tutanota-desktop-bin
maintainer yochananmarqos
· 71 votes
· scanned 2026-08-03 00:08:14.047287
LOW
View on AUR ↗
Why flagged
The package downloads a prebuilt AppImage and signature from GitHub and the project's own domain, which are standard and trusted sources for Tutanota; the binary is verified using a public key before installation, reducing supply-chain risk.
Triggered rules
LOW
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt AppImage and signature from GitHub and the project's own domain, which are standard and trusted sources for Tutanota; the binary is verified using a public key before installation, reducing supply-chain risk.
1 higher static finding superseded - not the current verdict (shown for transparency)
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:19
"linux-sig-$pkgver.bin::https://app.tuta.com/desktop/linux-sig.bin"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Mark Wagie <mark dot wagie at proton dot me>
2
# Co-Maintainer: Aaron J. Graves <linux@ajgraves.com>
3
pkgname=tutanota-desktop-bin
4
pkgver=355.260720.0
5
pkgrel=1
6
pkgdesc="The desktop client for Tutanota, the secure e-mail service."
7
arch=('x86_64')
8
url="https://tuta.com/secure-email"
9
license=('GPL-3.0-or-later')
10
depends=(
11
'alsa-lib'
12
'gtk3'
13
'libsecret'
14
'nss'
15
)
16
makedepends=('openssl')
17
#source=("${pkgname%-bin}-$pkgver.AppImage::https://app.tuta.com/desktop/${pkgname%-bin}-linux.AppImage"
18
source=("${pkgname%-bin}-$pkgver.AppImage::https://github.com/tutao/tutanota/releases/download/${pkgname%-bin}-release-$pkgver/${pkgname%-bin}-linux.AppImage"
19
"linux-sig-$pkgver.bin::https://app.tuta.com/desktop/linux-sig.bin"
20
"tutao-pub-$pkgver.pem::https://github.com/tutao/tutanota/raw/${pkgname%-bin}-release-$pkgver/tutao-pub.pem")
21
provides=("${pkgname%-bin}")
22
conflicts=("${pkgname%-bin}" "${pkgname%-bin}-linux")
23
sha512sums=('6d4b127667bd3d9d5e6b14fe2965aedd301a2ed28e8047df856dfa896ebac5d8c751bb197ff4ce8f6d90f6e2f3f4c04d7a733328fedbc1015a0f1555f145ff26'
24
'3ddf8990e8e68cf30b5d78fcd7e30949680493826b48ec142231135e1ff6f9da5f5f8f86bd539f45b1e0f0238e19273ed5186a7a9fb97facc274bd0bbfde6523'
25
'7c6cf9f1074c08b4d38567ced95159c0809af025efe01b0163d9bb5107daabfa873064255186c071a7dc3a9177ccd0c1b2fcc8b085bdbff234965a6710b3ae45')
26
27
prepare() {
28
# Validate the signature against public key:
29
# https://tuta.com/support#verify-desktop
30
openssl dgst -sha512 -verify tutao-pub-${pkgver}.pem -signature \
31
linux-sig-${pkgver}.bin "${pkgname%-bin}-$pkgver.AppImage"
32
33
chmod +x "${pkgname%-bin}-$pkgver.AppImage"
34
./"${pkgname%-bin}-$pkgver.AppImage" --appimage-extract
35
36
# Correct path for desktop file, remove unneeded desktop file keys
37
desktop-file-edit --set-key=Exec --set-value="/opt/${pkgname%-bin}/${pkgname%-bin}" \
38
--remove-key="X-AppImage-Version" \
39
