audibleport-bin

MEDIUM

maintainer kukapu 0 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads a prebuilt AppImage from a non-whitelisted host (downloads.audibleport.com), which is an unverifiable executable binary; if compromised, it could execute arbitrary code, constituting a supply-chain risk.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:38 "AudiblePort-${pkgver}-linux-x64.AppImage::https://downloads.audibleport.com/v${pkgver}/AudiblePort-linux-x64.AppImage"

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt AppImage from a non-whitelisted host (downloads.audibleport.com), which is an unverifiable executable binary; if compromised, it could execute arbitrary code, constituting a supply-chain risk.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: kukapu <susokukapu@gmail.com>
    
      2#
    
      3# Binary package for AudiblePort (Tauri desktop app).
    
      4# Downloads the official prebuilt AppImage, extracts it, and runs against
    
      5# Arch system WebKitGTK/GTK/Mesa — the Ubuntu-bundled WebKit causes a black
    
      6# window + "Could not create default EGL display: EGL_BAD_PARAMETER" on
    
      7# Arch/Omarchy (Intel and NVIDIA).
    
      8
    
      9pkgname=audibleport-bin
    
      10pkgver=1.1.2
    
      11pkgrel=1
    
      12pkgdesc="Download and convert Audible audiobooks locally"
    
      13arch=('x86_64')
    
      14url="https://audibleport.com"
    
      15license=('LicenseRef-Proprietary')
    
      16depends=(
    
      17  'webkit2gtk-4.1'
    
      18  'gtk3'
    
      19  'libsoup3'
    
      20  'gstreamer'
    
      21  'gst-plugins-base'
    
      22  'gst-plugins-good'
    
      23  'openssl'
    
      24  'hicolor-icon-theme'
    
      25  'zlib'
    
      26  'dbus'
    
      27  'org.freedesktop.secrets'
    
      28)
    
      29optdepends=(
    
      30  'gst-plugins-bad: extra media codecs for the webview'
    
      31  'gst-libav: extra media codecs for the webview'
    
      32)
    
      33provides=('audibleport')
    
      34conflicts=('audibleport')
    
      35options=('!strip' '!debug')
    
      36noextract=("AudiblePort-${pkgver}-linux-x64.AppImage")
    
      37source=(
    
      38  "AudiblePort-${pkgver}-linux-x64.AppImage::https://downloads.audibleport.com/v${pkgver}/AudiblePort-linux-x64.AppImage"
    
      39  "audibleport.desktop"
    
      40  "audibleport.png"
    
      41  "LICENSE"
    
      42)
    
      43sha256sums=(
    
      44  'caa3d7ee892638e6a837e5b4f1bc4035b9113284df878d36ab3bc5334b36805d'
    
      45  'd7afd4229854d68a47e0cdadbbf4cd44a2cbef90b4104e30800557f6846cd3a0'
    
      46  'f306dfb5d537724f15d2af8c2bd81d8bf666c85c45e20aea6e8fb9cda2f4881e'
    
      47  'ab768f90de1bebd36122c52dce48305f9191660e017772cf7d852de9a6376594'
    
      48)
    
      49
    
      50prepare() {
    
      51  chmod +x "${srcdir}/AudiblePort-${pkgver}-linux-x64.AppImage"
    
      52  cd "${srcdir}"
    
      53  rm -rf squashfs-root
    
      54  "./AudiblePort-${pkgver}-linux-x64.AppImage" --appimage-extract
    
      55
    
      56  # Drop Ubuntu-bundled WebKit so the app uses Arch webkit2gtk-4.1 + system Mesa.
    
      57  rm -f squashfs-root/usr/lib/libwebkit2gtk-4.1.so*
    
      58  rm -f squashfs-root/usr/lib/libjavascriptcoregtk-4.1.so*
    
      59  rm -rf squashfs-root/usr/lib/x86_64-linux-gnu/webkit2gtk-4.1
    
      60}
    
      61
    
      62package() {
    
      63  install -d "${pkgdir}/opt/audibleport"
    
      64  cp -a "${srcdir}/squashfs-root/." "${pkgdir}/opt/audibleport/"
    
      65
    
      66  # AppImage payloads may carry writable schemas/docs or unreadable helpers.
    
