anythingllm-desktop-bin
LOW
maintainer impulse
9 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads prebuilt AppImages from the project's own CDN (cdn.anythingllm.com), which is plausibly official; the source is verified via sha256sums and used to repackage a desktop launcher, posing no remote code execution or supply-chain risk beyond typical AUR packages.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads prebuilt AppImages from the project's own CDN (cdn.anythingllm.com), which is plausibly official; the source is verified via sha256sums and used to repackage a desktop launcher, posing no remote code execution or supply-chain risk beyond typical AUR packages.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:36
source_aarch64=("${pkgname%-bin}-${pkgver}-aarch64.AppImage::https://cdn.anythingllm.com/latest/${_pkgname//-/}-Arm64.AppImage")
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
2
_appname=anythingllm
3
pkgname="${_appname}-desktop-bin"
4
_pkgname=Anything-LLM-Desktop
5
pkgver=1.16.1
6
_electronversion=31
7
pkgrel=1
8
pkgdesc="The all-in-one AI application, tool suite, and API for RAG & Agents for Docker & Desktop.(Prebuilt version.Use system-wide electron)"
9
arch=(
10
'aarch64'
11
'x86_64'
12
)
13
url="https://anythingllm.com/"
14
_ghurl="https://github.com/Mintplex-Labs/anything-llm"
15
license=('MIT')
16
provides=("${pkgname%-bin}=${pkgver}")
17
conflicts=(
18
"${pkgname%-bin}"
19
"${_appname}"
20
)
21
depends=(
22
"electron${_electronversion}"
23
'ollama'
24
)
25
optdepends=(
26
'ollama-cuda'
27
'ollama-rocm'
28
)
29
makedepends=(
30
'asar'
31
)
32
options=(
33
'!strip'
34
)
35
source=("${pkgname%-bin}.sh")
36
source_aarch64=("${pkgname%-bin}-${pkgver}-aarch64.AppImage::https://cdn.anythingllm.com/latest/${_pkgname//-/}-Arm64.AppImage")
37
source_x86_64=("${pkgname%-bin}-${pkgver}-x86_64.AppImage::https://cdn.anythingllm.com/latest/${_pkgname//-/}.AppImage")
38
sha256sums=('31ad33b633744f5361abd964be306cea53ae1050e760c787115f7eca60045ae6')
39
sha256sums_aarch64=('41c0b98117ca8105e0a161599e7fb0612de264e44cdb78dc2f5c31d5d1d3dcf1')
40
sha256sums_x86_64=('628dd7fc2320d258ff913fab66b639bc2b4fe7598fedeb64796d765096357046')
41
pkgver() {
42
cd "${srcdir}/squashfs-root"
43
set -o pipefail
44
grep "X-AppImage-Version" "${pkgname%-bin}.desktop" | sed "s/X-AppImage-Version=//;s/-/_/g"
45
}
46
_get_electron_version() {
47
_elec_ver="$(strings "${srcdir}/squashfs-root/${pkgname%-bin}" | grep '^Chrome/[0-9.]* Electron/[0-9]' | cut -d'/' -f3 | cut -d'.' -f1)"
48
echo -e "The electron version is: \033[1;31m${_elec_ver}\033[0m"
49
}
50
prepare() {
51
sed -i -e "
52
s/@electronversion@/${_electronversion}/g
53
s/@appname@/${pkgname%-bin}/g
54
s/@runname@/app.asar/g
55
s/@cfgdirname@/${_pkgname}/g
56
s/@options@/env ELECTRON_OZONE_PLATFORM_HINT=auto/g
57
" "${srcdir}/${pkgname%-bin}.sh"
58
if [ ! -x "${srcdir}/${pkgname%-bin}-${pkgver}-${CARCH}.AppImage" ];then
59
chmod +x "${srcdir}/${pkgname%-bin}-${pkgver}-${CARCH}.AppImage"
60
fi
61
if [ -d "${srcdir}/squashfs-root" ];then
62
rm -rf "${srcdir}/squashfs-root"
63
fi
64
"${srcdir}/${pkgname%-bin}-${pkgver}-${CARCH}.AppImage" --appimage-extract > /dev/null
65
_get_electron_version
66
sed -i "s/AppRun --no-sandbox/${pkgname%-bin}/g" "${srcdir}/squashfs-root/${pkgname%-bin}.desktop"
67
find "${srcdir}/squashfs-root/resources" -type d -exec chmod 755 {} +
68
asar e "${srcdir}/squashfs-root/resources/app.asar" "${srcdir}/app.asar.unpacked"
69
rm -rf "${srcdir}/squashfs-root/resources/app.asar"
