akiflow-bin

maintainer shrimpwtf · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged Two distinct supply-chain concerns exist here. First, the Windows installer (Akiflow.exe) is downloaded from download.akiflow.com, which is the official vendor CDN — not an unofficial host — so that part is actually fine, and the sha512 checksum is provided. Second, and more seriously, a Python script (patch-main.py) is fetched from a personal GitHub repository (shrimpwtf/akiflow-arch) with 'SKIP' for its checksum, and this script is then executed during the build phase to patch app.asar. All other auxiliary files (QML widget files, PNG, JSON) also use 'SKIP'. The executed patch-main.py from an unverified personal repo with no integrity check is a genuine supply-chain risk: the maintainer can silently change the script at any time to execute arbitrary code during the build. This is a real medium-severity concern — not a false positive — because it is an executed script from an unofficial personal host with no checksum verification.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source=("Akiflow-${pkgver}.exe::https://download.akiflow.com/builds/Akiflow-${pkgver}-${_buildhash}-x64.exe"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 78%): Two distinct supply-chain concerns exist here. First, the Windows installer (Akiflow.exe) is downloaded from download.akiflow.com, which is the official vendor CDN — not an unofficial host — so that part is actually fine, and the sha512 checksum is provided. Second, and more seriously, a Python script (patch-main.py) is fetched from a personal GitHub repository (shrimpwtf/akiflow-arch) with 'SKIP' for its checksum, and this script is then executed during the build phase to patch app.asar. All other auxiliary files (QML widget files, PNG, JSON) also use 'SKIP'. The executed patch-main.py from an unverified personal repo with no integrity check is a genuine supply-chain risk: the maintainer can silently change the script at any time to execute arbitrary code during the build. This is a real medium-severity concern — not a false positive — because it is an executed script from an unofficial personal host with no checksum verification.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: shrimp
    
      2# Akiflow Desktop for Linux (unofficial)
    
      3
    
      4pkgname=akiflow-bin
    
      5pkgver=2.72.5
    
      6pkgrel=1
    
      7_buildhash=7536ef84
    
      8pkgdesc="Akiflow - Time blocking and task management (unofficial Linux build)"
    
      9arch=('x86_64')
    
      10url="https://akiflow.com"
    
      11license=('custom')
    
      12depends=('electron')
    
      13makedepends=('p7zip' 'imagemagick' 'icoutils' 'python')
    
      14_ghraw="https://raw.githubusercontent.com/shrimpwtf/akiflow-arch/main"
    
      15source=("Akiflow-${pkgver}.exe::https://download.akiflow.com/builds/Akiflow-${pkgver}-${_buildhash}-x64.exe"
    
      16        "patch-main.py::${_ghraw}/patch-main.py"
    
      17        "plasma-widget-metadata.json::${_ghraw}/plasma-widget/package/metadata.json"
    
      18        "plasma-widget-main.qml::${_ghraw}/plasma-widget/package/contents/ui/main.qml"
    
      19        "plasma-widget-CompactRepresentation.qml::${_ghraw}/plasma-widget/package/contents/ui/CompactRepresentation.qml"
    
      20        "plasma-widget-FullRepresentation.qml::${_ghraw}/plasma-widget/package/contents/ui/FullRepresentation.qml"
    
      21        "plasma-widget-akiflow.png::${_ghraw}/plasma-widget/package/contents/icons/akiflow.png")
    
      22sha512sums=('e4aeadcf7ec8a2a9c46dda84fe59d1cf38898808f891d28f98c73c8e1514d61051f4fa19215774c56c5c297befddefce4f8e55a6ec9bc92ed5d6a8b59c5a155d'
    
      23            'SKIP'
    
      24            'SKIP'
    
      25            'SKIP'
    
      26            'SKIP'
    
      27            'SKIP'
    
      28            'SKIP')
    
      29
    
      30prepare() {
    
      31    cd "${srcdir}"
    
      32
    
      33    # Extract the NSIS installer
    
      34    7z x -y "Akiflow-${pkgver}.exe" -oextracted
    
      35
    
      36    # Extract icons from exe if present
    
      37    if [ -f "extracted/\$PLUGINSDIR/app-64.7z" ]; then
    
      38        7z x -y "extracted/\$PLUGINSDIR/app-64.7z" -oapp
    
      39    else
    
      40        # Fallback: the app might be directly in extracted
    
      41        cp -r extracted app 2>/dev/null || true
    
      42    fi
    
      43
    
      44    # Try to extract icon
    
      45    if [ -f "app/Akiflow.exe" ]; then
    
      46        wrestool -x -t 14 app/Akiflow.exe -o akiflow.ico 2>/dev/null || true
    
      47    elif [ -f "extracted/Akiflow.exe" ]; then
    
      48        wrestool -x -t 14 extracted/Akiflow.exe -o akiflow.ico 2>/dev/null || true
    
      49    fi
    
      50
    
      51    # Convert ico to png if we got one
    
      52    if [ -f "akiflow.ico" ]; then
    
      53        icotool -x akiflow.ico 2>/dev/null || true
    
      54        mkdir -p icons/hicolor
    
      55        for size in 16 24 32 48 64 128 256; do
    
      56            icon_file=$(ls akiflow_*"${size}x${size}"*.png 2>/dev/null | head -1)
    
