Claude Desktop
Claude desktop for Linux (beta)
beta
Claude Desktop uses an independently maintained Flatpak wrapper. The proprietary Linux package is downloaded directly from its vendor during installation; this remote does not redistribute the app binaries.
Proprietary application; wrapper-only extra-data delivery. Not vendor official. No binary redistribution right is claimed.
The application downloads directly from its vendor during installation. The signed remote supplies its wrapper and pinned download identity.
Install
flatpak --user remote-add --if-not-exists thepeoples \
https://flatpak.thepeoples.io/thepeoples.flatpakrepo
flatpak --user install -y thepeoples io.thepeoples.Claude
flatpak --user install -y thepeoples io.thepeoples.Claude//4.23118.1Optional system install uses sudo flatpak remote-add --if-not-exists --system and sudo flatpak install -y --system. The //version form pins the advertised ostree branch; stable tracks the latest advertised tree.
Verify
- App id
io.thepeoples.Claude, vendor Anthropic, version4.23118.1, license proprietary - Channel beta
- Download 182.9 MB · installed 8.7 MB
- sha256
b09ccdd72b38916c9637d48548db70e77c425eb2e09bb467465409d2ff9d287a - Ostree key fingerprint
98D786877B6C4E8C6889CBD2E75B1C5B0CB2D841 - Vendor key fingerprint
31DDDE24DDFAB679F42D7BD2BAA929FF1A7ECACE - Homepage https://claude.ai/
Input scan
Pinned deb claude-desktop_4.23118.1_amd64.deb, extracted without install scripts, scanned before wrap. 2026-11-10 23:17 UTC · trivy 0.73.0 · vuln DB 2026-11-10.
Wrap
Layers this remote adds. Gate fails on CRITICAL.
none
gate pass
Vendor
In the upstream package. Not patched here.
1 HIGH · 1 MEDIUM
Vendor findings 2 · 1 HIGH · 1 MEDIUM
| Severity | ID | Package | Installed | Fixed | Title |
|---|---|---|---|---|---|
| HIGH | CVE-2026-48779 | ws | 8.18.0 | 5.2.5, 6.2.4, 7.5.11, 8.21.0 | ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments |
| MEDIUM | CVE-2026-45736 | ws | 8.18.0 | 8.20.1 | ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray` |
Previous scans
Daily Trivy refresh. Current report plus the last 14 full scans; older copies are deleted.