ya-claude
LOW
maintainer aaronsb
0 votes
scanned 2026-08-19 07:41:23.651733
Why flagged
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
Triggered rules
Low
Few votes, recently uploaded
zero_votes_recent
Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.
PKGBUILD
1
# Maintainer: Aaron Bockelie <aaronsb@gmail.com>
2
3
pkgname=ya-claude
4
pkgver=1.32885.1
5
pkgrel=1
6
pkgdesc="Claude Desktop from Anthropic's official Debian build, verified at build time against their signed apt index"
7
arch=('x86_64')
8
url="https://claude.com/download"
9
license=('LicenseRef-Proprietary')
10
11
# Fingerprint of "Anthropic Claude Code Release Signing <security@anthropic.com>",
12
# cross-checked against four independent sources on 2026-08-12: the published
13
# install docs, downloads.claude.ai/claude-desktop/key.asc, the InRelease
14
# signature itself, and the key embedded in the .deb's own postinst.
15
_fpr='31DDDE24DDFAB679F42D7BD2BAA929FF1A7ECACE'
16
17
_apt="https://downloads.claude.ai/claude-desktop/apt/stable"
18
_deb="claude-desktop_${pkgver}_amd64.deb"
19
20
# virtiofsd is a hard dependency, not a Cowork option: the app resolves it from
21
# /usr/libexec then /usr/bin and only falls back to its own bundled copy on
22
# Ubuntu 22.x, so on Arch the system binary is the only one ever reached.
23
# Verified by reading the resolver in resources/app.asar (1.28929.0).
24
#
25
# libgcc + libstdc++ rather than gcc-libs: that is now a metapackage pulling
26
# libasan/libtsan/libubsan/libgfortran/libquadmath, none of which are linked.
27
# libsecret and libnotify carry no NEEDED entry but appear as dlopen strings.
28
# libdrm, libxtst and util-linux-libs are upstream Depends we could not confirm
29
# independently; kept on upstream's authority rather than dropped.
30
depends=('alsa-lib' 'at-spi2-core' 'cairo' 'dbus' 'expat' 'glib2' 'glibc'
31
'gtk3' 'hicolor-icon-theme' 'libcap-ng' 'libcups' 'libdrm' 'libgcc'
32
'libnotify' 'libseccomp' 'libsecret' 'libstdc++' 'libx11' 'libxcb'
33
'libxcomposite' 'libxdamage' 'libxext' 'libxfixes' 'libxkbcommon'
34
'libxrandr' 'libxtst' 'mesa' 'nspr' 'nss' 'pango' 'systemd-libs'
35
'util-linux-libs' 'virtiofsd' 'xdg-desktop-portal' 'xdg-utils')
36
37
# Cowork boots a VM; without these the app reports it unsupported and the rest
38
# of the package still works. Optional rather than required so that installing a
39
# chat client never drags in a virtualisation stack a machine hasn't opted into.
40
# Hosts that already run QEMU satisfy these with what they have.
41
optdepends=('qemu-system-x86: Cowork agent VM'
42
'edk2-ovmf: UEFI firmware for the Cowork agent VM'
43
'gnome-keyring: credential storage via Secret Service'
44
'kwallet: credential storage on KDE Plasma'
45
'xdg-desktop-portal-gtk: portal backend for GTK desktops'
46
'xdg-desktop-portal-kde: portal backend for KDE Plasma')
47
48
provides=('claude-desktop')
49
conflicts=('claude-desktop' 'claude-desktop-appimage' 'claude-desktop-extra' 'claude')
50
51
# Prebuilt Electron/Chromium: stripping corrupts the V8 snapshot and embedded
52
# resources, and there is no source to build a -debug package from.
53
options=('!strip' '!debug')
54
55
source=("${_deb}::${_apt}/pool/main/c/claude-desktop/${_deb}"
56
"InRelease::${_apt}/dists/stable/InRelease"
57
"Packages::${_apt}/dists/stable/main/binary-amd64/Packages"
58
'anthropic-release-signing.key')
59
60
# InRelease and Packages are re-signed and appended to on every upstream
61
# release, so no fixed hash exists; prepare() authenticates them by signature
62
# instead. The .deb hash is pinned and additionally re-derived from the signed
63
# index, so a wrong value fails twice.
64
sha256sums=('f8a5ddea7c8cbe769589cf19c2e1832d5d532ab19bf8202621ba957c9351a2fc'
65
'SKIP'
66
'SKIP'
67
'bd70a5e4a268002704024ceba7f8446024114e94f3f0bdd11c23a9e592be81c6')
68
69
noextract=("${_deb}")
70
71
prepare() {
72
cd "$srcdir"
73
74
local keyring="$srcdir/.gnupg"
75
rm -rf "$keyring"
76
install -dm700 "$keyring"
77
gpg --homedir "$keyring" --batch --quiet --import anthropic-release-signing.key
78
79
local got
80
got=$(gpg --homedir "$keyring" --batch --with-colons --fingerprint \
81
| awk -F: '/^fpr:/{print $10; exit}')
82
if [[ $got != "$_fpr" ]]; then
83
echo "==> signing key is not Anthropic's: $got" >&2
84
return 1
85
fi
86
87
gpg --homedir "$keyring" --batch --verify InRelease >/dev/null 2>&1 || {
88
echo "==> InRelease signature did not verify" >&2
89
return 1
90
}
91
92
# InRelease authenticates Packages; Packages authenticates the .deb. Scope the
93
# lookup to the SHA256 block — the same filenames recur under SHA512.
94
local want
95
want=$(awk '/^SHA256:/{s=1;next} /^[A-Za-z][A-Za-z0-9-]*:/{s=0}
96
s && $3=="main/binary-amd64/Packages" && length($1)==64 {print $1; exit}' InRelease)
97
if [[ -z $want ]] || ! echo "${want} Packages" | sha256sum -c --status -; then
98
echo "==> Packages does not match the hash InRelease signs for it" >&2
99
return 1
100
fi
101
102
# Stanza state resets at each Package: head, so a stanza that carries no
103
# SHA256 cannot donate its version to the next one. Matching on its own rule
104
# rather than inside END keeps the match to a single line: awk's exit runs
105
# END on the way out, so printing in both places emits the hash twice.
106
local signed
107
signed=$(awk -v v="$pkgver" '
108
$1=="Package:" { ver=""; sum="" }
109
$1=="Version:" { ver=$2 }
110
$1=="SHA256:" { sum=$2 }
111
ver==v && sum!="" { print sum; exit }' Packages)
112
if [[ $signed != "${sha256sums[0]}" ]]; then
113
echo "==> ${pkgver} hash in the signed index (${signed:-none}) != pinned ${sha256sums[0]}" >&2
114
return 1
115
fi
116
117
echo "==> verified ${_deb} against Anthropic's signed index"
118
}
119
120
package() {
121
cd "$srcdir"
122
123
# Only the payload. The maintainer scripts register an apt repository and
124
# install an AppArmor profile gated on Ubuntu's userns restriction; neither
125
# applies here.
126
bsdtar -xOf "${_deb}" data.tar.xz | bsdtar -xJf - -C "$pkgdir"
127
128
# Chromium's setuid sandbox helper, for kernels without unprivileged userns.
129
chmod 4755 "$pkgdir/usr/lib/claude-desktop/chrome-sandbox"
130
131
rm -r "$pkgdir/usr/share/lintian"
132
133
# Arch installs virtiofsd outside the two paths the app searches.
134
install -d "$pkgdir/usr/bin"
135
ln -s ../lib/virtiofsd "$pkgdir/usr/bin/virtiofsd"
136
137
# The app opens Debian's firmware names under /usr/share/OVMF, which on Arch
138
# is a compat symlink to /usr/share/edk2; the files themselves live in x64/
139
# under different names. It derives the VARS path from the CODE path by
140
# substring replacement, so both links are required.
141
# Verified against edk2-ovmf 202605 on 2026-08-12.
142
#
143
# namcap reports these two as dangling, because edk2-ovmf is an optdepend
144
# rather than a depend — making it required would pull a virtualisation stack
145
# onto machines that never asked for one. Unresolved, the app reads no
146
# firmware and reports Cowork unsupported, which is accurate; where QEMU is
147
# already installed the links resolve. CI allows exactly these two errors.
148
install -d "$pkgdir/usr/share/edk2"
149
ln -s x64/OVMF_CODE.4m.fd "$pkgdir/usr/share/edk2/OVMF_CODE_4M.fd"
150
ln -s x64/OVMF_VARS.4m.fd "$pkgdir/usr/share/edk2/OVMF_VARS_4M.fd"
151
152
install -Dm644 "$pkgdir/usr/share/doc/claude-desktop/copyright" \
153
"$pkgdir/usr/share/licenses/$pkgname/LICENSE"
154
}
155
Changes since previous scan
--- PKGBUILD @ 2026-08-17 00:18+++ PKGBUILD @ 2026-08-19 07:41@@ -1,7 +1,7 @@ # Maintainer: Aaron Bockelie <aaronsb@gmail.com> pkgname=ya-claude-pkgver=1.30096.1+pkgver=1.32885.1 pkgrel=1 pkgdesc="Claude Desktop from Anthropic's official Debian build, verified at build time against their signed apt index" arch=('x86_64')@@ -61,7 +61,7 @@ # release, so no fixed hash exists; prepare() authenticates them by signature # instead. The .deb hash is pinned and additionally re-derived from the signed # index, so a wrong value fails twice.-sha256sums=('09e41a20a5b47ea0e5bc226d4fffa77af43ad450c7cbf5e66e56d6e4fd4ad2e9'+sha256sums=('f8a5ddea7c8cbe769589cf19c2e1832d5d532ab19bf8202621ba957c9351a2fc' 'SKIP' 'SKIP' 'bd70a5e4a268002704024ceba7f8446024114e94f3f0bdd11c23a9e592be81c6')Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-19 07:41:23 | Low | 1 |
| 2026-08-17 00:18:29 | Clean | 2 |
| 2026-08-16 09:32:18 | Low | 1 |
| 2026-08-14 00:03:41 | Clean | 2 |
| 2026-08-13 05:25:33 | Low | 1 |