Review Results

Comment

The change is a straightforward version bump in .SRCINFO from 1.6.5 to 1.6.7, updating the declared Electron dependency and the GitHub release URLs/checksums for the prebuilt RPMs. The sources remain HTTPS and point to the official upstream release artifacts, with no new scripts, patches, install hooks, or privilege-related metadata introduced. I do not see any supply-chain red flags in this diff alone.

@@ -1,23 +1,23 @@
 pkgbase = vesktop-bin
 	pkgdesc = A cross platform electron-based desktop app aiming to give you a snappier Discord experience with Vencord pre-installed.(Prebuilt version.Use system-wide electron)
-	pkgver = 1.6.5
+	pkgver = 1.6.7
 	pkgrel = 1
 	url = https://github.com/Vencord/Vesktop
 	arch = aarch64
 	arch = x86_64
 	license = GPL-3.0-only
-	depends = electron40
+	depends = electron43
 	depends = debugedit
 	optdepends = speech-dispatcher: High-level device independent layer for speech synthesis interface
-	provides = vesktop=1.6.5
-	provides = vencord-desktop=1.6.5
+	provides = vesktop=1.6.7
+	provides = vencord-desktop=1.6.7
 	conflicts = vesktop
 	conflicts = vencord-desktop
 	source = vesktop.sh
-	sha256sums = 31ad33b633744f5361abd964be306cea53ae1050e760c787115f7eca60045ae6
-	source_aarch64 = vesktop-1.6.5-aarch64.rpm::https://github.com/Vencord/Vesktop/releases/download/v1.6.5/vesktop-1.6.5.aarch64.rpm
-	sha256sums_aarch64 = a6314a88debfe370c690cc7549d921c8e08fd79af1bdc40b2b8ef463d057387d
-	source_x86_64 = vesktop-1.6.5-x86_64.rpm::https://github.com/Vencord/Vesktop/releases/download/v1.6.5/vesktop-1.6.5.x86_64.rpm
-	sha256sums_x86_64 = 6fd5669fe2d5b1ad9bec10a8af1cf859bd911226528eae923ba70e6ef032c134
+	sha256sums = a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d
+	source_aarch64 = vesktop-1.6.7-aarch64.rpm::https://github.com/Vencord/Vesktop/releases/download/v1.6.7/vesktop-1.6.7.aarch64.rpm
+	sha256sums_aarch64 = 642473098904feb424aafc0d97d33d20d8c2596186cdfc6e9866fa6bfc6d531d
+	source_x86_64 = vesktop-1.6.7-x86_64.rpm::https://github.com/Vencord/Vesktop/releases/download/v1.6.7/vesktop-1.6.7.x86_64.rpm
+	sha256sums_x86_64 = 0569c8a8956f161a28b82c6fba667e7ee6828df8856247f5c08f18c1b1b0b8fc
 
 pkgname = vesktop-bin

Comment

The change is low risk overall. It updates the packaged Vesktop release and Electron dependency from 1.6.5/40 to 1.6.7/43, with corresponding checksum updates for the upstream RPMs. The new helper functions only alter how the package locates the app directory and verifies the bundled Electron version, and the packaging logic still installs files into $pkgdir without introducing network access, privilege escalation, or persistence mechanisms. I do note the new package() logic is a bit more permissive (copying all files under resources/ and auto-installing icons found under share/icons), but in the context of a prebuilt upstream RPM this does not by itself indicate malicious behavior.

@@ -4,8 +4,8 @@
 pkgname=vesktop-bin
 _pkgname=Vesktop
 _appname=vencord-desktop
-pkgver=1.6.5
-_electronversion=40
+pkgver=1.6.7
+_electronversion=43
 pkgrel=1
 pkgdesc="A cross platform electron-based desktop app aiming to give you a snappier Discord experience with Vencord pre-installed.(Prebuilt version.Use system-wide electron)"
 arch=(

Comment

The change is limited to checksum updates and replacing a helper that printed the bundled Electron version with a more defensive version-check routine. It does not add network access, privilege escalation, persistence, or any new install-time behavior. The new helper only searches the extracted package contents for resources.pak, picks the largest executable, and inspects its embedded Electron version via strings; if anything is missing it emits a warning and returns. This is a packaging/diagnostic change only, with no security red flags in the diff provided.

