yesterdays-desktop-bin

maintainer mhpob · 1 votes · scanned 2026-08-18 00:03:42.021799

MEDIUM

Why flagged The package downloads a prebuilt .deb from a GitHub release, which is an unverifiable binary artifact; if the source were swapped, it could lead to arbitrary code execution during installation.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

MEDIUM AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 90%): The package downloads a prebuilt .deb from a GitHub release, which is an unverifiable binary artifact; if the source were swapped, it could lead to arbitrary code execution during installation.

PKGBUILD

      1# Maintainer: Mike O'Brien <mike at obrien dot page>
    
      2pkgname=yesterdays-desktop-bin
    
      3pkgver=0.3.0
    
      4pkgrel=1
    
      5pkgdesc="Yesterdays Desktop application"
    
      6arch=('x86_64')
    
      7url="https://github.com/MapRVA/yesterdays-desktop"
    
      8license=('GPL-3.0-or-later')
    
      9depends=(
    
      10  'cairo'
    
      11  'gdk-pixbuf2'
    
      12  'glib2'
    
      13  'glibc'
    
      14  'gtk3'
    
      15  'hicolor-icon-theme'
    
      16  'libgcc'
    
      17  'libsoup3'
    
      18  'openssl'
    
      19  'webkit2gtk-4.1'
    
      20)
    
      21provides=("${pkgname%-bin}")
    
      22conflicts=("${pkgname%-bin}")
    
      23
    
      24source=("${pkgname}-${pkgver}.deb::${url}/releases/download/v${pkgver}/Yesterdays.Desktop_${pkgver}_amd64.deb")
    
      25sha256sums=('4c2520c8c4865b2d296daa5bb43fa2c889feef80943aa57e85894513f7cdcdc4')
    
      26
    
      27prepare() {
    
      28  # Extract the data archive inside the .deb package (handles .xz, .gz, .zst, etc.)
    
      29  local data_archive
    
      30  data_archive=$(find "${srcdir}" -maxdepth 1 -name 'data.tar.*' -print -quit)
    
      31
    
      32  if [ -n "${data_archive}" ]; then
    
      33    bsdtar -xf "${data_archive}" -C "${srcdir}"
    
      34  else
    
      35    echo "Error: Could not find data archive inside .deb"
    
      36    return 1
    
      37  fi
    
      38}
    
      39
    
      40package() {
    
      41  # Copy extracted directory trees independently if they exist
    
      42  if [ -d "${srcdir}/usr" ]; then
    
      43    cp -dr --no-preserve=ownership "${srcdir}/usr" "${pkgdir}/"
    
      44  fi
    
      45
    
      46  if [ -d "${srcdir}/opt" ]; then
    
      47    cp -dr --no-preserve=ownership "${srcdir}/opt" "${pkgdir}/"
    
      48
    
      49    # Ensure binary is symlinked into PATH if placed under /opt
    
      50    if [ -f "${pkgdir}/opt/Yesterdays.Desktop/yesterdays-desktop" ]; then
    
      51      install -d "${pkgdir}/usr/bin"
    
      52      ln -s "/opt/Yesterdays.Desktop/yesterdays-desktop" "${pkgdir}/usr/bin/yesterdays-desktop"
    
      53    fi
    
      54  fi
    
      55}
    
      56

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	MEDIUM	2
2026-08-17 00:18:29	MEDIUM	2
2026-08-16 21:33:47	MEDIUM	2