70
find "${srcdir}/app.asar.unpacked/dist-electron" -type f -exec sed -i "s/process.resourcesPath/\'\/usr\/lib\/${pkgname%-bin}\'/g" {} \;
71
asar p "${srcdir}/app.asar.unpacked" "${srcdir}/squashfs-root/resources/app.asar"
72
ln -sf "/usr/bin/ollama" "${srcdir}/squashfs-root/resources/ollama/bin/llm"
73
_file_list=(libggml-base.so libggml-cpu-alderlake.so libggml-cpu-haswell.so libggml-cpu-icelake.so libggml-cpu-sandybridge.so \
74
libggml-cpu-skylakex.so libggml-cpu-sse42.so libggml-cpu-x64.so libggml-cuda.so libggml-hip.so)
75
for _files in "${_file_list[@]}";do
76
ln -sf "/usr/lib/ollama/${_files}" "${srcdir}/squashfs-root/resources/ollama/lib/${_files}"
77
done
78
}
79
package() {
80
install -Dm755 "${srcdir}/${pkgname%-bin}.sh" "${pkgdir}/usr/bin/${pkgname%-bin}"
81
install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-bin}"
82
find "${srcdir}/squashfs-root/resources" -maxdepth 1 -type f -exec install -Dm644 -t "${pkgdir}/usr/lib/${pkgname%-bin}" {} +
83
if find "${srcdir}/squashfs-root/resources" -mindepth 1 -maxdepth 1 -type d | read; then
84
for _subdir in "${srcdir}/squashfs-root/resources/"*; do
85
if [ -d "${_subdir}" ]; then
86
cp -Pr --no-preserve=ownership "${_subdir}" "${pkgdir}/usr/lib/${pkgname%-bin}"
87
fi
88
done
89
fi
90
install -Dm644 "${srcdir}/squashfs-root/usr/lib/"* -t "${pkgdir}/usr/lib/${pkgname%-bin}/lib"
91
install -Dm644 "${srcdir}/squashfs-root/usr/share/icons/hicolor/0x0/apps/${pkgname%-bin}.png" -t "${pkgdir}/usr/share/pixmaps"
92
install -Dm644 "${srcdir}/squashfs-root/${pkgname%-bin}.desktop" -t "${pkgdir}/usr/share/applications"
93
install -Dm644 "${srcdir}/squashfs-root/"LICENSE* -t "${pkgdir}/usr/share/licenses/${pkgname}"
94
}
95
Changes since previous scan
--- PKGBUILD @ 2026-09-14 00:27+++ PKGBUILD @ 2026-09-17 00:27@@ -2,7 +2,7 @@ _appname=anythingllm pkgname="${_appname}-desktop-bin" _pkgname=Anything-LLM-Desktop-pkgver=1.15.0+pkgver=1.16.1 _electronversion=31 pkgrel=1 pkgdesc="The all-in-one AI application, tool suite, and API for RAG & Agents for Docker & Desktop.(Prebuilt version.Use system-wide electron)"@@ -36,8 +36,8 @@ source_aarch64=("${pkgname%-bin}-${pkgver}-aarch64.AppImage::https://cdn.anythingllm.com/latest/${_pkgname//-/}-Arm64.AppImage") source_x86_64=("${pkgname%-bin}-${pkgver}-x86_64.AppImage::https://cdn.anythingllm.com/latest/${_pkgname//-/}.AppImage") sha256sums=('31ad33b633744f5361abd964be306cea53ae1050e760c787115f7eca60045ae6')-sha256sums_aarch64=('1b948c5090c398f03218d891fcbec8df7be0d0188cd1cf0bf2c881b5df9ac5f2')-sha256sums_x86_64=('0e4fc5786cde7c00a2265c937fefc155cf1926bc85f46abc056c59a9778069cb')+sha256sums_aarch64=('41c0b98117ca8105e0a161599e7fb0612de264e44cdb78dc2f5c31d5d1d3dcf1')+sha256sums_x86_64=('628dd7fc2320d258ff913fab66b639bc2b4fe7598fedeb64796d765096357046') pkgver() { cd "${srcdir}/squashfs-root" set -o pipefailScan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 17:17:35 | Medium | 1 |
| 2026-09-14 00:27:57 | Medium | 2 |
| 2026-09-13 00:19:54 | Medium | 2 |
| 2026-09-12 00:25:17 | Medium | 2 |
| 2026-09-11 00:19:22 | Medium | 2 |
| 2026-09-10 00:22:44 | Medium | 2 |
| 2026-09-09 00:04:09 | Medium | 2 |
| 2026-09-08 00:18:08 | Medium | 2 |
| 2026-09-07 00:30:15 | Medium | 2 |
| 2026-09-06 00:17:06 | Medium | 2 |
| 2026-09-05 00:16:27 | Medium | 2 |
| 2026-09-04 00:03:13 | Medium | 2 |
| 2026-09-03 00:15:47 | Medium | 2 |
| 2026-09-02 00:02:31 | Medium | 2 |
| 2026-09-01 00:11:19 | Medium | 2 |
| 2026-08-31 00:19:57 | Medium | 2 |
| 2026-08-30 00:04:14 | Medium | 2 |