cajviewer-appimage

maintainer orphaned · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary AppImage from download.cnki.net (the official CNKI/China National Knowledge Infrastructure distribution host, matching the package's stated url cajviewer.cnki.net). The AppImage is then extracted and executed during prepare() via --appimage-extract, and the binary itself is installed as an executable. While download.cnki.net appears to be the legitimate vendor distribution host for this Chinese academic software, it is not a well-known or widely audited source, and there is no GPG signature verification — only a sha512 checksum. The checksum provides integrity protection against silent substitution at rest, but not against the vendor serving a malicious binary in the first place. This is a standard pattern for AppImage packaging in the AUR (prebuilt vendor binary, no source build), which is inherently a medium-level supply-chain concern: users must trust the vendor binary entirely. There is no obfuscation, no exfiltration, and no signs of active malice, so this does not rise to high. The cheaper model's assessment of medium is correct for this class of package.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source=("https://download.cnki.net/${_pkgname}")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt binary AppImage from download.cnki.net (the official CNKI/China National Knowledge Infrastructure distribution host, matching the package's stated url cajviewer.cnki.net). The AppImage is then extracted and executed during prepare() via --appimage-extract, and the binary itself is installed as an executable. While download.cnki.net appears to be the legitimate vendor distribution host for this Chinese academic software, it is not a well-known or widely audited source, and there is no GPG signature verification — only a sha512 checksum. The checksum provides integrity protection against silent substitution at rest, but not against the vendor serving a malicious binary in the first place. This is a standard pattern for AppImage packaging in the AUR (prebuilt vendor binary, no source build), which is inherently a medium-level supply-chain concern: users must trust the vendor binary entirely. There is no obfuscation, no exfiltration, and no signs of active malice, so this does not rise to high. The cheaper model's assessment of medium is correct for this class of package.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: vvxxp8 <concatenate[g] the characters[x] in square[b] brackets[1] in[5] order[3] at gmail dot com
    
      2
    
      3pkgname=cajviewer-appimage
    
      4pkgver=210401
    
      5pkgrel=1
    
      6pkgdesc="CAJViewer for Linux"
    
      7arch=("x86_64")
    
      8url="http://cajviewer.cnki.net"
    
      9_pkgname="CAJViewer-${arch}-buildubuntu1604-${pkgver}.AppImage"
    
      10noextract=(${_pkgname})
    
      11options=("!strip")
    
      12provides=('cajviewer')
    
      13conflicts=('cajviewer')
    
      14source=("https://download.cnki.net/${_pkgname}")
    
      15sha512sums=("b503d0e39300978ecf6657097f8690321155b199b24393a75c1067e52f40ad8c67a374be61c02237989de44ebb6d04698815c40a6cb4a5ca3d8bb9ac11abaf13")
    
      16
    
      17_installdir=/opt/appimages
    
      18_installname=cajviewer
    
      19
    
      20prepare() {
    
      21	cd "${srcdir}"
    
      22	chmod a+x ${_pkgname}
    
      23	${srcdir}/${_pkgname} --appimage-extract
    
      24	sed -i "s+Exec=cajviewer+Exec=env DESKTOPINTEGRATION=no ${_installdir}/${_installname}.AppImage+" "squashfs-root/cajviewer.desktop"
    
      25	find "squashfs-root/usr/share/icons/hicolor" -type d -exec chmod 755 {} \;
    
      26}
    
      27
    
      28package() {
    
      29	install -dm755 "${pkgdir}/usr/share/icons"
    
      30	install -Dm755 ${_pkgname} "${pkgdir}/${_installdir}/${_installname}.AppImage"
    
      31	install -Dm644 "squashfs-root/${_installname}.desktop" "${pkgdir}/usr/share/applications/${_installname}.desktop"
    
      32	cp -R "squashfs-root/usr/share/icons/hicolor" "${pkgdir}/usr/share/icons"
    
      33}
    
      34

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2