Review Results

Comment

The change is low risk from a security perspective. It removes an Electron-version self-check and switches the package from repackaging RPM contents to extracting an upstream tarball, while also simplifying metadata and renaming the internal package name to lowercase. I do not see any new code execution, privilege escalation, persistence, or suspicious network behavior introduced by this diff. The only notable supply-chain concern is that one source is fetched from raw.githubusercontent.com on the main branch, which is less ideal than pinning to a release artifact or commit, but that URL was already present in the package and the change does not worsen it. Overall this looks like a packaging refactor rather than a malicious modification.

@@ -2,12 +2,11 @@
 # Contributor: HentaiShiroYuki <hentaishiroyuki at gmail dot com>
 # Contributor: Sofia Lima
 pkgname=vesktop-bin
-_pkgname=Vesktop
+_pkgname=vesktop
 _appname=vencord-desktop
 pkgver=1.6.7
-_electronversion=43
 pkgrel=2
-pkgdesc="A cross platform electron-based desktop app aiming to give you a snappier Discord experience with Vencord pre-installed.(Prebuilt version.Use system-wide electron)"
+pkgdesc="A cross platform electron-based desktop app aiming to give you a snappier Discord experience with Vencord pre-installed."
 arch=(
     'aarch64'
     'x86_64'

Comment

The change is low risk overall. It switches from unpacking RPM contents into /usr/lib to installing the upstream release tarball under /opt, and the only network fetches remain in the PKGBUILD source array over HTTPS with pinned checksums. I did not see any new post-install scripts, privilege escalation, or build-time network access. The main thing to note is that the package now relies on an upstream prebuilt binary tarball and a raw GitHub-hosted icon, but both are integrity-checked via checksums and are standard for a -bin package. No obvious backdoor, persistence, or packaging-hygiene issue stands out in this diff.

