typeless

MEDIUM

maintainer AsukaMinato 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads a prebuilt Windows installer (Setup.exe) from a non-official, non-whitelisted host (typeless-static.com), which is then extracted and repackaged; while the final build uses legitimate upstream sources for other components, the unverifiable origin of the primary payload introduces a supply-chain risk if that host were compromised or malicious.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:31 "Typeless-${pkgver}-x64-Setup.exe::https://typeless-static.com/desktop-release/Typeless-${pkgver}-x64-Setup.exe"

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 85%): The package downloads a prebuilt Windows installer (Setup.exe) from a non-official, non-whitelisted host (typeless-static.com), which is then extracted and repackaged; while the final build uses legitimate upstream sources for other components, the unverifiable origin of the primary payload introduces a supply-chain risk if that host were compromised or malicious.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: w <unknown>
    
      2
    
      3pkgname=typeless
    
      4pkgver=2.1.0
    
      5pkgrel=2
    
      6pkgdesc='AI voice dictation for any application (unofficial Linux compatibility build)'
    
      7arch=('x86_64')
    
      8url='https://www.typeless.com/'
    
      9license=('MIT' 'LicenseRef-custom')
    
      10provides=('typeless')
    
      11conflicts=('typeless')
    
      12depends=(
    
      13  'alsa-lib' 'at-spi2-core' 'cairo' 'dbus' 'expat' 'gcc-libs' 'glib2' 'glibc'
    
      14  'gtk3' 'libcups' 'libdrm' 'libpulse' 'libx11' 'libxcb'
    
      15  'libxcomposite' 'libxdamage' 'libxext' 'libxfixes' 'libxi' 'libxkbcommon'
    
      16  'libxrandr' 'libxtst' 'mesa' 'nspr' 'nss' 'opus' 'pango' 'xdg-utils'
    
      17  'xdotool' 'ydotool'
    
      18)
    
      19makedepends=('asar' 'cargo' 'p7zip' 'pkgconf' 'rust')
    
      20optdepends=(
    
      21  'wtype: text insertion in Wayland sessions'
    
      22  'pipewire: screen and audio capture under Wayland'
    
      23)
    
      24options=('!strip')
    
      25
    
      26_electron_version=33.4.11
    
      27_better_sqlite_version=12.4.1
    
      28_electron_abi=130
    
      29
    
      30source=(
    
      31  "Typeless-${pkgver}-x64-Setup.exe::https://typeless-static.com/desktop-release/Typeless-${pkgver}-x64-Setup.exe"
    
      32  "electron-v${_electron_version}-linux-x64.zip::https://github.com/electron/electron/releases/download/v${_electron_version}/electron-v${_electron_version}-linux-x64.zip"
    
      33  "better-sqlite3-v${_better_sqlite_version}-electron-v${_electron_abi}-linux-x64.tar.gz::https://github.com/WiseLibs/better-sqlite3/releases/download/v${_better_sqlite_version}/better-sqlite3-v${_better_sqlite_version}-electron-v${_electron_abi}-linux-x64.tar.gz"
    
      34  'Cargo.toml'
    
      35  'Cargo.lock'
    
      36  'rust-lib.rs'
    
      37  'atspi_support.rs'
    
      38  'audio.rs'
    
      39  'desktop.rs'
    
      40  'keyboard.rs'
    
      41  'support.rs'
    
      42  'patch-main.mjs'
    
      43  'keyboard-helper-child-process-linux.mjs'
    
      44  'typeless.sh'
    
      45  'typeless.desktop'
    
      46)
    
      47noextract=(
    
      48  "Typeless-${pkgver}-x64-Setup.exe"
    
      49  "electron-v${_electron_version}-linux-x64.zip"
    
      50  "better-sqlite3-v${_better_sqlite_version}-electron-v${_electron_abi}-linux-x64.tar.gz"
    
      51)
    
      52sha256sums=('254e7bf963786df4e79c277a310f6c66b83f2b954f6c51b43b4f2c624c452320'
    
