botim-appimage

maintainer lightning1141 · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt AppImage binary from cdn-web-sg.botim.me, which is the official CDN for the BOTIM messaging application (botim.me). The domain is project-specific but appears to be the legitimate vendor CDN rather than a personal or third-party host. A sha256 checksum is provided, which provides integrity verification against the known hash. However, the core concern remains: this is a closed-source, prebuilt executable binary installed system-wide (/opt and /usr/bin) with no source build, no GPG signature verification, and no reproducibility. If the CDN were compromised or the hash were wrong, arbitrary code would execute as the user. This is the standard AppImage packaging pattern in AUR and is not unusual, but the binary-from-CDN model with only a hash (no GPG) is a genuine medium-level supply-chain concern. The cheaper model's assessment is essentially correct for this category of package.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:18 source_x86_64=("${_appimage}::https://cdn-web-sg.botim.me/downloads/desktop/linux/${pkgver}/Botim-${pkgver}.AppImage")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt AppImage binary from cdn-web-sg.botim.me, which is the official CDN for the BOTIM messaging application (botim.me). The domain is project-specific but appears to be the legitimate vendor CDN rather than a personal or third-party host. A sha256 checksum is provided, which provides integrity verification against the known hash. However, the core concern remains: this is a closed-source, prebuilt executable binary installed system-wide (/opt and /usr/bin) with no source build, no GPG signature verification, and no reproducibility. If the CDN were compromised or the hash were wrong, arbitrary code would execute as the user. This is the standard AppImage packaging pattern in AUR and is not unusual, but the binary-from-CDN model with only a hash (no GPG) is a genuine medium-level supply-chain concern. The cheaper model's assessment is essentially correct for this category of package.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Light Ning <aur at i01 dot io>
    
      2# Based  on the template from https://daveparrish.net/posts/2019-11-16-Better-AppImage-PKGBUILD-template.html
    
      3
    
      4_pkgname=botim
    
      5
    
      6pkgname="${_pkgname}"-appimage
    
      7pkgver=1.7.5
    
      8pkgrel=0
    
      9pkgdesc="BOTIM - Free, Secure & Reliable Messages and Calls"
    
      10arch=('x86_64')
    
      11url="https://botim.me"
    
      12license=('custom:Commercial')
    
      13depends=('zlib' 'hicolor-icon-theme' 'fuse2')
    
      14provides=("${_pkgname}")
    
      15conflicts=("${_pkgname}" 'botim-bin')
    
      16options=(!strip)
    
      17_appimage="${pkgname}-${pkgver}.AppImage"
    
      18source_x86_64=("${_appimage}::https://cdn-web-sg.botim.me/downloads/desktop/linux/${pkgver}/Botim-${pkgver}.AppImage")
    
      19noextract=("${_appimage}")
    
      20sha256sums_x86_64=('9841933e77a3c08436dbce425ecf1adfc67c4a843378a93408de4151a6fbb0d7')
    
      21
    
      22prepare() {
    
      23    chmod +x "${_appimage}"
    
      24    ./"${_appimage}" --appimage-extract
    
      25}
    
      26
    
      27build() {
    
      28    # Adjust .desktop so it will work outside of AppImage container
    
      29    sed -i -E "s|Exec=AppRun|Exec=env DESKTOPINTEGRATION=false /usr/bin/${_pkgname} %u|"\
    
      30        "squashfs-root/${_pkgname}.desktop"
    
      31    # Fix permissions; .AppImage permissions are 700 for all directories
    
      32    chmod -R a-x+rX squashfs-root/usr
    
      33}
    
      34
    
      35package() {
    
      36    # AppImage
    
      37    install -Dm755 "${srcdir}/${_appimage}" "${pkgdir}/opt/${pkgname}/${pkgname}.AppImage"
    
      38
    
      39    # Desktop file
    
      40    install -Dm644 "${srcdir}/squashfs-root/${_pkgname}.desktop"\
    
      41            "${pkgdir}/usr/share/applications/${_pkgname}.desktop"
    
      42
    
      43    # Icon images
    
      44    install -dm755 "${pkgdir}/usr/share/"
    
      45    cp -a "${srcdir}/squashfs-root/usr/share/icons" "${pkgdir}/usr/share/"
    
      46
    
      47    # Symlink executable
    
      48    install -dm755 "${pkgdir}/usr/bin"
    
      49    ln -s "/opt/${pkgname}/${pkgname}.AppImage" "${pkgdir}/usr/bin/${_pkgname}"
    
      50}
    
      51

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2