todoist-wrapper-bin

maintainer zxp19821005 · 1 votes · scanned 2026-08-03 00:08:14.047287
MEDIUM
View on AUR ↗
Why flagged The package downloads a prebuilt RPM from a GitHub release and a logo from doist.com; while GitHub is generally trustworthy, the unverifiable prebuilt binary from an unofficial wrapper project poses a moderate supply-chain risk if the source were compromised.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:23 "${pkgname%-bin}-logo.zip::https://doist.com/brand-assets/todoist-logo.zip"
MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 85%): The package downloads a prebuilt RPM from a GitHub release and a logo from doist.com; while GitHub is generally trustworthy, the unverifiable prebuilt binary from an unofficial wrapper project poses a moderate supply-chain risk if the source were compromised.

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2pkgname=todoist-wrapper-bin
3_pkgname=Todoist
4pkgver=4.20260731032829
5_electronversion=41
6pkgrel=1
7pkgdesc="Electron Wrapper for Todoist on Linux.(Prebuilt version.Use system-wide electron)"
8arch=('x86_64')
9url="https://github.com/conjfrnk/todoist-wrapper"
10license=('GPL-3.0-only')
11provides=("${pkgname%-bin}=${pkgver}")
12conflicts=("${pkgname%-bin}")
13depends=(
14 "electron${_electronversion}"
15 'nodejs'
16)
17options=(
18 '!emptydirs'
19 '!strip'
20)
21source=(
22 "${pkgname%-bin}-${pkgver}.rpm::${url}/releases/download/v${pkgver}/${pkgname%-bin}-${pkgver}-1.${CARCH}.rpm"
23 "${pkgname%-bin}-logo.zip::https://doist.com/brand-assets/todoist-logo.zip"
24 "LICENSE-${pkgver}::https://raw.githubusercontent.com/conjfrnk/todoist-wrapper/v${pkgver}/LICENSE"
25 "${pkgname%-bin}.sh"
26)
27sha256sums=('25b493007fbe39935d6180c2e4f23f27ae67cc86b40a5ebba6a489ed32370037'
28 'b0ac98d0108e481f0717413ec594ea09f654eede762d4b0425d0974d0b2bec6a'
29 '3972dc9744f6499f0f9b2dbf76696f2ae7ad8af9b23dde66d6af86c9dfb36986'
30 'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
31_get_app_dir() {
32 find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1
33}
34_check_electron_version() {
35 echo "Verifying Electron version..."
36 local _main_exe=$(find "$(_get_app_dir)" -maxdepth 1 -type f -executable -printf '%s %p\n' | sort -nr | head -1 | cut -d' ' -f2-)
37 [[ -z "${_main_exe}" ]] && echo -e "\033[1;33mNote: Could not find Electron binary.\033[0m" && return
38 local _elec_ver=$(strings "${_main_exe}" | grep -oP 'Electron/\K[0-9]+' | head -1)
39 [[ -z "${_elec_ver}" ]] && echo -e "\033[1;33mNote: Could not determine Electron version.\033[0m" && return
40 [[ "${_elec_ver}" != "${_electronversion}" ]] &&
41 echo -e "\033[1;31mWarning: Electron version mismatch! Detected: ${_elec_ver}, Expected: ${_electronversion}\033[0m" ||
42 echo -e "Electron version verified: \033[1;31m${_elec_ver}\033[0m"
43}
44prepare() {
45 sed -i -e "
46 s/@electronversion@/${_electronversion}/g
47 s/@appname@/${pkgname%-bin}/g
48 s/@runname@/app/g
49 s/@cfgdirname@/${_pkgname}/g
50 " "${srcdir}/${pkgname%-bin}.sh"
51 _check_electron_version
52 local _app_dir=$(_get_app_dir)
53 find "${_app_dir}/resources/app/node_modules" -type f \( -name "*darwin*" -o -name "*arm64*" \) -exec rm -rf {} +
54}
55package() {
56 install -Dm755 "${srcdir}/${pkgname%-bin}.sh" "${pkgdir}/usr/bin/${pkgname%-bin}"
57 install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-bin}"
58 local _app_dir=$(_get_app_dir)
59 cp -a "${_app_dir}/resources/"* "${pkgdir}/usr/lib/${pkgname%-bin}/"
60 install -Dm644 "${srcdir}/Icon/Color.png" "${pkgdir}/usr/share/pixmaps/${pkgname%-bin}.png"
61 install -Dm644 "${srcdir}/LICENSE-${pkgver}" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
62 install -Dm644 "${srcdir}/usr/share/applications/${pkgname%-bin}.desktop" -t "${pkgdir}/usr/share/applications"
63}
64

Changes since previous scan

--- PKGBUILD @ 2026-07-31 00:14
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,7 +1,7 @@
# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
pkgname=todoist-wrapper-bin
_pkgname=Todoist
-pkgver=4.20260729031315
+pkgver=4.20260731032829
_electronversion=41
pkgrel=1
pkgdesc="Electron Wrapper for Todoist on Linux.(Prebuilt version.Use system-wide electron)"
@@ -24,7 +24,7 @@
"LICENSE-${pkgver}::https://raw.githubusercontent.com/conjfrnk/todoist-wrapper/v${pkgver}/LICENSE"
"${pkgname%-bin}.sh"
)
-sha256sums=('2686642b16be64829765134df1d325b519c4696c30e89069ffa99a04ad833925'
+sha256sums=('25b493007fbe39935d6180c2e4f23f27ae67cc86b40a5ebba6a489ed32370037'
'b0ac98d0108e481f0717413ec594ea09f654eede762d4b0425d0974d0b2bec6a'
'3972dc9744f6499f0f9b2dbf76696f2ae7ad8af9b23dde66d6af86c9dfb36986'
'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')

Scan history

Scanned at (UTC)SeverityRules
2026-08-03 00:08:14 MEDIUM 2
2026-08-02 00:16:08 MEDIUM 2
2026-08-01 00:11:18 MEDIUM 2
2026-07-31 11:17:50 MEDIUM 2
2026-07-31 00:14:10 MEDIUM 2
2026-07-30 00:17:23 MEDIUM 2
2026-07-29 11:11:22 MEDIUM 2
2026-07-29 00:25:53 MEDIUM 2
2026-07-28 00:07:28 MEDIUM 2
2026-07-27 11:35:00 MEDIUM 2
2026-07-27 03:34:02 MEDIUM 2
2026-07-27 00:24:32 MEDIUM 2
2026-07-26 00:07:32 MEDIUM 2
2026-07-25 00:13:44 MEDIUM 2
2026-07-24 00:02:28 MEDIUM 2
2026-07-23 00:14:47 MEDIUM 2
2026-07-22 11:20:06 MEDIUM 2
2026-07-22 00:29:32 MEDIUM 2
2026-07-21 11:16:59 MEDIUM 2
2026-07-21 03:15:42 MEDIUM 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion