tutanota-desktop-bin

LOW

maintainer yochananmarqos 71 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads a prebuilt AppImage and signature from GitHub and the project's own domain, which are standard and trusted sources for Tutanota; the binary is verified using a public key before installation, reducing supply-chain risk.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt AppImage and signature from GitHub and the project's own domain, which are standard and trusted sources for Tutanota; the binary is verified using a public key before installation, reducing supply-chain risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:19 "linux-sig-$pkgver.bin::https://app.tuta.com/desktop/linux-sig.bin"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Mark Wagie <mark dot wagie at proton dot me>
    
      2# Co-Maintainer: Aaron J. Graves <linux@ajgraves.com>
    
      3pkgname=tutanota-desktop-bin
    
      4pkgver=357.260901.0
    
      5pkgrel=1
    
      6pkgdesc="The desktop client for Tutanota, the secure e-mail service."
    
      7arch=('x86_64')
    
      8url="https://tuta.com/secure-email"
    
      9license=('GPL-3.0-or-later')
    
      10depends=(
    
      11  'alsa-lib'
    
      12  'gtk3'
    
      13  'libsecret'
    
      14  'nss'
    
      15)
    
      16makedepends=('openssl')
    
      17#source=("${pkgname%-bin}-$pkgver.AppImage::https://app.tuta.com/desktop/${pkgname%-bin}-linux.AppImage"
    
      18source=("${pkgname%-bin}-$pkgver.AppImage::https://github.com/tutao/tutanota/releases/download/${pkgname%-bin}-release-$pkgver/${pkgname%-bin}-linux.AppImage"
    
      19        "linux-sig-$pkgver.bin::https://app.tuta.com/desktop/linux-sig.bin"
    
      20        "tutao-pub-$pkgver.pem::https://github.com/tutao/tutanota/raw/${pkgname%-bin}-release-$pkgver/tutao-pub.pem")
    
      21provides=("${pkgname%-bin}")
    
      22conflicts=("${pkgname%-bin}" "${pkgname%-bin}-linux")
    
      23sha512sums=('3caca7f0270fe51a81c8560daece4bf09cf5c2488da71c1b154e2b8fcfa03647ebbf014c7ef6f4c15f33880103f1e6267aeed951ad73eb68b854fac09b484d8f'
    
      24            '93d47d1bdf4eb833556e56e28cf9a13864a411fb6fe011c989e5a10a918c34c6733198dbe6b3b64ed54bd7889195f1a08062d9bb2b93a199383a9cd316d064f6'
    
      25            '7c6cf9f1074c08b4d38567ced95159c0809af025efe01b0163d9bb5107daabfa873064255186c071a7dc3a9177ccd0c1b2fcc8b085bdbff234965a6710b3ae45')
    
      26
    
      27prepare() {
    
      28  # Validate the signature against public key:
    
      29  # https://tuta.com/support#verify-desktop
    
      30  openssl dgst -sha512 -verify tutao-pub-${pkgver}.pem -signature \
    
      31    linux-sig-${pkgver}.bin "${pkgname%-bin}-$pkgver.AppImage"
    
      32
    
      33  chmod +x "${pkgname%-bin}-$pkgver.AppImage"
    
      34  ./"${pkgname%-bin}-$pkgver.AppImage" --appimage-extract
    
      35
    
      36  # Correct path for desktop file, remove unneeded desktop file keys
    
      37  desktop-file-edit --set-key=Exec --set-value="/opt/${pkgname%-bin}/${pkgname%-bin}" \
    
      38    --remove-key="X-AppImage-Version" \
    
      39    "squashfs-root/${pkgname%-bin}.desktop"
    
      40}
    
      41
    
      42package() {
    
      43  find squashfs-root/{locales,resources,usr/share/icons}/ -type d -exec chmod 755 {} +
    
      44
    
      45  install -d "$pkgdir/opt/${pkgname%-bin}/"
    
      46  cp -av squashfs-root/* "$pkgdir/opt/${pkgname%-bin}/"
    
      47  chmod 4755 "$pkgdir/opt/${pkgname%-bin}/chrome-sandbox"
    