      53            '212d431c7c916292311c797cd91f84467c5abd6e6983cf24b162efff64cee8a9'
    
      54            '54c970ef78326dc203455383e7097a86c4cc5f2c92733984cbcb118ac88bdcec'
    
      55            '6f002ada503740fe4471daf16b63f138b20314a89916af11dde8cfd45d0cb8dd'
    
      56            '3d0fea167367e4b37bf31fe9d9343f50fbfbfc9b27cf6ed5e1804162613dec32'
    
      57            'e8ed8ff61be26f172e31b0cf8f1310567ec81102332843ead2161bb8329cf078'
    
      58            '2c47c9fec39e294cb6757fc7258a4588047ce9ee7f981e1c71ce161df99c91ab'
    
      59            '712da7747e389b99e96de378a537c80e6cf4b70ca2dd7967004aa7442f7cf9b0'
    
      60            'cb098fec03952d8eaf3060ce16c36b547b94a2e3bbade1515a76acab847222ab'
    
      61            '39b1f90abbc88e6958e9add1c2f756df7d1d6b22d9d0f4fbcb302b3180e8a3bf'
    
      62            '712897ddc034a63ea9545b4ce381170b99b926a677e50145ed8d1a3f92466ecc'
    
      63            '3a7a0e561e63a0d32e068e6d27d9616be9f88c47b2228284ce034a53e8ae2623'
    
      64            'c434d7b071394e3d8efab5f6d065fa0c9dfb566b9f20b00d5da5abd1fa2c7c65'
    
      65            '2ea1079651e2c85587f1c3272234d06b5aa906259201d8b379e71a3285e20b5c'
    
      66            '7eab64616bea602e2382cef4c9616edde36a01b475128c1f00fa3b3c8f6ffd58')
    
      67
    
      68prepare() {
    
      69  rm -rf -- "$srcdir/nsis" "$srcdir/upstream" "$srcdir/electron-runtime" "$srcdir/sqlite-prebuild"
    
      70  mkdir -p "$srcdir/nsis" "$srcdir/upstream" "$srcdir/electron-runtime" "$srcdir/sqlite-prebuild"
    
      71
    
      72  7z x -y -o"$srcdir/nsis" "$srcdir/Typeless-${pkgver}-x64-Setup.exe"
    
      73  7z x -y -o"$srcdir/upstream" "$srcdir/nsis/\$PLUGINSDIR/app-64.7z"
    
      74
    
      75  asar extract "$srcdir/upstream/resources/app.asar" "$srcdir/upstream/resources/app"
    
      76  node "$srcdir/patch-main.mjs" \
    
      77    "$srcdir/upstream/resources/app/dist/main/index.js" \
    
      78    "$srcdir/keyboard-helper-child-process-linux.mjs"
    
      79  rm -f -- "$srcdir/upstream/resources/app.asar"
    
      80  rm -rf -- "$srcdir/upstream/resources/app.asar.unpacked"
    
      81
    
      82  tar -xzf "$srcdir/better-sqlite3-v${_better_sqlite_version}-electron-v${_electron_abi}-linux-x64.tar.gz" \
    
      83    -C "$srcdir/sqlite-prebuild"
    
      84  local sqlite_binary
    
      85  sqlite_binary="$(find "$srcdir/sqlite-prebuild" -type f -name better_sqlite3.node -print -quit)"
    
      86  [[ -n "$sqlite_binary" ]] || return 1
    
      87  install -Dm755 "$sqlite_binary" \
    
      88    "$srcdir/upstream/resources/app/node_modules/better-sqlite3/build/Release/better_sqlite3.node"
    
      89
    
      90  # The asar contains binaries for every Koffi target plus Windows-only modules.
    
      91  # Keep the Linux N-API build and discard binaries that can never be loaded here.
    
