acheron-nightly

MEDIUM

maintainer Cleboost 0 votes scanned 2026-08-27 09:33:21.393967

View on AUR

Why flagged

Installs a prebuilt AppImage binary from nightly.link (a CI artifact redirect service for GitHub Actions), which is a legitimate but unofficial/unverifiable build artifact; the checksum is pinned so swapping is mitigated, but the binary is not from the project's own official release infrastructure and could change on any new build run.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source=("acheron-nightly-${pkgver}.zip::https://nightly.link/ouwou/acheron/workflows/build/master/acheron-appimage.zip" "acheron.desktop::https://raw.githubusercontent.com/Cleboost/missing-aur/main/packages/acheron/acheron.desktop" "acheron.png::https://raw.githubusercontent.com/Cleboost/missing-aur/main/packages/acheron/acheron.png")

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 75%): Installs a prebuilt AppImage binary from nightly.link (a CI artifact redirect service for GitHub Actions), which is a legitimate but unofficial/unverifiable build artifact; the checksum is pinned so swapping is mitigated, but the binary is not from the project's own official release infrastructure and could change on any new build run.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Cleboost <clement.balarot@gmail.com>
    
      2# Contributor: missing-aur project <https://github.com/Cleboost/missing-aur>
    
      3
    
      4pkgname=acheron-nightly
    
      5pkgver=2026.08.27_5f7293b
    
      6pkgrel=1
    
      7pkgdesc="Alternative Discord client made in C++ with Qt 6"
    
      8url="https://github.com/ouwou/acheron"
    
      9arch=("x86_64")
    
      10depends=("fuse2")
    
      11provides=("acheron")
    
      12conflicts=("acheron" "acheron-git")
    
      13options=("!strip")
    
      14license=("GPL-3.0")
    
      15
    
      16source=("acheron-nightly-${pkgver}.zip::https://nightly.link/ouwou/acheron/workflows/build/master/acheron-appimage.zip" "acheron.desktop::https://raw.githubusercontent.com/Cleboost/missing-aur/main/packages/acheron/acheron.desktop" "acheron.png::https://raw.githubusercontent.com/Cleboost/missing-aur/main/packages/acheron/acheron.png")
    
      17sha256sums=('637e1967e89566560905bc29d94de416233dd7d1e577a3c6d5744c99d2c45499'
    
      18            '22348420fd0e6cce6c9cf24c1ba9f4498d27b1ed169a0e38d88a0ef6a379f8e6'
    
      19            '3109929ab2009c8ceab6d2678492e0a0cccfd058726439e7f109a79ff9f85e84')
    
      20
    
      21prepare() {
    
      22  chmod +x "${srcdir}/Acheron-x86_64.AppImage"
    
      23}
    
      24
    
      25package() {
    
      26  install -Dm755 "${srcdir}/Acheron-x86_64.AppImage" "${pkgdir}/opt/acheron-nightly/acheron.AppImage"
    
      27  install -dm755 "${pkgdir}/usr/bin"
    
      28  ln -sf "/opt/acheron-nightly/acheron.AppImage" "${pkgdir}/usr/bin/acheron"
    
      29  install -Dm644 "${srcdir}/acheron.png" "${pkgdir}/usr/share/icons/hicolor/512x512/apps/acheron.png"
    
      30  install -Dm644 "${srcdir}/acheron.desktop" "${pkgdir}/usr/share/applications/acheron.desktop"
    
      31}
    
      32
    
      33

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-27 09:33:21	Medium	3
2026-08-27 09:31:53	Medium	3