@@ -32,12 +32,21 @@ optdepends=(
 source_aarch64=("${pkgname%-bin}-${pkgver}-aarch64.rpm::${url}/releases/download/v${pkgver}/${pkgname%-bin}-${pkgver}.aarch64.rpm")
 source_x86_64=("${pkgname%-bin}-${pkgver}-x86_64.rpm::${url}/releases/download/v${pkgver}/${pkgname%-bin}-${pkgver}.x86_64.rpm")
 source=("${pkgname%-bin}.sh")
-sha256sums=('31ad33b633744f5361abd964be306cea53ae1050e760c787115f7eca60045ae6')
-sha256sums_aarch64=('a6314a88debfe370c690cc7549d921c8e08fd79af1bdc40b2b8ef463d057387d')
-sha256sums_x86_64=('6fd5669fe2d5b1ad9bec10a8af1cf859bd911226528eae923ba70e6ef032c134')
-_get_electron_version() {
-    _elec_ver="$(strings "${srcdir}/opt/${_pkgname}/${pkgname%-bin}" | grep '^Chrome/[0-9.]* Electron/[0-9]' | cut -d'/' -f3 | cut -d'.' -f1)"
-    echo -e "The electron version is: \033[1;31m${_elec_ver}\033[0m"
+sha256sums=('a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
+sha256sums_aarch64=('642473098904feb424aafc0d97d33d20d8c2596186cdfc6e9866fa6bfc6d531d')
+sha256sums_x86_64=('0569c8a8956f161a28b82c6fba667e7ee6828df8856247f5c08f18c1b1b0b8fc')
+_get_app_dir() {
+    find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1
+}
+_check_electron_version() {
+    echo "Verifying Electron version..."
+    local _main_exe=$(find "$(_get_app_dir)" -maxdepth 1 -type f -executable -printf '%s %p\n' | sort -nr | head -1 | cut -d' ' -f2-)
+    [[ -z "${_main_exe}" ]] && echo -e "\033[1;33mNote: Could not find Electron binary.\033[0m" && return
+    local _elec_ver=$(strings "${_main_exe}" | grep -oP 'Electron/\K[0-9]+' | head -1)
+    [[ -z "${_elec_ver}" ]] && echo -e "\033[1;33mNote: Could not determine Electron version.\033[0m" && return
+    [[ "${_elec_ver}" != "${_electronversion}" ]] &&
+        echo -e "\033[1;31mWarning: Electron version mismatch! Detected: ${_elec_ver}, Expected: ${_electronversion}\033[0m" ||
+        echo -e "Electron version verified: \033[1;31m${_elec_ver}\033[0m"
 }
 prepare() {
     sed -i -e "

Comment

The change is low risk overall. It updates the package to a newer upstream release and adjusts packaging logic to locate the app directory dynamically, copy the full resources tree, and install icons from the extracted package. I do not see any new network fetches, privilege escalation, persistence mechanisms, or suspicious post-install behavior. The main security-relevant concern is that the package now copies an entire resources directory with `cp -a` from the extracted RPM instead of installing a single known file; this broadens what gets packaged, but since the source is still a pinned upstream release with checksums and the change only affects local packaging of already-downloaded artifacts, I do not see a high-confidence malicious issue here.

