benben-appimage

MEDIUM

maintainer ParadiseofMagic 0 votes scanned 2026-10-06 00:19:23.678998

View on AUR

Why flagged

A prebuilt AppImage binary is downloaded from chiselapp.com (a personal/niche Fossil SCM hosting service), which is not the project's own well-known official release infrastructure and could be silently swapped; the binary is executed at build time (--appimage-extract) and installed directly, making it an unverifiable prebuilt executable from a non-mainstream host.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:18 https://chiselapp.com/user/MistressRemilia/repository/benben/uv/"${_appimage}"

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): A prebuilt AppImage binary is downloaded from chiselapp.com (a personal/niche Fossil SCM hosting service), which is not the project's own well-known official release infrastructure and could be silently swapped; the binary is executed at build time (--appimage-extract) and installed directly, making it an unverifiable prebuilt executable from a non-mainstream host.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Keon Cachia <keonfarrugia@gmail.com>
    
      2
    
      3pkgname=benben-appimage
    
      4pkgver=0.7.1
    
      5_pkgname=benben
    
      6_appimage="${_pkgname}"-"${pkgver}"-x86_64.AppImage
    
      7pkgrel=1
    
      8pkgdesc="An oldschool fast and efficient CLI audio player"
    
      9arch=("x86_64")
    
      10url="https://chiselapp.com/user/MistressRemilia/repository/benben/home"
    
      11license=('AGPL-3.0-or-later')
    
      12depends=("fuse2")
    
      13optdepends=("remote-benben: Used to control from Unix socket")
    
      14provides=("${_pkgname}")
    
      15conflicts=("${_pkgname}")
    
      16options=("!strip")
    
      17source=(
    
      18    https://chiselapp.com/user/MistressRemilia/repository/benben/uv/"${_appimage}"
    
      19)
    
      20sha256sums=('37f6545c35f35d952c313e9f9398b01c7bc67957457b1f35a29056291ead8165')
    
      21
    
      22prepare() {
    
      23  chmod +x "${_appimage}"
    
      24  "./${_appimage}" --appimage-extract
    
      25}
    
      26
    
      27package() {
    
      28  install -Dm755 "${_appimage}" "${pkgdir}/usr/bin/benben"
    
      29  install -Dm644 -t "${pkgdir}/usr/share/applications" "squashfs-root/${_pkgname}.desktop"
    
      30}
    
      31

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-06 00:19:23	Medium	3
2026-10-06 00:13:36	Medium	3
2026-10-05 23:40:58	Medium	3