typeless

maintainer AsukaMinato · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt Windows installer (Setup.exe) from a non-official, non-whitelisted host (typeless-static.com), which is then extracted and repackaged; while the final build uses legitimate upstream sources for other components, the unverifiable origin of the primary payload introduces a supply-chain risk if that host were compromised or malicious.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:31 "Typeless-${pkgver}-x64-Setup.exe::https://typeless-static.com/desktop-release/Typeless-${pkgver}-x64-Setup.exe"

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 85%): The package downloads a prebuilt Windows installer (Setup.exe) from a non-official, non-whitelisted host (typeless-static.com), which is then extracted and repackaged; while the final build uses legitimate upstream sources for other components, the unverifiable origin of the primary payload introduces a supply-chain risk if that host were compromised or malicious.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: w <unknown>
    
      2
    
      3pkgname=typeless
    
      4pkgver=2.1.0
    
      5pkgrel=2
    
      6pkgdesc='AI voice dictation for any application (unofficial Linux compatibility build)'
    
      7arch=('x86_64')
    
      8url='https://www.typeless.com/'
    
      9license=('MIT' 'LicenseRef-custom')
    
      10provides=('typeless')
    
      11conflicts=('typeless')
    
      12depends=(
    
      13  'alsa-lib' 'at-spi2-core' 'cairo' 'dbus' 'expat' 'gcc-libs' 'glib2' 'glibc'
    
      14  'gtk3' 'libcups' 'libdrm' 'libpulse' 'libx11' 'libxcb'
    
      15  'libxcomposite' 'libxdamage' 'libxext' 'libxfixes' 'libxi' 'libxkbcommon'
    
      16  'libxrandr' 'libxtst' 'mesa' 'nspr' 'nss' 'opus' 'pango' 'xdg-utils'
    
      17  'xdotool' 'ydotool'
    
      18)
    
      19makedepends=('asar' 'cargo' 'p7zip' 'pkgconf' 'rust')
    
      20optdepends=(
    
      21  'wtype: text insertion in Wayland sessions'
    
      22  'pipewire: screen and audio capture under Wayland'
    
      23)
    
      24options=('!strip')
    
      25
    
      26_electron_version=33.4.11
    
      27_better_sqlite_version=12.4.1
    
      28_electron_abi=130
    
      29
    
      30source=(
    
      31  "Typeless-${pkgver}-x64-Setup.exe::https://typeless-static.com/desktop-release/Typeless-${pkgver}-x64-Setup.exe"
    
      32  "electron-v${_electron_version}-linux-x64.zip::https://github.com/electron/electron/releases/download/v${_electron_version}/electron-v${_electron_version}-linux-x64.zip"
    
      33  "better-sqlite3-v${_better_sqlite_version}-electron-v${_electron_abi}-linux-x64.tar.gz::https://github.com/WiseLibs/better-sqlite3/releases/download/v${_better_sqlite_version}/better-sqlite3-v${_better_sqlite_version}-electron-v${_electron_abi}-linux-x64.tar.gz"
    
      34  'Cargo.toml'
    
      35  'Cargo.lock'
    
      36  'rust-lib.rs'
    
      37  'atspi_support.rs'
    
      38  'audio.rs'
    
      39  'desktop.rs'
    
      40  'keyboard.rs'
    
      41  'support.rs'
    
      42  'patch-main.mjs'
    
      43  'keyboard-helper-child-process-linux.mjs'
    
      44  'typeless.sh'
    
      45  'typeless.desktop'
    
      46)
    
      47noextract=(
    
      48  "Typeless-${pkgver}-x64-Setup.exe"
    
      49  "electron-v${_electron_version}-linux-x64.zip"
    
      50  "better-sqlite3-v${_better_sqlite_version}-electron-v${_electron_abi}-linux-x64.tar.gz"
    
      51)
    
      52sha256sums=('254e7bf963786df4e79c277a310f6c66b83f2b954f6c51b43b4f2c624c452320'
    