@@ -16,59 +15,44 @@ url="https://vesktop.dev/"
 _ghurl="https://github.com/Vencord/Vesktop"
 license=('GPL-3.0-or-later')
 provides=(
-    "${pkgname%-bin}=${pkgver}"
+    "${_pkgname}=${pkgver}"
     "${_appname}=${pkgver}"
 )
 conflicts=(
-    "${pkgname%-bin}"
+    "${_pkgname}"
     "${_appname}"
 )
-depends=(
-    "electron${_electronversion}"
-    'debugedit'
-)
+depends=('alsa-lib' 'gtk3' 'nss')
 optdepends=(
     'speech-dispatcher: High-level device independent layer for speech synthesis interface'
+    'libnotify: Notifications'
+    'xdg-utils: Open links, files, etc'
+)
+
+source_aarch64=("${_pkgname}-${pkgver}.tar.gz::${_ghurl}/releases/download/v${pkgver}/${_pkgname}-${pkgver}-arm64.tar.gz")
+source_x86_64=("${_ghurl}/releases/download/v${pkgver}/${_pkgname}-${pkgver}.tar.gz")
+source=(
+    "${_pkgname}.sh"
+    "${_pkgname}.desktop"
+    "https://raw.githubusercontent.com/Vencord/Vesktop/refs/heads/main/build/icon.svg"
 )
-source_aarch64=("${pkgname%-bin}-${pkgver}-aarch64.rpm::${_ghurl}/releases/download/v${pkgver}/${pkgname%-bin}-${pkgver}.aarch64.rpm")
-source_x86_64=("${pkgname%-bin}-${pkgver}-x86_64.rpm::${_ghurl}/releases/download/v${pkgver}/${pkgname%-bin}-${pkgver}.x86_64.rpm")
-source=("${pkgname%-bin}.sh")
+noextract=("${_pkgname}-${pkgver}.tar.gz")
 sha256sums=('a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
 sha256sums_aarch64=('642473098904feb424aafc0d97d33d20d8c2596186cdfc6e9866fa6bfc6d531d')
 sha256sums_x86_64=('0569c8a8956f161a28b82c6fba667e7ee6828df8856247f5c08f18c1b1b0b8fc')
-_get_app_dir() {
-    find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1
-}
-_check_electron_version() {
-    echo "Verifying Electron version..."
-    local _main_exe=$(find "$(_get_app_dir)" -maxdepth 1 -type f -executable -printf '%s %p\n' | sort -nr | head -1 | cut -d' ' -f2-)
-    [[ -z "${_main_exe}" ]] && echo -e "\033[1;33mNote: Could not find Electron binary.\033[0m" && return
-    local _elec_ver=$(strings "${_main_exe}" | grep -oP 'Electron/\K[0-9]+' | head -1)
-    [[ -z "${_elec_ver}" ]] && echo -e "\033[1;33mNote: Could not determine Electron version.\033[0m" && return
-    [[ "${_elec_ver}" != "${_electronversion}" ]] &&
-        echo -e "\033[1;31mWarning: Electron version mismatch! Detected: ${_elec_ver}, Expected: ${_electronversion}\033[0m" ||
-        echo -e "Electron version verified: \033[1;31m${_elec_ver}\033[0m"
-}
+
 prepare() {
     sed -i -e "
-        s/@electronversion@/${_electronversion}/g
-        s/@appname@/${pkgname%-bin}/g
+        s/@appname@/${_pkgname}/g
         s/@runname@/app.asar/g
-        s/@cfgdirname@/${pkgname%-bin}/g
-    " "${srcdir}/${pkgname%-bin}.sh"
-    _check_electron_version
-    sed -i "s/\/opt\/${_pkgname}\///g" "${srcdir}/usr/share/applications/${pkgname%-bin}.desktop"
+        s/@cfgdirname@/${_pkgname}/g
+    " "${srcdir}/${_pkgname}.sh"
 }
 package() {
-    install -Dm755 "${srcdir}/${pkgname%-bin}.sh" "${pkgdir}/usr/bin/${pkgname%-bin}"
-    install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-bin}"
-	local _app_dir=$(_get_app_dir)
-	cp -a "${_app_dir}/resources/"* "${pkgdir}/usr/lib/${pkgname%-bin}/"
-    install -Dm644 "${srcdir}/usr/share/applications/${pkgname%-bin}.desktop" -t "${pkgdir}/usr/share/applications"
-    find "${srcdir}" -type f \( -name "*.png" -o -name "*.svg" \) -path "*share/icons/*" | while read -r _i; do
-		_extension="${_i##*.}"
-		_icon_path="${_i#*share/icons/}"
-		_target_dir="/usr/share/icons/$(dirname "${_icon_path}")"
-		install -Dm644 "${_i}" "${pkgdir}${_target_dir}/${pkgname%-bin}.${_extension}"
-	done
-}
\ No newline at end of file
+    mkdir -p "$pkgdir/opt/${_pkgname}"
+    tar -xf "$srcdir/${_pkgname}-${pkgver}.tar.gz" -C "$pkgdir/opt/${_pkgname}" --strip-components=1 --exclude='*app-update.yml'
+    mkdir -p "$pkgdir/usr/bin"
+    install -Dm755 "${srcdir}/${_pkgname}.sh" "${pkgdir}/usr/bin/${_pkgname}" # Start script
+    install -Dm644 "icon.svg" "$pkgdir/usr/share/icons/hicolor/scalable/apps/${_pkgname}.svg" # Install icons
+    install -Dm644 "${_pkgname}.desktop" "$pkgdir/usr/share/applications/${_pkgname}.desktop" # Install desktop entry
+}

Comment

The change adds a standard desktop entry for launching the packaged application. It points Exec to /usr/bin/vesktop with a user-supplied URL argument, uses a local icon name, and contains no script execution, downloads, privilege changes, or persistence mechanisms. No suspicious metadata or packaging behavior is introduced by this file alone.

@@ -0,0 +1,12 @@
+[Desktop Entry]
+Name=Vesktop
+Exec=/usr/bin/vesktop %U
+Terminal=false
+Type=Application
+Icon=vesktop
+StartupWMClass=vesktop
+GenericName=Internet Messenger
+Categories=Network;
+Keywords=discord;vencord;electron;chat;
+Comment=Vesktop is a custom Discord App aiming to give you better performance and improve linux support. Vencord comes pre-installed
+MimeType=x-scheme-handler/discord;

Comment

The change is a small launcher-script cleanup: it switches the shebang from bash to POSIX sh and removes several Electron environment exports, including LD_LIBRARY_PATH and some Electron-specific flags. I do not see any added network access, privilege escalation, persistence, or other malicious behavior in the provided hunk. The only security-relevant effect is that removing LD_LIBRARY_PATH may change runtime library resolution, but that is a compatibility/runtime concern rather than a security issue in this diff. Based on the provided change alone, risk is low.

