whatsdesk-bin

maintainer Abzie · 19 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt binary .deb from zerkc.gitlab.io (a GitLab Pages host for the project maintainer 'zerkc'), which is the same namespace as the upstream GitLab project (gitlab.com/zerkc/whatsdesk). This is a common pattern where upstream authors publish release artifacts via their GitLab Pages subdomain. However, it is still a prebuilt Electron binary (whatsdesk is an Electron-based WhatsApp client) installed directly to /opt/whatsdesk/whatsdesk and executed, not built from source. The sha256sum is pinned, which mitigates substitution risk, but the binary itself is opaque and executed at runtime. The host is the project author's own GitLab Pages rather than a completely unrelated third party, which reduces but does not eliminate supply-chain concern. The LICENSE file has no URL, suggesting it may be missing or fetched from an unspecified location. Overall this is a legitimate but non-ideal packaging pattern (prebuilt binary from author's CDN rather than official release artifacts from gitlab.com releases), warranting medium severity.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:18 source_x86_64=("whatsdesk_${pkgver}_${pkgrel}_amd64.deb::https://zerkc.gitlab.io/whatsdesk/whatsdesk_${pkgver}_amd64.deb"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt binary .deb from zerkc.gitlab.io (a GitLab Pages host for the project maintainer 'zerkc'), which is the same namespace as the upstream GitLab project (gitlab.com/zerkc/whatsdesk). This is a common pattern where upstream authors publish release artifacts via their GitLab Pages subdomain. However, it is still a prebuilt Electron binary (whatsdesk is an Electron-based WhatsApp client) installed directly to /opt/whatsdesk/whatsdesk and executed, not built from source. The sha256sum is pinned, which mitigates substitution risk, but the binary itself is opaque and executed at runtime. The host is the project author's own GitLab Pages rather than a completely unrelated third party, which reduces but does not eliminate supply-chain concern. The LICENSE file has no URL, suggesting it may be missing or fetched from an unspecified location. Overall this is a legitimate but non-ideal packaging pattern (prebuilt binary from author's CDN rather than official release artifacts from gitlab.com releases), warranting medium severity.

PKGBUILD

1 offending line(s) highlighted

      1# Contributor: Giancarlo Grasso <gianniesoft at gmail dot com>
    
      2# Maintainer: Alan Beale <the dot mrabz at gmail dot com>
    
      3
    
      4pkgname=whatsdesk-bin
    
      5pkgver=0.3.12
    
      6pkgrel=2
    
      7pkgdesc="unofficial client of whatsapp"
    
      8arch=('x86_64')
    
      9url="https://gitlab.com/zerkc/whatsdesk/"
    
      10license=('MIT')
    
      11provides=('whatsdesk')
    
      12conflicts=('whatsdesk-git')
    
      13depends=('libxss'
    
      14         'nss'
    
      15         'libxtst'
    
      16         'libnotify'
    
      17         'libappindicator-gtk3')
    
      18source_x86_64=("whatsdesk_${pkgver}_${pkgrel}_amd64.deb::https://zerkc.gitlab.io/whatsdesk/whatsdesk_${pkgver}_amd64.deb"
    
      19               "LICENSE")
    
      20sha256sums_x86_64=('a6b1d2ecea9889c779e874cec67ac5ea79d9846dbb92c898074f3550df4a664b'
    
      21                   '38f8c3d94c9497be761fc95f10d3c530a693bae33fa89d5ce29fe1fac45e3aea')
    
      22
    
      23package() {
    
      24  bsdtar -xv -C "${pkgdir}" -f "${srcdir}/data.tar.xz"
    
      25  mkdir -p "${pkgdir}/usr/bin/"
    
      26  ln -s "/opt/whatsdesk/whatsdesk" "${pkgdir}/usr/bin"
    
      27  install -Dm644 "$srcdir/LICENSE" "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      28}
    
      29

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2