      53            '212d431c7c916292311c797cd91f84467c5abd6e6983cf24b162efff64cee8a9'
    
      54            '54c970ef78326dc203455383e7097a86c4cc5f2c92733984cbcb118ac88bdcec'
    
      55            '6f002ada503740fe4471daf16b63f138b20314a89916af11dde8cfd45d0cb8dd'
    
      56            '3d0fea167367e4b37bf31fe9d9343f50fbfbfc9b27cf6ed5e1804162613dec32'
    
      57            'e8ed8ff61be26f172e31b0cf8f1310567ec81102332843ead2161bb8329cf078'
    
      58            '2c47c9fec39e294cb6757fc7258a4588047ce9ee7f981e1c71ce161df99c91ab'
    
      59            '712da7747e389b99e96de378a537c80e6cf4b70ca2dd7967004aa7442f7cf9b0'
    
      60            'cb098fec03952d8eaf3060ce16c36b547b94a2e3bbade1515a76acab847222ab'
    
      61            '39b1f90abbc88e6958e9add1c2f756df7d1d6b22d9d0f4fbcb302b3180e8a3bf'
    
      62            '712897ddc034a63ea9545b4ce381170b99b926a677e50145ed8d1a3f92466ecc'
    
      63            '3a7a0e561e63a0d32e068e6d27d9616be9f88c47b2228284ce034a53e8ae2623'
    
      64            'c434d7b071394e3d8efab5f6d065fa0c9dfb566b9f20b00d5da5abd1fa2c7c65'
    
      65            '2ea1079651e2c85587f1c3272234d06b5aa906259201d8b379e71a3285e20b5c'
    
      66            '7eab64616bea602e2382cef4c9616edde36a01b475128c1f00fa3b3c8f6ffd58')
    
      67
    
      68prepare() {
    
      69  rm -rf -- "$srcdir/nsis" "$srcdir/upstream" "$srcdir/electron-runtime" "$srcdir/sqlite-prebuild"
    
      70  mkdir -p "$srcdir/nsis" "$srcdir/upstream" "$srcdir/electron-runtime" "$srcdir/sqlite-prebuild"
    
      71
    
      72  7z x -y -o"$srcdir/nsis" "$srcdir/Typeless-${pkgver}-x64-Setup.exe"
    
      73  7z x -y -o"$srcdir/upstream" "$srcdir/nsis/\$PLUGINSDIR/app-64.7z"
    
      74
    
      75  asar extract "$srcdir/upstream/resources/app.asar" "$srcdir/upstream/resources/app"
    
      76  node "$srcdir/patch-main.mjs" \
    
      77    "$srcdir/upstream/resources/app/dist/main/index.js" \
    
      78    "$srcdir/keyboard-helper-child-process-linux.mjs"
    
      79  rm -f -- "$srcdir/upstream/resources/app.asar"
    
      80  rm -rf -- "$srcdir/upstream/resources/app.asar.unpacked"
    
      81
    
      82  tar -xzf "$srcdir/better-sqlite3-v${_better_sqlite_version}-electron-v${_electron_abi}-linux-x64.tar.gz" \
    
      83    -C "$srcdir/sqlite-prebuild"
    
      84  local sqlite_binary
    
      85  sqlite_binary="$(find "$srcdir/sqlite-prebuild" -type f -name better_sqlite3.node -print -quit)"
    
      86  [[ -n "$sqlite_binary" ]] || return 1
    
      87  install -Dm755 "$sqlite_binary" \
    
      88    "$srcdir/upstream/resources/app/node_modules/better-sqlite3/build/Release/better_sqlite3.node"
    
      89
    
      90  # The asar contains binaries for every Koffi target plus Windows-only modules.
    
      91  # Keep the Linux N-API build and discard binaries that can never be loaded here.
    
