buzz-appimage

maintainer corrm · 2 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt AppImage from GitHub releases, which is an unverifiable executable binary; if the source were compromised, it could execute arbitrary code, constituting a supply-chain risk.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

MEDIUM AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package downloads a prebuilt AppImage from GitHub releases, which is an unverifiable executable binary; if the source were compromised, it could execute arbitrary code, constituting a supply-chain risk.

PKGBUILD

      1pkgname=buzz-appimage
    
      2pkgver=0.5.3
    
      3pkgrel=1
    
      4pkgdesc="Self-hostable workspace where humans and AI agents build together, on a relay you own"
    
      5arch=(x86_64)
    
      6url="https://github.com/block/buzz"
    
      7license=(Apache-2.0)
    
      8
    
      9depends=("faac" "fuse2" "hicolor-icon-theme" "xdg-utils")
    
      10options=(!strip !debug)
    
      11conflicts=("buzz-bin" "buzz-git" "buzz-desktop-git")
    
      12
    
      13_appimage="Buzz_${pkgver}_amd64.AppImage"
    
      14source=("${_appimage}::https://github.com/block/buzz/releases/download/desktop-v0.5.3/Buzz_0.5.3_amd64.AppImage")
    
      15sha256sums=('5dc842a3dae32125fb662b32e1e3ddba65e2fb1c927744dfbb7bca7ea24cc2e3')
    
      16noextract=("${_appimage}")
    
      17
    
      18prepare() {
    
      19    chmod +x "${_appimage}"
    
      20    ./"${_appimage}" --appimage-extract
    
      21}
    
      22
    
      23package() {
    
      24    install -Dm755 "${srcdir}/${_appimage}" \
    
      25        "${pkgdir}/opt/${pkgname}/${_appimage}"
    
      26
    
      27    install -dm755 "${pkgdir}/usr/bin"
    
      28    ln -s "/opt/${pkgname}/${_appimage}" "${pkgdir}/usr/bin/buzz"
    
      29
    
      30    # Install extra files from srcdir (e.g., LICENSE alongside AppImage)
    
      31
    
      32    cd "${srcdir}/squashfs-root"
    
      33    find . -maxdepth 1 -name '*.desktop' -exec \
    
      34        install -Dm644 {} "${pkgdir}/usr/share/applications/buzz.desktop" \;
    
      35
    
      36    sed -i "s|Exec=.*|Exec=buzz %U|" \
    
      37        "${pkgdir}/usr/share/applications/buzz.desktop"
    
      38    sed -i "s|Icon=.*|Icon=buzz|" \
    
      39        "${pkgdir}/usr/share/applications/buzz.desktop"
    
      40    if [ -d usr/share/icons ]; then
    
      41        cp -r usr/share/icons "${pkgdir}/usr/share/"
    
      42        find "${pkgdir}/usr/share/icons" -type d -exec chmod 755 {} +
    
      43        find "${pkgdir}/usr/share/icons" -type f -exec chmod 644 {} +
    
      44        find "${pkgdir}/usr/share/icons" -name '*.png' -o -name '*.svg' | while read -r icon; do
    
      45            dir=$(dirname "$icon")
    
      46            base=$(basename "$icon")
    
      47            ext="${base##*.}"
    
      48            name="${base%.*}"
    
      49            [ "$name" = "buzz" ] && continue
    
      50            mv "$icon" "${dir}/buzz.${ext}"
    
      51        done
    
      52    fi
    
      53    # Install root-level icons to pixmaps (first matching png or svg)
    
      54    for f in *.png *.svg; do
    
      55        [ -f "$f" ] || continue
    
      56        ext="${f##*.}"
    
      57        install -Dm644 "$f" "${pkgdir}/usr/share/pixmaps/buzz.${ext}"
    
      58        break
    
      59    done
    
      60}

Changes since previous scan

--- PKGBUILD @ 2026-07-31 00:14
+++ PKGBUILD @ 2026-08-03 00:08
@@ -1,6 +1,6 @@
 pkgname=buzz-appimage
-pkgver=0.5.2
-pkgrel=4
+pkgver=0.5.3
+pkgrel=1
 pkgdesc="Self-hostable workspace where humans and AI agents build together, on a relay you own"
 arch=(x86_64)
 url="https://github.com/block/buzz"
@@ -11,8 +11,8 @@
 conflicts=("buzz-bin" "buzz-git" "buzz-desktop-git")
 
 _appimage="Buzz_${pkgver}_amd64.AppImage"
-source=("${_appimage}::https://github.com/block/buzz/releases/download/v0.5.2/Buzz_0.5.2_amd64.AppImage")
-sha256sums=('68c1048346720d7d3c398ccb701e9df1eebdcd1acd7ea0b25a5d42e956428b87')
+source=("${_appimage}::https://github.com/block/buzz/releases/download/desktop-v0.5.3/Buzz_0.5.3_amd64.AppImage")
+sha256sums=('5dc842a3dae32125fb662b32e1e3ddba65e2fb1c927744dfbb7bca7ea24cc2e3')
 noextract=("${_appimage}")
 
 prepare() {

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 23:19:22	MEDIUM	2
2026-07-31 00:14:10	LOW	2
2026-07-30 01:13:52	LOW	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 23:13:22	MEDIUM	2