ait-bin

MEDIUM

maintainer oowl 0 votes scanned 2026-10-17 00:21:55.226236

View on AUR

Why flagged

The package installs an unverifiable prebuilt AppImage from a GitHub release, which could be swapped by a malicious actor; while the source is from the project's official repository, the binary nature of the AppImage and lack of reproducible build raises supply-chain risk.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package installs an unverifiable prebuilt AppImage from a GitHub release, which could be swapped by a malicious actor; while the source is from the project's official repository, the binary nature of the AppImage and lack of reproducible build raises supply-chain risk.

PKGBUILD

      1# Maintainer: Ait contributors <https://github.com/ait-app/ait>
    
      2
    
      3pkgname=ait-bin
    
      4pkgver=0.1.2
    
      5pkgrel=1
    
      6pkgdesc='Local-first multi-agent manager with an Electron desktop and Rust daemon'
    
      7arch=('x86_64')
    
      8url='https://github.com/ait-app/ait'
    
      9license=('Apache-2.0')
    
      10depends=(
    
      11  'alsa-lib' 'at-spi2-core' 'bash' 'cairo' 'coreutils' 'dbus' 'expat'
    
      12  'libgcc' 'libstdc++' 'git' 'glib2' 'glibc' 'grep' 'gtk3' 'hicolor-icon-theme'
    
      13  'libcups' 'libnotify' 'libxcb' 'libxcomposite' 'libxdamage' 'libxext'
    
      14  'libxfixes' 'libxkbcommon' 'libxrandr' 'libx11' 'mesa' 'nspr' 'nss'
    
      15  'pango' 'systemd-libs' 'util-linux' 'xdg-utils'
    
      16)
    
      17optdepends=(
    
      18  'libsecret: desktop credential storage'
    
      19  'org.freedesktop.secrets: Secret Service provider for credential storage'
    
      20)
    
      21provides=("ait=${pkgver}")
    
      22conflicts=('ait')
    
      23options=('!strip' '!debug')
    
      24_appimage="Ait-${pkgver}-linux-x86_64.AppImage"
    
      25source=(
    
      26  "${_appimage}::${url}/releases/download/v${pkgver}/Ait-linux-x86_64.AppImage"
    
      27  'ait.desktop'
    
      28)
    
      29noextract=("${_appimage}")
    
      30sha256sums=(
    
      31  '17ab96cc24ab9176fb778b582da4d2c14f47ae036d7c6b1c873f70fe9b7320e4'
    
      32  'c046b482bf9d9ba6ce161a6b242fa506798e908b5b5dfbf5e27776558e803cc0'
    
      33)
    
      34
    
      35prepare() {
    
      36  chmod +x "${_appimage}"
    
      37  "./${_appimage}" --appimage-extract > /dev/null
    
      38  # The AppImage extractor can create private directories under the user's umask.
    
      39  chmod -R a+rX squashfs-root
    
      40}
    
      41
    
      42package() {
    
      43  local app="${srcdir}/squashfs-root"
    
      44  local icon size
    
      45
    
      46  install -dm755 "${pkgdir}/usr/lib/ait" "${pkgdir}/usr/bin"
    
      47  cp -a --no-preserve=ownership "${app}/." "${pkgdir}/usr/lib/ait/"
    
      48  # Use Arch's system libraries and desktop integration, keeping Electron's runtime.
    
      49  rm -r "${pkgdir}/usr/lib/ait/"{AppRun,Ait.desktop,Ait.png,.DirIcon,usr}
    
      50  # Provide Chromium's sandbox fallback when user namespaces are unavailable.
    
      51  chmod 4755 "${pkgdir}/usr/lib/ait/chrome-sandbox"
    
      52  ln -s /usr/lib/ait/Ait "${pkgdir}/usr/bin/ait"
    
      53
    
      54  install -Dm644 "${srcdir}/ait.desktop" \
    
      55    "${pkgdir}/usr/share/applications/ait.desktop"
    
      56  for icon in "${app}/usr/share/icons/hicolor/"*/apps/Ait.png; do
    
      57    size="${icon%/apps/*}"
    
      58    size="${size##*/}"
    
      59    install -Dm644 "${icon}" \
    
      60      "${pkgdir}/usr/share/icons/hicolor/${size}/apps/ait.png"
    
      61  done
    
      62  install -dm755 "${pkgdir}/usr/share/licenses/${pkgname}"
    
      63  ln -s /usr/lib/ait/LICENSE.electron.txt \
    
      64    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.electron.txt"
    
      65  ln -s /usr/lib/ait/LICENSES.chromium.html \
    
      66    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSES.chromium.html"
    
      67}
    
      68

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-17 00:21:55	Medium	2
2026-10-16 00:12:47	Medium	2
2026-10-15 00:28:05	Medium	2
2026-10-14 17:20:19	Medium	2