tutanota-desktop-bin
LOW
maintainer yochananmarqos
72 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The package downloads an AppImage and signature from GitHub and app.tuta.com, which are plausible project hosts; the AppImage is verified using a separately downloaded public key, and the build process is transparent, posing no direct risk of remote code execution or data exfiltration.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads an AppImage and signature from GitHub and app.tuta.com, which are plausible project hosts; the AppImage is verified using a separately downloaded public key, and the build process is transparent, posing no direct risk of remote code execution or data exfiltration.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:19
"linux-sig-$pkgver.bin::https://app.tuta.com/desktop/linux-sig.bin"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Mark Wagie <mark dot wagie at proton dot me>
2
# Co-Maintainer: Aaron J. Graves <linux@ajgraves.com>
3
pkgname=tutanota-desktop-bin
4
pkgver=362.261023.2
5
pkgrel=1
6
pkgdesc="The desktop client for Tutanota, the secure e-mail service."
7
arch=('x86_64')
8
url="https://tuta.com/secure-email"
9
license=('GPL-3.0-or-later')
10
depends=(
11
'alsa-lib'
12
'gtk3'
13
'libsecret'
14
'nss'
15
)
16
makedepends=('openssl')
17
#source=("${pkgname%-bin}-$pkgver.AppImage::https://app.tuta.com/desktop/${pkgname%-bin}-linux.AppImage"
18
source=("${pkgname%-bin}-$pkgver.AppImage::https://github.com/tutao/tutanota/releases/download/${pkgname%-bin}-release-$pkgver/${pkgname%-bin}-linux.AppImage"
19
"linux-sig-$pkgver.bin::https://app.tuta.com/desktop/linux-sig.bin"
20
"tutao-pub-$pkgver.pem::https://github.com/tutao/tutanota/raw/${pkgname%-bin}-release-$pkgver/tutao-pub.pem")
21
provides=("${pkgname%-bin}")
22
conflicts=("${pkgname%-bin}" "${pkgname%-bin}-linux")
23
sha512sums=('3baf63c537e4eebd8cd29919bdaa7884e59003991dddbf31141c1c9773aee0fa73d79c6124d7f2c1ebfd0461a3b14b2ebd63b3d03bce1cc1fd671d0991773dcd'
24
'faf6bf8c672889606843b080b5557ddf9ae405085963838f5b828ab943a87428da17a6aea5ef8b95e438b37ea60b8aede52d6f48662092bbf7e9533b3393723c'
25
'7c6cf9f1074c08b4d38567ced95159c0809af025efe01b0163d9bb5107daabfa873064255186c071a7dc3a9177ccd0c1b2fcc8b085bdbff234965a6710b3ae45')
26
27
prepare() {
28
# Validate the signature against public key:
29
# https://tuta.com/support#verify-desktop
30
openssl dgst -sha512 -verify tutao-pub-${pkgver}.pem -signature \
31
linux-sig-${pkgver}.bin "${pkgname%-bin}-$pkgver.AppImage"
32
33
chmod +x "${pkgname%-bin}-$pkgver.AppImage"
34
./"${pkgname%-bin}-$pkgver.AppImage" --appimage-extract
35
36
# Correct path for desktop file, remove unneeded desktop file keys
37
desktop-file-edit --set-key=Exec --set-value="/opt/${pkgname%-bin}/${pkgname%-bin}" \
38
--remove-key="X-AppImage-Version" \
39
"squashfs-root/${pkgname%-bin}.desktop"
40
}
41
42
package() {
43
find squashfs-root/{locales,resources,usr/share/icons}/ -type d -exec chmod 755 {} +
44
45
install -d "$pkgdir/opt/${pkgname%-bin}/"
46
cp -av squashfs-root/* "$pkgdir/opt/${pkgname%-bin}/"
47
chmod 4755 "$pkgdir/opt/${pkgname%-bin}/chrome-sandbox"
48
rm -rf "$pkgdir/opt/${pkgname%-bin}/usr/"
49
rm "$pkgdir/opt/${pkgname%-bin}"/{"${pkgname%-bin}".desktop,AppRun}
50
51
# Fix permisssions
52
chmod 644 "$pkgdir/opt/${pkgname%-bin}"/resources/app{.asar,-update.yml}
53
54
install -d "$pkgdir/usr/bin"
55
ln -s "/opt/${pkgname%-bin}/${pkgname%-bin}" "$pkgdir/usr/bin/"
56
57
install -Dm644 "squashfs-root/${pkgname%-bin}.desktop" -t \
58
"$pkgdir/usr/share/applications/"
59
60
install -d "$pkgdir/usr/share/icons/"
61
cp -r squashfs-root/usr/share/icons/hicolor/ "$pkgdir/usr/share/icons/"
62
}
63
Changes since previous scan
--- PKGBUILD @ 2026-10-23 00:02+++ PKGBUILD @ 2026-11-01 00:21@@ -1,7 +1,7 @@ # Maintainer: Mark Wagie <mark dot wagie at proton dot me> # Co-Maintainer: Aaron J. Graves <linux@ajgraves.com> pkgname=tutanota-desktop-bin-pkgver=361.261006.0+pkgver=362.261023.2 pkgrel=1 pkgdesc="The desktop client for Tutanota, the secure e-mail service." arch=('x86_64')@@ -20,8 +20,8 @@ "tutao-pub-$pkgver.pem::https://github.com/tutao/tutanota/raw/${pkgname%-bin}-release-$pkgver/tutao-pub.pem") provides=("${pkgname%-bin}") conflicts=("${pkgname%-bin}" "${pkgname%-bin}-linux")-sha512sums=('84ee358cb477f8f6d4aa11d73c3d903160ea172726cac95e7e5ba3954102ba7a5b539d773dbb01c34ca2e1949bd2b7732925e55a521901fea4060f52a48f00e1'- 'c5f2f2848d211813be6cd1447da9f06f32ff5fe1e08d186762adc9297c3c4a2fd8fa82fc2b09a16c01a58ea7a8aff91a24a0982f63070ef4cbf77433b762cd89'+sha512sums=('3baf63c537e4eebd8cd29919bdaa7884e59003991dddbf31141c1c9773aee0fa73d79c6124d7f2c1ebfd0461a3b14b2ebd63b3d03bce1cc1fd671d0991773dcd'+ 'faf6bf8c672889606843b080b5557ddf9ae405085963838f5b828ab943a87428da17a6aea5ef8b95e438b37ea60b8aede52d6f48662092bbf7e9533b3393723c' '7c6cf9f1074c08b4d38567ced95159c0809af025efe01b0163d9bb5107daabfa873064255186c071a7dc3a9177ccd0c1b2fcc8b085bdbff234965a6710b3ae45') prepare() {Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Low | 2 |
| 2026-10-31 00:07:41 | Low | 2 |
| 2026-10-30 00:29:30 | Low | 2 |
| 2026-10-29 00:13:55 | Low | 2 |
| 2026-10-28 00:06:54 | Low | 2 |
| 2026-10-27 00:23:28 | Low | 2 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 19:38:15 | Medium | 1 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 23:33:14 | Medium | 1 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |
| 2026-10-15 00:28:05 | Low | 2 |