bootstrap-studio

maintainer nathawat_a · 14 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt AppImage binary from releases.bootstrapstudio.io, which is the official vendor release host for Bootstrap Studio (bootstrapstudio.io). This is a legitimate commercial application distributed by its vendor via their own subdomain. The b2sums are pinned, providing integrity verification. However, the pattern of installing a prebuilt proprietary binary from a vendor-controlled (non-GitHub/GitLab) host does carry a real supply-chain risk: if the vendor's release server were compromised or the binary swapped, users would execute arbitrary code. This is the standard medium-risk pattern for prebuilt proprietary AppImage packages in the AUR — not clearly malicious, but not from a universally auditable source. The PKGBUILD itself is straightforward: extract AppImage, copy to /opt, create launcher script. No obfuscation, no exfiltration, no piracy concerns (this is a paid commercial tool being packaged, not cracked).

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:24 source=("https://releases.bootstrapstudio.io/${pkgver}/Bootstrap%20Studio.AppImage"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt AppImage binary from releases.bootstrapstudio.io, which is the official vendor release host for Bootstrap Studio (bootstrapstudio.io). This is a legitimate commercial application distributed by its vendor via their own subdomain. The b2sums are pinned, providing integrity verification. However, the pattern of installing a prebuilt proprietary binary from a vendor-controlled (non-GitHub/GitLab) host does carry a real supply-chain risk: if the vendor's release server were compromised or the binary swapped, users would execute arbitrary code. This is the standard medium-risk pattern for prebuilt proprietary AppImage packages in the AUR — not clearly malicious, but not from a universally auditable source. The PKGBUILD itself is straightforward: extract AppImage, copy to /opt, create launcher script. No obfuscation, no exfiltration, no piracy concerns (this is a paid commercial tool being packaged, not cracked).

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer:  nathawat <nathawat at noreply dot codeberg dot org>
    
      2# Contributor: Mohamed tarek <Mokhamed_tarek@mail.ru>
    
      3# Contributor: rotzelbart <tausendkubik@gmail.com>
    
      4# Contributor: TechVio <68242352+techvio1@users.noreply.github.com>
    
      5# Contributor: chn <g897331845@gmail.com>
    
      6# Contributor: Hunter Wittenborn <git@hunterwittenborn.me>
    
      7# Contributor: Alfin Bakhtiar Ilhami <alfin at nuclea dot id>
    
      8# Contributor: Jan-Tarek Butt <tarek at ring0 dot de>
    
      9
    
      10pkgname=bootstrap-studio
    
      11pkgver=8.0.1
    
      12pkgrel=1
    
      13pkgdesc="Bootstrap Studio is a powerful tool which web developers and designers use to create layouts and fully functional websites using the Bootstrap framework."
    
      14arch=("x86_64")
    
      15license=("custom")
    
      16url="https://bootstrapstudio.io/"
    
      17depends=(
    
      18    'alsa-lib'
    
      19    'gtk3'
    
      20    'libcups'
    
      21    'nss'
    
      22)
    
      23
    
      24source=("https://releases.bootstrapstudio.io/${pkgver}/Bootstrap%20Studio.AppImage"
    
      25        "bstudio.desktop")
    
      26b2sums=('c7dd0e6493fb6317cf4f6da7f2bd83a0e13de4de44a9f8a2455521de07240a8b86512a6ccfbbc0799ff17c09753502b16a9aaefc34ecefee91874775e448a814'
    
      27        '6588d6c99396a05eafa74ca0e4d0c1113ff927f0fc6afc6cf549bf251b1f03a742d0a39d5e1b8bffd0052b49196357daafef371c1ebd49efc16ef353ab3d9daa')
    
      28prepare() {
    
      29    # Extract AppImage
    
      30    echo "Extracting AppImage..."
    
      31    mv "Bootstrap%20Studio.AppImage" "Bootstrap Studio.AppImage"
    
      32    chmod +x "Bootstrap Studio.AppImage"
    
      33    ./"Bootstrap Studio.AppImage" --appimage-extract &> /dev/null
    
      34}
    
      35
    
      36package() {
    
      37    # Copy package files
    
      38    echo "Copying package files..."
    
      39    mkdir -p "${pkgdir}/opt/${pkgname}"
    
      40    cp -Lr "${srcdir}/squashfs-root" "${pkgdir}/opt/${pkgname}"
    
      41
    
      42    # Set permissions
    
      43    chmod a+rx "${pkgdir}/opt/${pkgname}/" -R
    
      44
    
      45    # Create launcher script
    
      46    mkdir -p "${pkgdir}/usr/bin"
    
      47    cat > "${pkgdir}/usr/bin/${pkgname}" << EOF
    
      48#!/bin/bash
    
      49if [ \$# -eq 0 ]; then
    
      50    /opt/${pkgname}/squashfs-root/AppRun
    
      51else
    
      52    /opt/${pkgname}/squashfs-root/AppRun "\$@"
    
      53fi
    
      54EOF
    
      55    chmod +x "${pkgdir}/usr/bin/${pkgname}"
    
      56
    
      57    # Copy .desktop file
    
      58    mkdir -p "${pkgdir}/usr/share/applications"
    
      59    cp -Lr "${srcdir}/bstudio.desktop" "${pkgdir}/usr/share/applications/"
    
      60
    
      61    # Copy icons
    
      62    mkdir -p "${pkgdir}/usr/share/icons/hicolor/"{128x128,192x192,256x256,512x512}"/apps/"
    
      63    for i in 128x128 192x192 256x256 512x512; do
    
      64        cp -Lr "${srcdir}/squashfs-root/usr/share/icons/hicolor/0x0/apps/bstudio.png" "${pkgdir}/usr/share/icons/hicolor/${i}/apps/"
    
      65    done
    
      66}
    
      67

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2