      92  find "$srcdir/upstream/resources/app/node_modules/koffi/build/koffi" \
    
      93    -mindepth 1 -maxdepth 1 -type d ! -name linux_x64 -exec rm -rf -- {} +
    
      94  rm -rf -- "$srcdir/upstream/resources/app/node_modules/winax"
    
      95
    
      96  bsdtar -xf "$srcdir/electron-v${_electron_version}-linux-x64.zip" \
    
      97    -C "$srcdir/electron-runtime"
    
      98  chmod 4755 "$srcdir/electron-runtime/chrome-sandbox"
    
      99
    
      100  cargo fetch --manifest-path "$srcdir/Cargo.toml" --locked
    
      101}
    
      102
    
      103build() {
    
      104  CARGO_TARGET_DIR="$srcdir/cargo-target" \
    
      105    cargo build --manifest-path "$srcdir/Cargo.toml" --release --frozen
    
      106}
    
      107
    
      108package() {
    
      109  local appdir="$pkgdir/opt/typeless"
    
      110  install -d "$appdir" "$appdir/resources"
    
      111  cp -a --no-preserve=ownership "$srcdir/electron-runtime/." "$appdir/"
    
      112  rm -f -- "$appdir/resources/default_app.asar"
    
      113  mv "$appdir/electron" "$appdir/typeless"
    
      114
    
      115  cp -a --no-preserve=ownership "$srcdir/upstream/resources/app" "$appdir/resources/app"
    
      116  cp -a --no-preserve=ownership "$srcdir/upstream/resources/build" "$appdir/resources/build"
    
      117  cp -a --no-preserve=ownership "$srcdir/upstream/resources/drizzle" "$appdir/resources/drizzle"
    
      118  cp -a --no-preserve=ownership "$srcdir/upstream/resources/locales" "$appdir/resources/locales"
    
      119  cp -a --no-preserve=ownership "$srcdir/upstream/resources/lib" "$appdir/resources/lib"
    
      120
    
      121  rm -rf -- "$appdir/resources/lib/"*/build/windows
    
      122  local helper="$srcdir/cargo-target/release/libtypeless_linux_helpers.so"
    
      123  install -Dm755 "$helper" \
    
      124    "$appdir/resources/lib/keyboard-helper/build/linux/x64/libKeyboardHelper.so"
    
      125  install -Dm755 "$helper" \
    
      126    "$appdir/resources/lib/context-helper/build/linux/x64/libContextHelper.so"
    
      127  install -Dm755 "$helper" \
    
      128    "$appdir/resources/lib/input-helper/build/linux/x64/libInputHelper.so"
    
      129  install -Dm755 "$helper" \
    
      130    "$appdir/resources/lib/util-helper/build/libUtilHelper.so"
    
      131  install -Dm755 "$helper" \
    
      132    "$appdir/resources/lib/libopusenc/build/linux/x64/libopusenc.so"
    
      133
    
      134  chmod 4755 "$appdir/chrome-sandbox"
    
      135  install -Dm755 "$srcdir/typeless.sh" "$pkgdir/usr/bin/typeless"
    
      136  install -Dm644 "$srcdir/typeless.desktop" \
    
      137    "$pkgdir/usr/share/applications/typeless.desktop"
    
      138  install -Dm644 "$srcdir/upstream/resources/build/icons/png/256x256.png" \
    
      139    "$pkgdir/usr/share/icons/hicolor/256x256/apps/typeless.png"
    
      140
    
      141  install -Dm644 "$srcdir/electron-runtime/LICENSE" \
    
      142    "$pkgdir/usr/share/licenses/$pkgname/LICENSE.electron"
    
      143  install -Dm644 "$srcdir/electron-runtime/LICENSES.chromium.html" \
    
      144    "$pkgdir/usr/share/licenses/$pkgname/LICENSES.chromium.html"
    
      145  install -Dm644 "$srcdir/upstream/resources/app/package.json" \
    
      146    "$pkgdir/usr/share/licenses/$pkgname/app-package.json"
    