      48  rm -rf "$pkgdir/opt/${pkgname%-bin}/usr/"
    
      49  rm "$pkgdir/opt/${pkgname%-bin}"/{"${pkgname%-bin}".desktop,AppRun}
    
      50
    
      51  # Fix permisssions
    
      52  chmod 644 "$pkgdir/opt/${pkgname%-bin}"/resources/app{.asar,-update.yml}
    
      53
    
      54  install -d "$pkgdir/usr/bin"
    
      55  ln -s "/opt/${pkgname%-bin}/${pkgname%-bin}" "$pkgdir/usr/bin/"
    
      56
    
      57  install -Dm644 "squashfs-root/${pkgname%-bin}.desktop" -t \
    
      58    "$pkgdir/usr/share/applications/"
    
      59
    
      60  install -d "$pkgdir/usr/share/icons/"
    
      61  cp -r squashfs-root/usr/share/icons/hicolor/ "$pkgdir/usr/share/icons/"
    
      62}
    
      63

Changes since previous scan

--- PKGBUILD @ 2026-09-03 00:15
+++ PKGBUILD @ 2026-09-17 00:27
@@ -1,8 +1,8 @@
 # Maintainer: Mark Wagie <mark dot wagie at proton dot me>
 # Co-Maintainer: Aaron J. Graves <linux@ajgraves.com>
 pkgname=tutanota-desktop-bin
-pkgver=357.260812.1
-pkgrel=2
+pkgver=357.260901.0
+pkgrel=1
 pkgdesc="The desktop client for Tutanota, the secure e-mail service."
 arch=('x86_64')
 url="https://tuta.com/secure-email"
@@ -14,14 +14,14 @@
   'nss'
 )
 makedepends=('openssl')
-source=("${pkgname%-bin}-$pkgver.AppImage::https://app.tuta.com/desktop/${pkgname%-bin}-linux.AppImage"
-# source=("${pkgname%-bin}-$pkgver.AppImage::https://github.com/tutao/tutanota/releases/download/${pkgname%-bin}-release-$pkgver/${pkgname%-bin}-linux.AppImage"
+#source=("${pkgname%-bin}-$pkgver.AppImage::https://app.tuta.com/desktop/${pkgname%-bin}-linux.AppImage"
+source=("${pkgname%-bin}-$pkgver.AppImage::https://github.com/tutao/tutanota/releases/download/${pkgname%-bin}-release-$pkgver/${pkgname%-bin}-linux.AppImage"
         "linux-sig-$pkgver.bin::https://app.tuta.com/desktop/linux-sig.bin"
         "tutao-pub-$pkgver.pem::https://github.com/tutao/tutanota/raw/${pkgname%-bin}-release-$pkgver/tutao-pub.pem")
 provides=("${pkgname%-bin}")
 conflicts=("${pkgname%-bin}" "${pkgname%-bin}-linux")
-sha512sums=('dff996efe36ec785f84aaeec421172f814acb2feeee8e0ee415e91dd034def83e923cfa70db49d8f1e73702209f1269dfe6c99f0a834bf07bbb5f1d765252a84'
-            'ef0a187c115d32c846054f986c4dffd10b55349c1873ab55647d1eefa8e7e802c8fe0452175986080d1cecf9f5a5720bc2cf03d0647527b7ab8318228c2ed9b8'
+sha512sums=('3caca7f0270fe51a81c8560daece4bf09cf5c2488da71c1b154e2b8fcfa03647ebbf014c7ef6f4c15f33880103f1e6267aeed951ad73eb68b854fac09b484d8f'
+            '93d47d1bdf4eb833556e56e28cf9a13864a411fb6fe011c989e5a10a918c34c6733198dbe6b3b64ed54bd7889195f1a08062d9bb2b93a199383a9cd316d064f6'
             '7c6cf9f1074c08b4d38567ced95159c0809af025efe01b0163d9bb5107daabfa873064255186c071a7dc3a9177ccd0c1b2fcc8b085bdbff234965a6710b3ae45')
 
 prepare() {

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 19:18:21	Medium	1
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 15:53:41	Medium	1
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2