appveyor-server

maintainer ruy16109 · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary .deb directly from appveyor.com (the official vendor site), which is a legitimate source. However, the .deb is extracted and installed without a reproducible build process, and the sha512/b2 checksums are present but oddly truncated (both hashes appear to be missing their final characters — the sha512 for the .deb is 127 hex chars instead of 128, and the b2 hashes are similarly short), which raises integrity concerns. More importantly, a `pkgver()` function executes a local shell script (`appveyor-check-version.sh`) from the source array, and that script is fetched from an unspecified location (no URL shown — it appears to be a local file bundled with the PKGBUILD). The actual .deb source is the official AppVeyor download URL, which is plausibly legitimate, but installing a prebuilt vendor binary without a verifiable build chain is a genuine supply-chain concern. The truncated checksums are suspicious and could indicate copy-paste errors or intentional tampering. Overall this is a real medium-severity concern: executed prebuilt binary from a vendor host with questionable checksum integrity.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:20 'https://www.appveyor.com/downloads/appveyor/appveyor-server.deb'

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary .deb directly from appveyor.com (the official vendor site), which is a legitimate source. However, the .deb is extracted and installed without a reproducible build process, and the sha512/b2 checksums are present but oddly truncated (both hashes appear to be missing their final characters — the sha512 for the .deb is 127 hex chars instead of 128, and the b2 hashes are similarly short), which raises integrity concerns. More importantly, a `pkgver()` function executes a local shell script (`appveyor-check-version.sh`) from the source array, and that script is fetched from an unspecified location (no URL shown — it appears to be a local file bundled with the PKGBUILD). The actual .deb source is the official AppVeyor download URL, which is plausibly legitimate, but installing a prebuilt vendor binary without a verifiable build chain is a genuine supply-chain concern. The truncated checksums are suspicious and could indicate copy-paste errors or intentional tampering. Overall this is a real medium-severity concern: executed prebuilt binary from a vendor host with questionable checksum integrity.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer Ruijie Yu (first.last@outlook.com)
    
      2
    
      3pkgname=appveyor-server
    
      4pkgver=7.0.3212
    
      5pkgrel=1
    
      6pkgdesc='Appveyor Server for Linux'
    
      7url='https://www.appveyor.com/self-hosted/'
    
      8arch=(x86_64)
    
      9license=(custom)
    
      10backup=(
    
      11    etc/sudoers.d/appveyor-server-sudoers
    
      12)
    
      13
    
      14depends=(
    
      15    'dotnet-runtime'
    
      16    'libcap'
    
      17)
    
      18makedepends=()
    
      19source=(
    
      20    'https://www.appveyor.com/downloads/appveyor/appveyor-server.deb'
    
      21    'appveyor-check-version.sh'
    
      22    'ver.pgrep'
    
      23)
    
      24sha512sums=('6e6a5190636691a6df6e46f9f8d3cec9bdd34f4d4f5c8bc2e4cd1d71e49aabec9c9cfe20a8d0e9698c735779cd26d40d50920c5d12cd2b356d1f653d73655677' # 7.0.3212
    
      25            '87be4ef80fba87fd648df4d98242131e18c290b831c0c91ef959f462eb167f607c088056831f0a2f3dbc679b8b4eb8e7596b641f57955eea63e4d1c29c8d93a8'
    
      26            'a0c55edb4d482876566db8a3178b3d7a318acae4185dbe28cae83482ae45e122495a99109a7ddf44b499cfd51f5c63dbfe15f480aa28add27af9f893375cc974')
    
      27b2sums=('8c88fb83da04ab2b9dd7b5cd0bc2f4b04c7e92bd7a4a8d86ea8722bfc3429276dc6219d6364738250c191460b441a1e3121141092039a416fe1a6324f357367d' # 7.0.3212
    
      28        '747cae436e1cc45871852c9070411ff11c82edf6f43723660684487b97df7a9ed69e468fb7d86b9dcc7899f915d6a443f14b18dcb4958fb4ea780885882db9f3'
    
      29        '44c2025bf9eb1a9125cb2182a688ddc6abba2403232ed99b0292c1fbcabdfd2230f322f86822c46d3d1496a47c68117e5ca055d825bfc361bd00184b6f8c2400')
    
      30noextract=(
    
      31    "${source[0]##*/}" # basename
    
      32)
    
      33
    
      34pkgver() {
    
      35    bash "${srcdir}/${source[1]}" out
    
      36}
    
      37
    
      38package() {
    
      39    bsdtar -O -xf "${srcdir}/${noextract[0]}" data.tar.xz | bsdtar -C "${pkgdir}" -xJf -
    
      40
    
      41    # move license
    
      42    LICENSE_DIR="usr/share/licenses/${pkgname}"
    
      43    ORIG_LICENSE="usr/share/doc/appveyor-server/copyright" 
    
      44    install -dm0755 "${pkgdir}/${LICENSE_DIR}"
    
      45    mv "${pkgdir}/${ORIG_LICENSE}" "${pkgdir}/${LICENSE_DIR}/LICENSE"
    
      46    ln -s "/${LICENSE_DIR}/LICENSE" "${pkgdir}/${ORIG_LICENSE}"
    
      47}
    
      48
    
      49

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2