      57            if [ -n "$icon_file" ]; then
    
      58                mkdir -p "icons/hicolor/${size}x${size}/apps"
    
      59                cp "$icon_file" "icons/hicolor/${size}x${size}/apps/akiflow.png"
    
      60            fi
    
      61        done
    
      62    fi
    
      63}
    
      64
    
      65_find_asar() {
    
      66    if [ -f "${srcdir}/app/resources/app.asar" ]; then
    
      67        echo "${srcdir}/app/resources"
    
      68    elif [ -f "${srcdir}/extracted/resources/app.asar" ]; then
    
      69        echo "${srcdir}/extracted/resources"
    
      70    else
    
      71        dirname "$(find "${srcdir}" -name 'app.asar' -type f | head -1)"
    
      72    fi
    
      73}
    
      74
    
      75build() {
    
      76    # Patch app.asar to write tray status for the KDE Plasma widget
    
      77    ASAR_PATH="$(_find_asar)"
    
      78    if [ -z "$ASAR_PATH" ] || [ ! -f "$ASAR_PATH/app.asar" ]; then
    
      79        echo "ERROR: Could not find app.asar"
    
      80        exit 1
    
      81    fi
    
      82
    
      83    cd "$ASAR_PATH"
    
      84    python "${srcdir}/patch-main.py"
    
      85}
    
      86
    
      87package() {
    
      88    ASAR_PATH="$(_find_asar)"
    
      89    if [ -z "$ASAR_PATH" ] || [ ! -f "$ASAR_PATH/app.asar" ]; then
    
      90        echo "ERROR: Could not find app.asar"
    
      91        exit 1
    
      92    fi
    
      93
    
      94    # Install app files
    
      95    install -d "${pkgdir}/usr/lib/${pkgname}"
    
      96    cp "$ASAR_PATH/app.asar" "${pkgdir}/usr/lib/${pkgname}/"
    
      97
    
      98    # Copy unpacked resources if they exist
    
      99    if [ -d "$ASAR_PATH/app.asar.unpacked" ]; then
    
      100        cp -r "$ASAR_PATH/app.asar.unpacked" "${pkgdir}/usr/lib/${pkgname}/"
    
      101    fi
    
      102
    
      103    # Install icons if we extracted them
    
      104    if [ -d "${srcdir}/icons/hicolor" ]; then
    
      105        install -d "${pkgdir}/usr/share/icons"
    
      106        cp -r "${srcdir}/icons/"* "${pkgdir}/usr/share/icons/"
    
      107    fi
    
      108
    
      109    # Create desktop file
    
      110    install -Dm644 /dev/stdin "${pkgdir}/usr/share/applications/${pkgname}.desktop" <<EOF
    
      111[Desktop Entry]
    
      112Name=Akiflow
    
      113GenericName=Task Management
    
      114Comment=Time blocking and task management
    
      115Exec=${pkgname} %u
    
      116Icon=akiflow
    
      117Type=Application
    
      118Terminal=false
    
      119Categories=Office;ProjectManagement;Calendar;
    
      120MimeType=x-scheme-handler/akiflow;
    
      121StartupWMClass=Akiflow
    
      122EOF
    
      123
    
      124    # Create launcher script
    
      125    install -Dm755 /dev/stdin "${pkgdir}/usr/bin/${pkgname}" <<EOF
    
      126#!/bin/sh
    
      127exec electron --class=Akiflow --name=Akiflow /usr/lib/${pkgname}/app.asar "\$@"
    
      128EOF
    
      129
    
      130    # Install KDE Plasma widget for upcoming events
    
      131    install -d "${pkgdir}/usr/share/plasma/plasmoids/com.akiflow.panelwidget/contents/ui"
    
      132    install -d "${pkgdir}/usr/share/plasma/plasmoids/com.akiflow.panelwidget/contents/icons"
    
      133    install -Dm644 "${srcdir}/plasma-widget-metadata.json" \
    
      134        "${pkgdir}/usr/share/plasma/plasmoids/com.akiflow.panelwidget/metadata.json"
    
      135    install -Dm644 "${srcdir}/plasma-widget-main.qml" \
    
      136        "${pkgdir}/usr/share/plasma/plasmoids/com.akiflow.panelwidget/contents/ui/main.qml"
    
      137    install -Dm644 "${srcdir}/plasma-widget-CompactRepresentation.qml" \
    
      138        "${pkgdir}/usr/share/plasma/plasmoids/com.akiflow.panelwidget/contents/ui/CompactRepresentation.qml"
    
      139    install -Dm644 "${srcdir}/plasma-widget-FullRepresentation.qml" \
    
      140        "${pkgdir}/usr/share/plasma/plasmoids/com.akiflow.panelwidget/contents/ui/FullRepresentation.qml"
    
      141    install -Dm644 "${srcdir}/plasma-widget-akiflow.png" \
    
      142        "${pkgdir}/usr/share/plasma/plasmoids/com.akiflow.panelwidget/contents/icons/akiflow.png"
    
      143}
    
      144

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2