"squashfs-root/${pkgname%-bin}.desktop"
40
}
41
42
package() {
43
find squashfs-root/{locales,resources,usr/share/icons}/ -type d -exec chmod 755 {} +
44
45
install -d "$pkgdir/opt/${pkgname%-bin}/"
46
cp -av squashfs-root/* "$pkgdir/opt/${pkgname%-bin}/"
47
chmod 4755 "$pkgdir/opt/${pkgname%-bin}/chrome-sandbox"
48
rm -rf "$pkgdir/opt/${pkgname%-bin}/usr/"
49
rm "$pkgdir/opt/${pkgname%-bin}"/{"${pkgname%-bin}".desktop,AppRun}
50
51
# Fix permisssions
52
chmod 644 "$pkgdir/opt/${pkgname%-bin}"/resources/app{.asar,-update.yml}
53
54
install -d "$pkgdir/usr/bin"
55
ln -s "/opt/${pkgname%-bin}/${pkgname%-bin}" "$pkgdir/usr/bin/"
56
57
install -Dm644 "squashfs-root/${pkgname%-bin}.desktop" -t \
58
"$pkgdir/usr/share/applications/"
59
60
install -d "$pkgdir/usr/share/icons/"
61
cp -r squashfs-root/usr/share/icons/hicolor/ "$pkgdir/usr/share/icons/"
62
}
63
Changes since previous scan
--- PKGBUILD @ 2026-07-21 00:24+++ PKGBUILD @ 2026-08-03 00:08@@ -1,7 +1,7 @@ # Maintainer: Mark Wagie <mark dot wagie at proton dot me> # Co-Maintainer: Aaron J. Graves <linux@ajgraves.com> pkgname=tutanota-desktop-bin-pkgver=354.260707.0+pkgver=355.260720.0 pkgrel=1 pkgdesc="The desktop client for Tutanota, the secure e-mail service." arch=('x86_64')@@ -20,8 +20,8 @@ "tutao-pub-$pkgver.pem::https://github.com/tutao/tutanota/raw/${pkgname%-bin}-release-$pkgver/tutao-pub.pem") provides=("${pkgname%-bin}") conflicts=("${pkgname%-bin}" "${pkgname%-bin}-linux")-sha512sums=('df42047bda53f42707fb74f3790fccf2ab3fcdfd4d52a727570bcace9b6387700d0ef50f1aa6758d836f0e0bceae893ea6e8affda435267b6b01a8acbe1569f4'- '3b2028001b48b58b65f98bb4fcd21c36b335dec021bf198b0dff45f0f3035cca47165ac37d843b56319d0fd1e1502dd1ac719b5bb08ca09267460cb335a6de5a'+sha512sums=('6d4b127667bd3d9d5e6b14fe2965aedd301a2ed28e8047df856dfa896ebac5d8c751bb197ff4ce8f6d90f6e2f3f4c04d7a733328fedbc1015a0f1555f145ff26'+ '3ddf8990e8e68cf30b5d78fcd7e30949680493826b48ec142231135e1ff6f9da5f5f8f86bd539f45b1e0f0238e19273ed5186a7a9fb97facc274bd0bbfde6523' '7c6cf9f1074c08b4d38567ced95159c0809af025efe01b0163d9bb5107daabfa873064255186c071a7dc3a9177ccd0c1b2fcc8b085bdbff234965a6710b3ae45') prepare() {Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | LOW | 2 |
| 2026-08-02 00:16:08 | LOW | 2 |
| 2026-08-01 00:11:18 | LOW | 2 |
| 2026-07-31 00:14:10 | LOW | 2 |
| 2026-07-30 00:17:23 | LOW | 2 |
| 2026-07-29 00:25:53 | LOW | 2 |
| 2026-07-28 00:07:28 | LOW | 2 |
| 2026-07-27 00:24:32 | LOW | 2 |
| 2026-07-26 00:07:32 | LOW | 2 |
| 2026-07-25 00:13:44 | LOW | 2 |
| 2026-07-24 00:02:28 | LOW | 2 |
| 2026-07-23 00:14:47 | LOW | 2 |
| 2026-07-22 00:29:32 | LOW | 2 |
| 2026-07-21 17:17:32 | MEDIUM | 1 |
| 2026-07-21 00:24:15 | LOW | 2 |
| 2026-07-20 00:19:49 | LOW | 2 |
| 2026-07-19 00:17:08 | LOW | 2 |
| 2026-07-18 00:14:48 | LOW | 2 |
| 2026-07-17 00:06:16 | LOW | 2 |
| 2026-07-16 00:05:41 | LOW | 2 |