@@ -45,15 +54,20 @@ prepare() {
         s/@appname@/${pkgname%-bin}/g
         s/@runname@/app.asar/g
         s/@cfgdirname@/${pkgname%-bin}/g
-        s/@options@/env ELECTRON_OZONE_PLATFORM_HINT=auto/g
     " "${srcdir}/${pkgname%-bin}.sh"
-    _get_electron_version
+    _check_electron_version
     sed -i "s/\/opt\/${_pkgname}\///g" "${srcdir}/usr/share/applications/${pkgname%-bin}.desktop"
 }
 package() {
     install -Dm755 "${srcdir}/${pkgname%-bin}.sh" "${pkgdir}/usr/bin/${pkgname%-bin}"
-    install -Dm644 "${srcdir}/opt/${_pkgname}/resources/app.asar" -t "${pkgdir}/usr/lib/${pkgname%-bin}"
+    install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-bin}"
+	local _app_dir=$(_get_app_dir)
+	cp -a "${_app_dir}/resources/"* "${pkgdir}/usr/lib/${pkgname%-bin}/"
     install -Dm644 "${srcdir}/usr/share/applications/${pkgname%-bin}.desktop" -t "${pkgdir}/usr/share/applications"
-    install -Dm644 "${srcdir}/usr/share/icons/hicolor/scalable/apps/${pkgname%-bin}.svg" \
-        -t "${pkgdir}/usr/share/icons/hicolor/scalable/apps"
+    find "${srcdir}" -type f \( -name "*.png" -o -name "*.svg" \) -path "*share/icons/*" | while read -r _i; do
+		_extension="${_i##*.}"
+		_icon_path="${_i#*share/icons/}"
+		_target_dir="/usr/share/icons/$(dirname "${_icon_path}")"
+		install -Dm644 "${_i}" "${pkgdir}${_target_dir}/${pkgname%-bin}.${_extension}"
+	done
 }

Comment

The change is mostly a launcher refactor, but it introduces a notable security regression: it now loads and tokenizes multiple user-controlled flag files from XDG config paths and passes their contents directly to Electron. That is expected for a launcher, but the new implementation also changes argument ordering and removes the previous explicit `@options@` handling and `--wayland` gating, which is not itself a security issue. The main concern is that the script now prints the exact flag file path being loaded and uses `read -ra` word-splitting on each line, which can alter quoting semantics and make it easier for a malicious local config file to inject arbitrary Electron flags. However, this is limited to the local user’s own config directory and does not create a privilege escalation or supply-chain compromise. No network access, root writes, or persistence mechanisms were added. Overall low risk.