      147}
    
      148

Changes since previous scan

--- PKGBUILD @ 2026-07-22 15:20
+++ PKGBUILD @ 2026-08-03 00:08
@@ -2,7 +2,7 @@
 
 pkgname=typeless
 pkgver=2.1.0
-pkgrel=1
+pkgrel=2
 pkgdesc='AI voice dictation for any application (unofficial Linux compatibility build)'
 arch=('x86_64')
 url='https://www.typeless.com/'
@@ -11,12 +11,12 @@
 conflicts=('typeless')
 depends=(
   'alsa-lib' 'at-spi2-core' 'cairo' 'dbus' 'expat' 'gcc-libs' 'glib2' 'glibc'
-  'gtk3' 'libcups' 'libdrm' 'libogg' 'libpulse' 'libx11' 'libxcb'
+  'gtk3' 'libcups' 'libdrm' 'libpulse' 'libx11' 'libxcb'
   'libxcomposite' 'libxdamage' 'libxext' 'libxfixes' 'libxi' 'libxkbcommon'
   'libxrandr' 'libxtst' 'mesa' 'nspr' 'nss' 'opus' 'pango' 'xdg-utils'
   'xdotool' 'ydotool'
 )
-makedepends=('asar' 'cmake' 'ninja' 'p7zip' 'pkgconf')
+makedepends=('asar' 'cargo' 'p7zip' 'pkgconf' 'rust')
 optdepends=(
   'wtype: text insertion in Wayland sessions'
   'pipewire: screen and audio capture under Wayland'
@@ -31,9 +31,14 @@
   "Typeless-${pkgver}-x64-Setup.exe::https://typeless-static.com/desktop-release/Typeless-${pkgver}-x64-Setup.exe"
   "electron-v${_electron_version}-linux-x64.zip::https://github.com/electron/electron/releases/download/v${_electron_version}/electron-v${_electron_version}-linux-x64.zip"
   "better-sqlite3-v${_better_sqlite_version}-electron-v${_electron_abi}-linux-x64.tar.gz::https://github.com/WiseLibs/better-sqlite3/releases/download/v${_better_sqlite_version}/better-sqlite3-v${_better_sqlite_version}-electron-v${_electron_abi}-linux-x64.tar.gz"
-  'CMakeLists.txt'
-  'typeless_helper.cpp'
-  'opus_helper.cpp'
+  'Cargo.toml'
+  'Cargo.lock'
+  'rust-lib.rs'
+  'atspi_support.rs'
+  'audio.rs'
+  'desktop.rs'
+  'keyboard.rs'
+  'support.rs'
   'patch-main.mjs'
   'keyboard-helper-child-process-linux.mjs'
   'typeless.sh'
@@ -47,9 +52,14 @@
 sha256sums=('254e7bf963786df4e79c277a310f6c66b83f2b954f6c51b43b4f2c624c452320'
             '212d431c7c916292311c797cd91f84467c5abd6e6983cf24b162efff64cee8a9'
             '54c970ef78326dc203455383e7097a86c4cc5f2c92733984cbcb118ac88bdcec'
-            'afedbdcbcf754da75c6d428e8adfff337d857049009c96a272125533a16e71a2'
-            '87ade74f138c711b10ea0a43f1650ea0b26a2bb8421ffac4d2f5b00994d7a3a1'
-            '43b9c517611e3329f91352b3165f590a4c862a501ba163915e8d96c70bfc5956'
+            '6f002ada503740fe4471daf16b63f138b20314a89916af11dde8cfd45d0cb8dd'
+            '3d0fea167367e4b37bf31fe9d9343f50fbfbfc9b27cf6ed5e1804162613dec32'
+            'e8ed8ff61be26f172e31b0cf8f1310567ec81102332843ead2161bb8329cf078'
+            '2c47c9fec39e294cb6757fc7258a4588047ce9ee7f981e1c71ce161df99c91ab'
+            '712da7747e389b99e96de378a537c80e6cf4b70ca2dd7967004aa7442f7cf9b0'
+            'cb098fec03952d8eaf3060ce16c36b547b94a2e3bbade1515a76acab847222ab'
+            '39b1f90abbc88e6958e9add1c2f756df7d1d6b22d9d0f4fbcb302b3180e8a3bf'
+            '712897ddc034a63ea9545b4ce381170b99b926a677e50145ed8d1a3f92466ecc'
             '3a7a0e561e63a0d32e068e6d27d9616be9f88c47b2228284ce034a53e8ae2623'
             'c434d7b071394e3d8efab5f6d065fa0c9dfb566b9f20b00d5da5abd1fa2c7c65'
             '2ea1079651e2c85587f1c3272234d06b5aa906259201d8b379e71a3285e20b5c'
@@ -86,12 +96,13 @@
   bsdtar -xf "$srcdir/electron-v${_electron_version}-linux-x64.zip" \
     -C "$srcdir/electron-runtime"
   chmod 4755 "$srcdir/electron-runtime/chrome-sandbox"
+
+  cargo fetch --manifest-path "$srcdir/Cargo.toml" --locked
 }
 
