audibleport-bin

maintainer kukapu · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged Downloads and executes a prebuilt proprietary AppImage binary from downloads.audibleport.com (a non-whitelisted personal/project host with few votes and a recently uploaded package); while the checksum is provided and the host plausibly belongs to the project, it is an unverifiable closed-source executable from a low-trust source that gets installed system-wide and run directly.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:36 "AudiblePort-${pkgver}-linux-x64.AppImage::https://downloads.audibleport.com/v${pkgver}/AudiblePort-linux-x64.AppImage"

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

MEDIUM AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): Downloads and executes a prebuilt proprietary AppImage binary from downloads.audibleport.com (a non-whitelisted personal/project host with few votes and a recently uploaded package); while the checksum is provided and the host plausibly belongs to the project, it is an unverifiable closed-source executable from a low-trust source that gets installed system-wide and run directly.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: kukapu <susokukapu@gmail.com>
    
      2#
    
      3# Binary package for AudiblePort (Tauri desktop app).
    
      4# Downloads the official prebuilt AppImage, extracts it, and runs against
    
      5# Arch system WebKitGTK/GTK/Mesa — the Ubuntu-bundled WebKit causes a black
    
      6# window + "Could not create default EGL display: EGL_BAD_PARAMETER" on
    
      7# Arch/Omarchy (Intel and NVIDIA).
    
      8
    
      9pkgname=audibleport-bin
    
      10pkgver=1.0.0
    
      11pkgrel=3
    
      12pkgdesc="Download and convert Audible audiobooks locally"
    
      13arch=('x86_64')
    
      14url="https://audibleport.com"
    
      15license=('LicenseRef-Proprietary')
    
      16depends=(
    
      17  'webkit2gtk-4.1'
    
      18  'gtk3'
    
      19  'libsoup3'
    
      20  'gstreamer'
    
      21  'gst-plugins-base'
    
      22  'gst-plugins-good'
    
      23  'openssl'
    
      24  'hicolor-icon-theme'
    
      25  'zlib'
    
      26)
    
      27optdepends=(
    
      28  'gst-plugins-bad: extra media codecs for the webview'
    
      29  'gst-libav: extra media codecs for the webview'
    
      30)
    
      31provides=('audibleport')
    
      32conflicts=('audibleport')
    
      33options=('!strip' '!debug')
    
      34noextract=("AudiblePort-${pkgver}-linux-x64.AppImage")
    
      35source=(
    
      36  "AudiblePort-${pkgver}-linux-x64.AppImage::https://downloads.audibleport.com/v${pkgver}/AudiblePort-linux-x64.AppImage"
    
      37  "audibleport.desktop"
    
      38  "audibleport.png"
    
      39  "LICENSE"
    
      40)
    
      41sha256sums=(
    
      42  'd0ea2d6ba0fc83e4e43e5a884ba1fa510a3dbdb10d946ed3a866037a5532ed05'
    
      43  'd7afd4229854d68a47e0cdadbbf4cd44a2cbef90b4104e30800557f6846cd3a0'
    
      44  'f306dfb5d537724f15d2af8c2bd81d8bf666c85c45e20aea6e8fb9cda2f4881e'
    
      45  'ab768f90de1bebd36122c52dce48305f9191660e017772cf7d852de9a6376594'
    
      46)
    
      47
    
      48prepare() {
    
      49  chmod +x "${srcdir}/AudiblePort-${pkgver}-linux-x64.AppImage"
    
      50  cd "${srcdir}"
    
      51  rm -rf squashfs-root
    
      52  "./AudiblePort-${pkgver}-linux-x64.AppImage" --appimage-extract
    
      53
    
      54  # Drop Ubuntu-bundled WebKit so the app uses Arch webkit2gtk-4.1 + system Mesa.
    
      55  rm -f squashfs-root/usr/lib/libwebkit2gtk-4.1.so*
    
      56  rm -f squashfs-root/usr/lib/libjavascriptcoregtk-4.1.so*
    
      57  rm -rf squashfs-root/usr/lib/x86_64-linux-gnu/webkit2gtk-4.1
    
      58}
    
      59
    
      60package() {
    
      61  install -d "${pkgdir}/opt/audibleport"
    
      62  cp -a "${srcdir}/squashfs-root/." "${pkgdir}/opt/audibleport/"
    
      63
    
      64  # Keep the main binary and bundled resources (ffmpeg) executable.
    
      65  chmod 755 "${pkgdir}/opt/audibleport/usr/bin/audibleport"
    
      66
    
      67  install -Dm755 /dev/stdin "${pkgdir}/usr/bin/audibleport" <<'EOF'
    
      68#!/bin/sh
    
      69APPDIR="/opt/audibleport"
    
      70BIN="${APPDIR}/usr/bin/audibleport"
    
      71
    
      72if [ ! -x "$BIN" ]; then
    
      73  echo "audibleport: missing $BIN" >&2
    
      74  exit 1
    
      75fi
    
      76
    
      77# Prefer Arch system libraries (WebKit/GTK/GLib/Mesa/GStreamer) over the
    
      78# Ubuntu copies still present in the extracted AppImage tree. Without this,
    
      79# WebKit dies with: Could not create default EGL display: EGL_BAD_PARAMETER
    
      80export LD_LIBRARY_PATH="/usr/lib${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}"
    
      81
    
      82# Extra safety on Wayland + DMA-BUF (Intel/NVIDIA/AMD).
    
      83export WEBKIT_DISABLE_DMABUF_RENDERER="${WEBKIT_DISABLE_DMABUF_RENDERER:-1}"
    
      84
    
      85exec "$BIN" "$@"
    
      86EOF
    
      87
    
      88  install -Dm644 "${srcdir}/audibleport.desktop" \
    
      89    "${pkgdir}/usr/share/applications/audibleport.desktop"
    
      90
    
      91  install -Dm644 "${srcdir}/audibleport.png" \
    
      92    "${pkgdir}/usr/share/icons/hicolor/512x512/apps/audibleport.png"
    
      93
    
      94  install -Dm644 "${srcdir}/LICENSE" \
    
      95    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      96}
    
      97

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	3
2026-08-02 00:16:08	MEDIUM	3
2026-08-01 00:11:18	MEDIUM	3
2026-07-31 00:14:10	MEDIUM	3
2026-07-30 00:17:23	MEDIUM	3
2026-07-29 00:25:53	MEDIUM	3
2026-07-28 09:39:30	MEDIUM	3
2026-07-28 09:37:42	MEDIUM	3