      92  find "$srcdir/upstream/resources/app/node_modules/koffi/build/koffi" \
    
      93    -mindepth 1 -maxdepth 1 -type d ! -name linux_x64 -exec rm -rf -- {} +
    
      94  rm -rf -- "$srcdir/upstream/resources/app/node_modules/winax"
    
      95
    
      96  bsdtar -xf "$srcdir/electron-v${_electron_version}-linux-x64.zip" \
    
      97    -C "$srcdir/electron-runtime"
    
      98  chmod 4755 "$srcdir/electron-runtime/chrome-sandbox"
    
      99
    
      100  cargo fetch --manifest-path "$srcdir/Cargo.toml" --locked
    
      101}
    
      102
    
      103build() {
    
      104  CARGO_TARGET_DIR="$srcdir/cargo-target" \
    
      105    cargo build --manifest-path "$srcdir/Cargo.toml" --release --frozen
    
      106}
    
      107
    
      108package() {
    
      109  local appdir="$pkgdir/opt/typeless"
    
      110  install -d "$appdir" "$appdir/resources"
    
      111  cp -a --no-preserve=ownership "$srcdir/electron-runtime/." "$appdir/"
    
      112  rm -f -- "$appdir/resources/default_app.asar"
    
      113  mv "$appdir/electron" "$appdir/typeless"
    
      114
    
      115  cp -a --no-preserve=ownership "$srcdir/upstream/resources/app" "$appdir/resources/app"
    
      116  cp -a --no-preserve=ownership "$srcdir/upstream/resources/build" "$appdir/resources/build"
    
      117  cp -a --no-preserve=ownership "$srcdir/upstream/resources/drizzle" "$appdir/resources/drizzle"
    
      118  cp -a --no-preserve=ownership "$srcdir/upstream/resources/locales" "$appdir/resources/locales"
    
      119  cp -a --no-preserve=ownership "$srcdir/upstream/resources/lib" "$appdir/resources/lib"
    
      120
    
      121  rm -rf -- "$appdir/resources/lib/"*/build/windows
    
      122  local helper="$srcdir/cargo-target/release/libtypeless_linux_helpers.so"
    
      123  install -Dm755 "$helper" \
    
      124    "$appdir/resources/lib/keyboard-helper/build/linux/x64/libKeyboardHelper.so"
    
      125  install -Dm755 "$helper" \
    
      126    "$appdir/resources/lib/context-helper/build/linux/x64/libContextHelper.so"
    
      127  install -Dm755 "$helper" \
    
      128    "$appdir/resources/lib/input-helper/build/linux/x64/libInputHelper.so"
    
      129  install -Dm755 "$helper" \
    
      130    "$appdir/resources/lib/util-helper/build/libUtilHelper.so"
    
      131  install -Dm755 "$helper" \
    
      132    "$appdir/resources/lib/libopusenc/build/linux/x64/libopusenc.so"
    
      133
    
      134  chmod 4755 "$appdir/chrome-sandbox"
    
      135  install -Dm755 "$srcdir/typeless.sh" "$pkgdir/usr/bin/typeless"
    
      136  install -Dm644 "$srcdir/typeless.desktop" \
    
      137    "$pkgdir/usr/share/applications/typeless.desktop"
    
      138  install -Dm644 "$srcdir/upstream/resources/build/icons/png/256x256.png" \
    
      139    "$pkgdir/usr/share/icons/hicolor/256x256/apps/typeless.png"
    
      140
    
      141  install -Dm644 "$srcdir/electron-runtime/LICENSE" \
    
      142    "$pkgdir/usr/share/licenses/$pkgname/LICENSE.electron"
    
      143  install -Dm644 "$srcdir/electron-runtime/LICENSES.chromium.html" \
    
      144    "$pkgdir/usr/share/licenses/$pkgname/LICENSES.chromium.html"
    
      145  install -Dm644 "$srcdir/upstream/resources/app/package.json" \
    
      146    "$pkgdir/usr/share/licenses/$pkgname/app-package.json"
    
      147}
    
      148

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2
2026-08-29 00:29:17	Medium	2