 build() {
-  cmake -S "$srcdir" -B "$srcdir/native-build" -G Ninja \
-    -DCMAKE_BUILD_TYPE=Release
-  cmake --build "$srcdir/native-build"
+  CARGO_TARGET_DIR="$srcdir/cargo-target" \
+    cargo build --manifest-path "$srcdir/Cargo.toml" --release --frozen
 }
 
 package() {
@@ -108,15 +119,16 @@
   cp -a --no-preserve=ownership "$srcdir/upstream/resources/lib" "$appdir/resources/lib"
 
   rm -rf -- "$appdir/resources/lib/"*/build/windows
-  install -Dm755 "$srcdir/native-build/libtypeless_helper.so" \
+  local helper="$srcdir/cargo-target/release/libtypeless_linux_helpers.so"
+  install -Dm755 "$helper" \
     "$appdir/resources/lib/keyboard-helper/build/linux/x64/libKeyboardHelper.so"
-  install -Dm755 "$srcdir/native-build/libtypeless_helper.so" \
+  install -Dm755 "$helper" \
     "$appdir/resources/lib/context-helper/build/linux/x64/libContextHelper.so"
-  install -Dm755 "$srcdir/native-build/libtypeless_helper.so" \
+  install -Dm755 "$helper" \
     "$appdir/resources/lib/input-helper/build/linux/x64/libInputHelper.so"
-  install -Dm755 "$srcdir/native-build/libtypeless_helper.so" \
+  install -Dm755 "$helper" \
     "$appdir/resources/lib/util-helper/build/libUtilHelper.so"
-  install -Dm755 "$srcdir/native-build/libopusenc.so" \
+  install -Dm755 "$helper" \
     "$appdir/resources/lib/libopusenc/build/linux/x64/libopusenc.so"
 
   chmod 4755 "$appdir/chrome-sandbox"

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	3
2026-08-02 00:16:08	MEDIUM	3
2026-08-01 00:11:18	MEDIUM	3
2026-07-31 00:14:10	MEDIUM	3
2026-07-30 00:17:23	MEDIUM	3
2026-07-29 00:25:53	MEDIUM	3
2026-07-28 00:07:28	MEDIUM	3
2026-07-27 00:24:32	MEDIUM	3
2026-07-26 00:07:32	MEDIUM	3
2026-07-25 00:13:44	MEDIUM	3
2026-07-24 00:02:28	MEDIUM	3
2026-07-23 00:14:47	MEDIUM	3
2026-07-22 17:21:24	MEDIUM	3
2026-07-22 15:20:42	MEDIUM	3
2026-07-22 13:22:57	MEDIUM	3
2026-07-22 13:20:28	MEDIUM	3