audibleport-bin

LOW

maintainer kukapu 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads a prebuilt AppImage from the project's official domain (downloads.audibleport.com), which is not on standard hosting but plausibly legitimate; it extracts and repackages it using system libraries, a common practice for compatibility, with no obfuscated or malicious behavior observed.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt AppImage from the project's official domain (downloads.audibleport.com), which is not on standard hosting but plausibly legitimate; it extracts and repackages it using system libraries, a common practice for compatibility, with no obfuscated or malicious behavior observed.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:38 "AudiblePort-${pkgver}-linux-x64.AppImage::https://downloads.audibleport.com/v${pkgver}/AudiblePort-linux-x64.AppImage"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: kukapu <susokukapu@gmail.com>
    
      2#
    
      3# Binary package for AudiblePort (Tauri desktop app).
    
      4# Downloads the official prebuilt AppImage, extracts it, and runs against
    
      5# Arch system WebKitGTK/GTK/Mesa — the Ubuntu-bundled WebKit causes a black
    
      6# window + "Could not create default EGL display: EGL_BAD_PARAMETER" on
    
      7# Arch/Omarchy (Intel and NVIDIA).
    
      8
    
      9pkgname=audibleport-bin
    
      10pkgver=1.0.11
    
      11pkgrel=1
    
      12pkgdesc="Download and convert Audible audiobooks locally"
    
      13arch=('x86_64')
    
      14url="https://audibleport.com"
    
      15license=('LicenseRef-Proprietary')
    
      16depends=(
    
      17  'webkit2gtk-4.1'
    
      18  'gtk3'
    
      19  'libsoup3'
    
      20  'gstreamer'
    
      21  'gst-plugins-base'
    
      22  'gst-plugins-good'
    
      23  'openssl'
    
      24  'hicolor-icon-theme'
    
      25  'zlib'
    
      26  'dbus'
    
      27  'org.freedesktop.secrets'
    
      28)
    
      29optdepends=(
    
      30  'gst-plugins-bad: extra media codecs for the webview'
    
      31  'gst-libav: extra media codecs for the webview'
    
      32)
    
      33provides=('audibleport')
    
      34conflicts=('audibleport')
    
      35options=('!strip' '!debug')
    
      36noextract=("AudiblePort-${pkgver}-linux-x64.AppImage")
    
      37source=(
    
      38  "AudiblePort-${pkgver}-linux-x64.AppImage::https://downloads.audibleport.com/v${pkgver}/AudiblePort-linux-x64.AppImage"
    
      39  "audibleport.desktop"
    
      40  "audibleport.png"
    
      41  "LICENSE"
    
      42)
    
      43sha256sums=(
    
      44  '055c6e82adc9aed02e217367e2e3a1c839ab9237faf6e4907e8773ad59735a29'
    
      45  'd7afd4229854d68a47e0cdadbbf4cd44a2cbef90b4104e30800557f6846cd3a0'
    
      46  'f306dfb5d537724f15d2af8c2bd81d8bf666c85c45e20aea6e8fb9cda2f4881e'
    
      47  'ab768f90de1bebd36122c52dce48305f9191660e017772cf7d852de9a6376594'
    
      48)
    
      49
    
      50prepare() {
    
      51  chmod +x "${srcdir}/AudiblePort-${pkgver}-linux-x64.AppImage"
    
      52  cd "${srcdir}"
    
      53  rm -rf squashfs-root
    
      54  "./AudiblePort-${pkgver}-linux-x64.AppImage" --appimage-extract
    
      55
    
      56  # Drop Ubuntu-bundled WebKit so the app uses Arch webkit2gtk-4.1 + system Mesa.
    
      57  rm -f squashfs-root/usr/lib/libwebkit2gtk-4.1.so*
    
      58  rm -f squashfs-root/usr/lib/libjavascriptcoregtk-4.1.so*
    
      59  rm -rf squashfs-root/usr/lib/x86_64-linux-gnu/webkit2gtk-4.1
    
      60}
    
      61
    
      62package() {
    
      63  install -d "${pkgdir}/opt/audibleport"
    
      64  cp -a "${srcdir}/squashfs-root/." "${pkgdir}/opt/audibleport/"
    
      65
    
      66  # AppImage payloads may carry writable schemas/docs or unreadable helpers.
    
