0m"
43
}
44
prepare() {
45
sed -i -e "
46
s/@electronversion@/${_electronversion}/g
47
s/@appname@/${pkgname%-bin}/g
48
s/@runname@/app/g
49
s/@cfgdirname@/${_pkgname}/g
50
" "${srcdir}/${pkgname%-bin}.sh"
51
_check_electron_version
52
local _app_dir=$(_get_app_dir)
53
find "${_app_dir}/resources/app/node_modules" -type f \( -name "*darwin*" -o -name "*arm64*" \) -exec rm -rf {} +
54
}
55
package() {
56
install -Dm755 "${srcdir}/${pkgname%-bin}.sh" "${pkgdir}/usr/bin/${pkgname%-bin}"
57
install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-bin}"
58
local _app_dir=$(_get_app_dir)
59
cp -a "${_app_dir}/resources/"* "${pkgdir}/usr/lib/${pkgname%-bin}/"
60
install -Dm644 "${srcdir}/Icon/Color.png" "${pkgdir}/usr/share/pixmaps/${pkgname%-bin}.png"
61
install -Dm644 "${srcdir}/LICENSE-${pkgver}" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
62
install -Dm644 "${srcdir}/usr/share/applications/${pkgname%-bin}.desktop" -t "${pkgdir}/usr/share/applications"
63
}
64
Changes since previous scan
--- PKGBUILD @ 2026-07-31 00:14+++ PKGBUILD @ 2026-08-03 00:08@@ -1,7 +1,7 @@ # Maintainer: zxp19821005 <zxp19821005 at 163 dot com> pkgname=todoist-wrapper-bin _pkgname=Todoist-pkgver=4.20260729031315+pkgver=4.20260731032829 _electronversion=41 pkgrel=1 pkgdesc="Electron Wrapper for Todoist on Linux.(Prebuilt version.Use system-wide electron)"@@ -24,7 +24,7 @@ "LICENSE-${pkgver}::https://raw.githubusercontent.com/conjfrnk/todoist-wrapper/v${pkgver}/LICENSE" "${pkgname%-bin}.sh" )-sha256sums=('2686642b16be64829765134df1d325b519c4696c30e89069ffa99a04ad833925'+sha256sums=('25b493007fbe39935d6180c2e4f23f27ae67cc86b40a5ebba6a489ed32370037' 'b0ac98d0108e481f0717413ec594ea09f654eede762d4b0425d0974d0b2bec6a' '3972dc9744f6499f0f9b2dbf76696f2ae7ad8af9b23dde66d6af86c9dfb36986' 'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | MEDIUM | 2 |
| 2026-08-02 00:16:08 | MEDIUM | 2 |
| 2026-08-01 00:11:18 | MEDIUM | 2 |
| 2026-07-31 11:17:50 | MEDIUM | 2 |
| 2026-07-31 00:14:10 | MEDIUM | 2 |
| 2026-07-30 00:17:23 | MEDIUM | 2 |
| 2026-07-29 11:11:22 | MEDIUM | 2 |
| 2026-07-29 00:25:53 | MEDIUM | 2 |
| 2026-07-28 00:07:28 | MEDIUM | 2 |
| 2026-07-27 11:35:00 | MEDIUM | 2 |
| 2026-07-27 03:34:02 | MEDIUM | 2 |
| 2026-07-27 00:24:32 | MEDIUM | 2 |
| 2026-07-26 00:07:32 | MEDIUM | 2 |
| 2026-07-25 00:13:44 | MEDIUM | 2 |
| 2026-07-24 00:02:28 | MEDIUM | 2 |
| 2026-07-23 00:14:47 | MEDIUM | 2 |
| 2026-07-22 11:20:06 | MEDIUM | 2 |
| 2026-07-22 00:29:32 | MEDIUM | 2 |
| 2026-07-21 11:16:59 | MEDIUM | 2 |
| 2026-07-21 03:15:42 | MEDIUM | 2 |