@@ -2,38 +2,72 @@
 set -e
 _APPDIR="/usr/lib/@appname@"
 _RUNNAME="${_APPDIR}/@runname@"
-_OPTIONS="@options@"
-export PATH="${_APPDIR}:${PATH}"
-export LD_LIBRARY_PATH="${_APPDIR}/swiftshader:${_APPDIR}/lib:${LD_LIBRARY_PATH}"
+
+# Base environment variables
 export ELECTRON_IS_DEV=0
 export ELECTRON_FORCE_IS_PACKAGED=true
 export ELECTRON_DISABLE_SECURITY_WARNINGS=true
 export NODE_ENV=production
 export XDG_CONFIG_HOME="${XDG_CONFIG_HOME:-$HOME/.config}"
-_FLAGS_FILE="${XDG_CONFIG_HOME}/@appname@-flags.conf"
+export LD_LIBRARY_PATH="${_APPDIR}/lib:${LD_LIBRARY_PATH}"
+
+# 1. Display System Optimization (X11 & Wayland)
+# Use 'auto' to allow modern Electron (v20+) to detect the best platform
+# This helps with Wayland window decorations, fractional scaling, and GPU acceleration
+export ELECTRON_OZONE_PLATFORM_HINT="${ELECTRON_OZONE_PLATFORM_HINT:-auto}"
+
+# 2. Desktop Environment (DE) Compatibility
+# Set CHROME_DESKTOP to match the .desktop file for correct taskbar icon grouping
+export CHROME_DESKTOP="@appname@.desktop"
+
+# Fix for Electron's trash implementation on different DEs
+case "${XDG_CURRENT_DESKTOP}" in
+    KDE)
+        export ELECTRON_TRASH="kioclient5"
+        ;;
+    GNOME)
+        export ELECTRON_TRASH="gio"
+        ;;
+    XFCE)
+        export ELECTRON_TRASH="gvfs-trash"
+        ;;
+    *)
+        # Default fallback
+        ;;
+esac
+
+# 3. Load user-defined flags
+# The script checks for flags in the following order (later files override/append to earlier ones):
+# 1. System-wide Electron flags: $XDG_CONFIG_HOME/electron-flags.conf
+# 2. Version-specific Electron flags: $XDG_CONFIG_HOME/electron@electronversion@-flags.conf
+# 3. App-specific global flags: $XDG_CONFIG_HOME/@appname@-flags.conf
+# 4. App-specific directory flags: $XDG_CONFIG_HOME/@cfgdirname@/@appname@-flags.conf
+_FLAG_SOURCES=(
+    "${XDG_CONFIG_HOME}/electron-flags.conf"
+    "${XDG_CONFIG_HOME}/electron@electronversion@-flags.conf"
+    "${XDG_CONFIG_HOME}/@appname@-flags.conf"
+    "${XDG_CONFIG_HOME}/@cfgdirname@/@appname@-flags.conf"
+)
+
 declare -a flags
-if [[ -f "${_FLAGS_FILE}" ]]; then
-    mapfile -t < "${_FLAGS_FILE}"
-fi
-for line in "${MAPFILE[@]}"; do
-    if [[ ! "${line}" =~ ^[[:space:]]*#.* ]] && [[ -n "${line}" ]]; then
-        flags+=("${line}")
-    fi
-done
-_WAYLAND_OPTION=false
-for arg in "$@"; do
-    if [[ "${arg}" == "--wayland" ]]; then
-        _WAYLAND_OPTION=true
-        break
+for _FLAGS_FILE in "${_FLAG_SOURCES[@]}"; do
+    if [[ -f "${_FLAGS_FILE}" ]]; then
+        echo "Loading flags from ${_FLAGS_FILE}"
+        while read -r line || [[ -n "$line" ]]; do
+            [[ "${line}" =~ ^[[:space:]]*#.* ]] || [[ -z "${line}" ]] || {
+                read -ra line_flags <<< "$line"
+                flags+=("${line_flags[@]}")
+            }
+        done < "${_FLAGS_FILE}"
     fi
 done
-if [[ "${_WAYLAND_OPTION}" == true ]]; then
-    echo "Forcing Wayland"
-    flags+=("--enable-features=UseOzonePlatform,WaylandWindowDecorations,VaapiVideoDecodeLinuxGL" "--ozone-platform=wayland")
+
+# 4. Sandbox and Execution Permissions
+# Disable sandbox if running as root without ELECTRON_RUN_AS_NODE
+_SANDBOX_ARG=()
+if [[ "${EUID}" -eq 0 ]] && [[ "${ELECTRON_RUN_AS_NODE}" != "1" ]]; then
+    _SANDBOX_ARG=("--no-sandbox")
 fi
+
 cd "${_APPDIR}"
-if [[ "${EUID}" -ne 0 ]] || [[ "${ELECTRON_RUN_AS_NODE}" ]]; then
-    exec electron@electronversion@ "${_RUNNAME}" "${_OPTIONS}" "${flags[@]}" "$@" || exit $?
-else
-    exec electron@electronversion@ "${_RUNNAME}" "${_OPTIONS}" --no-sandbox "${flags[@]}" "$@" || exit $?
-fi
\ No newline at end of file
+exec electron@electronversion@ "${flags[@]}" "${_SANDBOX_ARG[@]}" "${_RUNNAME}" "$@"
\ No newline at end of file