acheron-nightly

MEDIUM

maintainer Cleboost 0 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

The package downloads a prebuilt AppImage from a non-standard host (nightly.link), which is an unverifiable executable artifact that could be silently swapped, posing a supply-chain risk despite checksum verification.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source=("acheron-nightly-${pkgver}.zip::https://nightly.link/ouwou/acheron/workflows/build/master/acheron-appimage.zip" "acheron.desktop::https://raw.githubusercontent.com/Cleboost/missing-aur/main/packages/acheron/acheron.desktop" "acheron.png::https://raw.githubusercontent.com/Cleboost/missing-aur/main/packages/acheron/acheron.png")

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt AppImage from a non-standard host (nightly.link), which is an unverifiable executable artifact that could be silently swapped, posing a supply-chain risk despite checksum verification.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Cleboost <clement.balarot@gmail.com>
    
      2# Contributor: missing-aur project <https://github.com/Cleboost/missing-aur>
    
      3
    
      4pkgname=acheron-nightly
    
      5pkgver=2026.09.21_e2f35d4
    
      6pkgrel=1
    
      7pkgdesc="Alternative Discord client made in C++ with Qt 6"
    
      8url="https://github.com/ouwou/acheron"
    
      9arch=("x86_64")
    
      10depends=("fuse2")
    
      11provides=("acheron")
    
      12conflicts=("acheron" "acheron-git")
    
      13options=("!strip")
    
      14license=("GPL-3.0")
    
      15
    
      16source=("acheron-nightly-${pkgver}.zip::https://nightly.link/ouwou/acheron/workflows/build/master/acheron-appimage.zip" "acheron.desktop::https://raw.githubusercontent.com/Cleboost/missing-aur/main/packages/acheron/acheron.desktop" "acheron.png::https://raw.githubusercontent.com/Cleboost/missing-aur/main/packages/acheron/acheron.png")
    
      17sha256sums=('51281accd5034c5b191a3fb43ad5dfdfcc4cec85bba833760f52ac4cdf6c1bf9'
    
      18            '22348420fd0e6cce6c9cf24c1ba9f4498d27b1ed169a0e38d88a0ef6a379f8e6'
    
      19            '3109929ab2009c8ceab6d2678492e0a0cccfd058726439e7f109a79ff9f85e84')
    
      20
    
      21prepare() {
    
      22  chmod +x "${srcdir}/Acheron-x86_64.AppImage"
    
      23}
    
      24
    
      25package() {
    
      26  install -Dm755 "${srcdir}/Acheron-x86_64.AppImage" "${pkgdir}/opt/acheron-nightly/acheron.AppImage"
    
      27  install -dm755 "${pkgdir}/usr/bin"
    
      28  ln -sf "/opt/acheron-nightly/acheron.AppImage" "${pkgdir}/usr/bin/acheron"
    
      29  install -Dm644 "${srcdir}/acheron.png" "${pkgdir}/usr/share/icons/hicolor/512x512/apps/acheron.png"
    
      30  install -Dm644 "${srcdir}/acheron.desktop" "${pkgdir}/usr/share/applications/acheron.desktop"
    
      31}
    
      32
    
      33

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Medium	2
2026-10-16 00:12:47	Medium	2
2026-10-15 00:28:05	Medium	2
2026-10-14 00:06:47	Medium	2
2026-10-13 00:23:45	Medium	2
2026-10-12 00:18:51	Medium	2
2026-10-11 00:26:05	Medium	2
2026-10-10 00:11:52	Medium	2
2026-10-09 00:05:33	Medium	2
2026-10-08 00:28:03	Medium	2
2026-10-07 00:21:34	Medium	2
2026-10-06 00:13:36	Medium	2
2026-10-05 00:08:03	Medium	2
2026-10-04 00:18:08	Medium	2
2026-10-03 00:23:04	Medium	2
2026-10-02 00:00:32	Medium	2
2026-10-01 00:02:06	Medium	2
2026-09-30 00:20:07	Medium	2
2026-09-29 00:07:46	Medium	2
2026-09-28 00:28:32	Medium	2