      67  chmod -R a+rX,go-w "${pkgdir}/opt/audibleport"
    
      68
    
      69  # Keep the main binary and bundled resources (ffmpeg) executable.
    
      70  chmod 755 "${pkgdir}/opt/audibleport/usr/bin/audibleport"
    
      71
    
      72  install -Dm755 /dev/stdin "${pkgdir}/usr/bin/audibleport" <<'EOF'
    
      73#!/bin/sh
    
      74APPDIR="/opt/audibleport"
    
      75BIN="${APPDIR}/usr/bin/audibleport"
    
      76
    
      77if [ ! -x "$BIN" ]; then
    
      78  echo "audibleport: missing $BIN" >&2
    
      79  exit 1
    
      80fi
    
      81
    
      82# Prefer Arch system libraries (WebKit/GTK/GLib/Mesa/GStreamer) over the
    
      83# Ubuntu copies still present in the extracted AppImage tree. Without this,
    
      84# WebKit dies with: Could not create default EGL display: EGL_BAD_PARAMETER
    
      85export LD_LIBRARY_PATH="/usr/lib${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}"
    
      86
    
      87# Extra safety on Wayland + DMA-BUF (Intel/NVIDIA/AMD).
    
      88export WEBKIT_DISABLE_DMABUF_RENDERER="${WEBKIT_DISABLE_DMABUF_RENDERER:-1}"
    
      89
    
      90exec "$BIN" "$@"
    
      91EOF
    
      92
    
      93  install -Dm644 "${srcdir}/audibleport.desktop" \
    
      94    "${pkgdir}/usr/share/applications/audibleport.desktop"
    
      95
    
      96  install -Dm644 "${srcdir}/audibleport.png" \
    
      97    "${pkgdir}/usr/share/icons/hicolor/512x512/apps/audibleport.png"
    
      98
    
      99  install -Dm644 "${srcdir}/LICENSE" \
    
      100    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      101}
    
      102

Changes since previous scan

--- PKGBUILD @ 2026-10-17 00:21
+++ PKGBUILD @ 2026-11-01 00:21
@@ -7,7 +7,7 @@
 # Arch/Omarchy (Intel and NVIDIA).
 
 pkgname=audibleport-bin
-pkgver=1.1.1
+pkgver=1.1.2
 pkgrel=1
 pkgdesc="Download and convert Audible audiobooks locally"
 arch=('x86_64')
@@ -41,7 +41,7 @@
   "LICENSE"
 )
 sha256sums=(
-  '662a58a0abb7787e8e35499d935aa52b0d0818907e2b9cf4e7030880de7873c6'
+  'caa3d7ee892638e6a837e5b4f1bc4035b9113284df878d36ab3bc5334b36805d'
   'd7afd4229854d68a47e0cdadbbf4cd44a2cbef90b4104e30800557f6846cd3a0'
   'f306dfb5d537724f15d2af8c2bd81d8bf666c85c45e20aea6e8fb9cda2f4881e'
   'ab768f90de1bebd36122c52dce48305f9191660e017772cf7d852de9a6376594'

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Medium	2
2026-10-31 00:07:41	Medium	2
2026-10-30 00:29:30	Medium	2
2026-10-29 00:13:55	Medium	2
2026-10-28 00:06:54	Medium	2
2026-10-27 00:23:28	Medium	2
2026-10-26 00:12:40	Medium	2
2026-10-25 00:20:48	Medium	2
2026-10-24 00:14:55	Medium	2
2026-10-23 00:02:19	Medium	2
2026-10-22 00:13:10	Medium	2
2026-10-21 00:12:50	Medium	2
2026-10-20 00:10:31	Medium	2
2026-10-19 00:03:55	Medium	2
2026-10-18 00:06:55	Medium	2
2026-10-17 21:19:24	Medium	2
2026-10-17 00:21:55	Medium	2
2026-10-16 00:12:47	Medium	2
2026-10-15 00:28:05	Medium	2
2026-10-14 00:06:47	Medium	2