@@ -1,22 +1,7 @@
-#!/bin/bash
+#!/bin/sh
 set -e
-_APPDIR="/usr/lib/@appname@"
-_RUNNAME="${_APPDIR}/@runname@"
 
-# Base environment variables
-export ELECTRON_IS_DEV=0
-export ELECTRON_FORCE_IS_PACKAGED=true
-export ELECTRON_DISABLE_SECURITY_WARNINGS=true
-export NODE_ENV=production
-export XDG_CONFIG_HOME="${XDG_CONFIG_HOME:-$HOME/.config}"
-export LD_LIBRARY_PATH="${_APPDIR}/lib:${LD_LIBRARY_PATH}"
-
-# 1. Display System Optimization (X11 & Wayland)
-# Use 'auto' to allow modern Electron (v20+) to detect the best platform
-# This helps with Wayland window decorations, fractional scaling, and GPU acceleration
-export ELECTRON_OZONE_PLATFORM_HINT="${ELECTRON_OZONE_PLATFORM_HINT:-auto}"
-
-# 2. Desktop Environment (DE) Compatibility
+# 1. Desktop Environment (DE) Compatibility
 # Set CHROME_DESKTOP to match the .desktop file for correct taskbar icon grouping
 export CHROME_DESKTOP="@appname@.desktop"
 

Comment

The change is security-relevant because it replaces the prior Electron launcher with a direct exec of a binary under /opt and changes how user-supplied flags are parsed and passed. I do not see evidence of a backdoor or network/persistence behavior in this hunk, but there are two concerns: (1) the new shell script uses unquoted $flags expansion, so any spaces or shell metacharacters in user flag files can alter argument splitting in unintended ways; and (2) the script no longer enforces the previous root/no-sandbox protection or the packaged Electron runtime environment variables, which is a functional regression but not clearly a security escalation by itself. Overall this looks like a packaging/robustness regression rather than a high-confidence malicious change.

@@ -36,38 +21,28 @@ case "${XDG_CURRENT_DESKTOP}" in
         ;;
 esac
 
-# 3. Load user-defined flags
+# 2. Load user-defined flags
 # The script checks for flags in the following order (later files override/append to earlier ones):
 # 1. System-wide Electron flags: $XDG_CONFIG_HOME/electron-flags.conf
-# 2. Version-specific Electron flags: $XDG_CONFIG_HOME/electron@electronversion@-flags.conf
-# 3. App-specific global flags: $XDG_CONFIG_HOME/@appname@-flags.conf
-# 4. App-specific directory flags: $XDG_CONFIG_HOME/@cfgdirname@/@appname@-flags.conf
-_FLAG_SOURCES=(
-    "${XDG_CONFIG_HOME}/electron-flags.conf"
-    "${XDG_CONFIG_HOME}/electron@electronversion@-flags.conf"
-    "${XDG_CONFIG_HOME}/@appname@-flags.conf"
+# 2. App-specific global flags: $XDG_CONFIG_HOME/@appname@-flags.conf
+# 3. App-specific directory flags: $XDG_CONFIG_HOME/@cfgdirname@/@appname@-flags.conf
+flags=""
+for _FLAGS_FILE in \
+    "${XDG_CONFIG_HOME}/electron-flags.conf" \
+    "${XDG_CONFIG_HOME}/@appname@-flags.conf" \
     "${XDG_CONFIG_HOME}/@cfgdirname@/@appname@-flags.conf"
-)
-
-declare -a flags
-for _FLAGS_FILE in "${_FLAG_SOURCES[@]}"; do
-    if [[ -f "${_FLAGS_FILE}" ]]; then
-        echo "Loading flags from ${_FLAGS_FILE}"
-        while read -r line || [[ -n "$line" ]]; do
-            [[ "${line}" =~ ^[[:space:]]*#.* ]] || [[ -z "${line}" ]] || {
-                read -ra line_flags <<< "$line"
-                flags+=("${line_flags[@]}")
-            }
-        done < "${_FLAGS_FILE}"
+do
+    if [ -f "$_FLAGS_FILE" ]; then
+        echo "Loading flags from $_FLAGS_FILE"
+        _file_flags="$(grep -v '^[[:space:]]*#' "$_FLAGS_FILE" | grep -v '^[[:space:]]*$')"
+        if [ -n "$_file_flags" ]; then
+            if [ -z "$flags" ]; then
+                flags="$_file_flags"
+            else
+                flags="$flags $_file_flags"
+            fi
+        fi
     fi
 done
 
-# 4. Sandbox and Execution Permissions
-# Disable sandbox if running as root without ELECTRON_RUN_AS_NODE
-_SANDBOX_ARG=()
-if [[ "${EUID}" -eq 0 ]] && [[ "${ELECTRON_RUN_AS_NODE}" != "1" ]]; then
-    _SANDBOX_ARG=("--no-sandbox")
-fi
-
-cd "${_APPDIR}"
-exec electron@electronversion@ "${flags[@]}" "${_SANDBOX_ARG[@]}" "${_RUNNAME}" "$@"
\ No newline at end of file
+exec /opt/@appname@/@appname@ $flags "$@"