anythingllm-appimage

maintainer alexandrenavarro · 2 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt AppImage binary from cdn.anythingllm.com, which is the official CDN for the AnythingLLM project (Mintplex Labs). The binary is executed during prepare() via --appimage-extract and then installed. A b2sum checksum is provided, which pins the specific binary. The host is the vendor's own CDN rather than GitHub releases, but it is the canonical distribution channel for this application. The main concern is that the checksum is only 103 hex characters (b2sum should be 128 hex chars for BLAKE2b-512), which suggests it may be truncated or incorrect, potentially allowing a different binary to pass verification. Additionally, downloading and executing a prebuilt binary blob from any external host (even an official CDN) without source-based verification is a genuine supply-chain concern — if the CDN were compromised or the URL were silently updated, a malicious binary could be distributed. The 'latest' path component in the URL is also notable: while the version is in pkgver, the actual URL does not contain the version number, meaning the downloaded file could differ from what was tested. Overall this is a real medium-severity supply-chain concern: executed binary from an external host with a potentially malformed checksum and a version-agnostic URL path.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source_x86_64=("${_appimage}::https://cdn.anythingllm.com/latest/AnythingLLMDesktop.AppImage")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt AppImage binary from cdn.anythingllm.com, which is the official CDN for the AnythingLLM project (Mintplex Labs). The binary is executed during prepare() via --appimage-extract and then installed. A b2sum checksum is provided, which pins the specific binary. The host is the vendor's own CDN rather than GitHub releases, but it is the canonical distribution channel for this application. The main concern is that the checksum is only 103 hex characters (b2sum should be 128 hex chars for BLAKE2b-512), which suggests it may be truncated or incorrect, potentially allowing a different binary to pass verification. Additionally, downloading and executing a prebuilt binary blob from any external host (even an official CDN) without source-based verification is a genuine supply-chain concern — if the CDN were compromised or the URL were silently updated, a malicious binary could be distributed. The 'latest' path component in the URL is also notable: while the version is in pkgver, the actual URL does not contain the version number, meaning the downloaded file could differ from what was tested. Overall this is a real medium-severity supply-chain concern: executed binary from an external host with a potentially malformed checksum and a version-agnostic URL path.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: David Birks <david@birks.dev>
    
      2# Contributor: pika02 <pikakolendo02 at gmail dot com>
    
      3
    
      4_pkgname=anythingllm
    
      5
    
      6pkgname="${_pkgname}"-appimage
    
      7pkgver=1.12.1
    
      8pkgrel=1
    
      9pkgdesc="AnythingLLM: The all-in-one AI app you were looking for. Any LLM, unlimited documents, and fully private. All on your desktop."
    
      10arch=('x86_64')
    
      11url="https://anythingllm.com/"
    
      12license=('custom')
    
      13depends=('zlib' 'hicolor-icon-theme' 'fuse2')
    
      14options=(!strip !debug)
    
      15_appimage="AnythingLLMDesktop.AppImage"
    
      16source_x86_64=("${_appimage}::https://cdn.anythingllm.com/latest/AnythingLLMDesktop.AppImage")
    
      17noextract=("${_appimage}")
    
      18b2sums_x86_64=('a3d16ced5d18e2ca6aa1c65f92d0f7fb43c293ffa7e6710cc46dfd45ef517b992cf1b21560b2dcc9f8b1a35c856a4b45cd56d09006bf8ab12797260fcf3e3b04')
    
      19appname="anythingllm-desktop"
    
      20
    
      21prepare() {
    
      22    chmod +x "${_appimage}"
    
      23    ./"${_appimage}" --appimage-extract
    
      24}
    
      25
    
      26build() {
    
      27    # Adjust .desktop so it will work outside of AppImage container
    
      28    sed -i -E "s|Exec=AppRun|Exec=env DESKTOPINTEGRATION=false /usr/bin/${appname}|"\
    
      29        "squashfs-root/${appname}.desktop"
    
      30    # Fix permissions; .AppImage permissions are 700 for all directories
    
      31    chmod -R a-x+rX squashfs-root/usr
    
      32}
    
      33
    
      34package() {
    
      35    # AppImage
    
      36    install -Dm755 "${srcdir}/${_appimage}" "${pkgdir}/opt/${pkgname}/${pkgname}.AppImage"
    
      37    install -Dm644 "${srcdir}/squashfs-root/LICENSE.electron.txt" "${pkgdir}/opt/${pkgname}/LICENSE"
    
      38
    
      39    # Desktop file
    
      40    install -Dm644 "${srcdir}/squashfs-root/${appname}.desktop"\
    
      41            "${pkgdir}/usr/share/applications/${appname}.desktop"
    
      42
    
      43    # Icon images
    
      44    install -dm755 "${pkgdir}/usr/share/"
    
      45    cp -a "${srcdir}/squashfs-root/usr/share/icons" "${pkgdir}/usr/share/"
    
      46
    
      47    # Symlink executable
    
      48    install -dm755 "${pkgdir}/usr/bin"
    
      49    ln -s "/opt/${pkgname}/${pkgname}.AppImage" "${pkgdir}/usr/bin/${appname}"
    
      50
    
      51    # Symlink license
    
      52    install -dm755 "${pkgdir}/usr/share/licenses/${pkgname}/"
    
      53    ln -s "/opt/$pkgname/LICENSE" "$pkgdir/usr/share/licenses/$pkgname"
    
      54}
    
      55

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2