      67  chmod -R a+rX,go-w "${pkgdir}/opt/audibleport"
    
      68
    
      69  # Keep the main binary and bundled resources (ffmpeg) executable.
    
      70  chmod 755 "${pkgdir}/opt/audibleport/usr/bin/audibleport"
    
      71
    
      72  install -Dm755 /dev/stdin "${pkgdir}/usr/bin/audibleport" <<'EOF'
    
      73#!/bin/sh
    
      74APPDIR="/opt/audibleport"
    
      75BIN="${APPDIR}/usr/bin/audibleport"
    
      76
    
      77if [ ! -x "$BIN" ]; then
    
      78  echo "audibleport: missing $BIN" >&2
    
      79  exit 1
    
      80fi
    
      81
    
      82# Prefer Arch system libraries (WebKit/GTK/GLib/Mesa/GStreamer) over the
    
      83# Ubuntu copies still present in the extracted AppImage tree. Without this,
    
      84# WebKit dies with: Could not create default EGL display: EGL_BAD_PARAMETER
    
      85export LD_LIBRARY_PATH="/usr/lib${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}"
    
      86
    
      87# Extra safety on Wayland + DMA-BUF (Intel/NVIDIA/AMD).
    
      88export WEBKIT_DISABLE_DMABUF_RENDERER="${WEBKIT_DISABLE_DMABUF_RENDERER:-1}"
    
      89
    
      90exec "$BIN" "$@"
    
      91EOF
    
      92
    
      93  install -Dm644 "${srcdir}/audibleport.desktop" \
    
      94    "${pkgdir}/usr/share/applications/audibleport.desktop"
    
      95
    
      96  install -Dm644 "${srcdir}/audibleport.png" \
    
      97    "${pkgdir}/usr/share/icons/hicolor/512x512/apps/audibleport.png"
    
      98
    
      99  install -Dm644 "${srcdir}/LICENSE" \
    
      100    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      101}
    
      102

Changes since previous scan

--- PKGBUILD @ 2026-09-07 00:30
+++ PKGBUILD @ 2026-09-17 00:27
@@ -7,7 +7,7 @@
 # Arch/Omarchy (Intel and NVIDIA).
 
 pkgname=audibleport-bin
-pkgver=1.0.9
+pkgver=1.0.11
 pkgrel=1
 pkgdesc="Download and convert Audible audiobooks locally"
 arch=('x86_64')
@@ -23,6 +23,8 @@
   'openssl'
   'hicolor-icon-theme'
   'zlib'
+  'dbus'
+  'org.freedesktop.secrets'
 )
 optdepends=(
   'gst-plugins-bad: extra media codecs for the webview'
@@ -39,7 +41,7 @@
   "LICENSE"
 )
 sha256sums=(
-  'db0e40682f6065b0062b236729cb3b9b19db859aa000f148b982c4fd79117b1d'
+  '055c6e82adc9aed02e217367e2e3a1c839ab9237faf6e4907e8773ad59735a29'
   'd7afd4229854d68a47e0cdadbbf4cd44a2cbef90b4104e30800557f6846cd3a0'
   'f306dfb5d537724f15d2af8c2bd81d8bf666c85c45e20aea6e8fb9cda2f4881e'
   'ab768f90de1bebd36122c52dce48305f9191660e017772cf7d852de9a6376594'
@@ -60,6 +62,9 @@
 package() {
   install -d "${pkgdir}/opt/audibleport"
   cp -a "${srcdir}/squashfs-root/." "${pkgdir}/opt/audibleport/"
+
+  # AppImage payloads may carry writable schemas/docs or unreadable helpers.
+  chmod -R a+rX,go-w "${pkgdir}/opt/audibleport"
 
   # Keep the main binary and bundled resources (ffmpeg) executable.
   chmod 755 "${pkgdir}/opt/audibleport/usr/bin/audibleport"

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 13:14:41	Medium	1
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 20:01:32	Medium	2
2026-09-05 14:00:22	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2