citra-appimage

maintainer AlphaJack · 14 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD installs prebuilt AppImage binaries (executed code) downloaded from archive.org, which is a third-party archival host rather than the official Citra project release infrastructure. The source is specifically a 'pablomk7-fork' path on archive.org, meaning these are binaries built and uploaded by an individual, not the upstream project. While b2sums are present (providing integrity verification against tampering in transit), they only guarantee the file hasn't changed since the maintainer wrote the PKGBUILD — they do not verify the provenance or trustworthiness of the binaries themselves. The AppImages are installed directly as executables in /usr/bin. This is a genuine supply-chain concern: an unofficial personal fork's binaries hosted on a mutable archive.org collection, executed directly on the user's system. Note also that Citra was officially shut down in March 2024 due to a Nintendo lawsuit, so this is a fork/archive of discontinued software, which adds further uncertainty about the source's legitimacy and maintenance. The medium rating from the cheaper model is correct.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:24 source=("https://archive.org/download/citra-emulator-pablomk7-fork/git/r$_commit/citra-linux-appimage-$pkgver-$_commit.tar.gz"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 78%): This PKGBUILD installs prebuilt AppImage binaries (executed code) downloaded from archive.org, which is a third-party archival host rather than the official Citra project release infrastructure. The source is specifically a 'pablomk7-fork' path on archive.org, meaning these are binaries built and uploaded by an individual, not the upstream project. While b2sums are present (providing integrity verification against tampering in transit), they only guarantee the file hasn't changed since the maintainer wrote the PKGBUILD — they do not verify the provenance or trustworthiness of the binaries themselves. The AppImages are installed directly as executables in /usr/bin. This is a genuine supply-chain concern: an unofficial personal fork's binaries hosted on a mutable archive.org collection, executed directly on the user's system. Note also that Citra was officially shut down in March 2024 due to a Nintendo lawsuit, so this is a fork/archive of discontinued software, which adds further uncertainty about the source's legitimacy and maintenance. The medium rating from the cheaper model is correct.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: AlphaJack <alphajack at tuta dot io>
    
      2
    
      3pkgname="citra-appimage"
    
      4pkgver="20240927"
    
      5_commit="608383e"
    
      6pkgrel=1
    
      7epoch=1
    
      8pkgdesc="An experimental open-source Nintendo 3DS emulator/debugger, GUI version, already compiled"
    
      9url="https://citra-emu.org"
    
      10license=("GPL2")
    
      11arch=("x86_64")
    
      12provides=("citra")
    
      13conflicts=("citra-bin"
    
      14           "citra-git"
    
      15           "citra-canary-bin"
    
      16           "citra-canary-git"
    
      17           "citra-qt-git"
    
      18           "citra-qt-canary-bin"
    
      19           "citra-qt-bin")
    
      20replaces=("citra-bin"
    
      21          "citra-qt-bin")
    
      22depends=("ffmpeg"
    
      23         "sdl2")
    
      24source=("https://archive.org/download/citra-emulator-pablomk7-fork/git/r$_commit/citra-linux-appimage-$pkgver-$_commit.tar.gz"
    
      25        "citra.desktop")
    
      26b2sums=('74d037791de0d37124d6064e698f30f7b1a13d0b6f3fdc391d0bba97fbe1b0501719fdaef09f8550961c79b5b3e0d28e6cd07e95ef55ebf6a669e22a506578c2'
    
      27        '1c12c015380367b599cb56cabfdcf9065e2cbb04e3145d0dcfdfc5e2cb404926c2851e58383c930f569b67da8f89095164b7d1f482f39fb5e1f5a1c26e1853b0')
    
      28options=("!strip")
    
      29
    
      30package(){
    
      31 cd "citra-linux-appimage-$pkgver-$_commit"
    
      32 install -D -m 755 "citra.AppImage"       "$pkgdir/usr/bin/citra"
    
      33 install -D -m 755 "citra-room.AppImage"  "$pkgdir/usr/bin/citra-room"
    
      34 install -D -m 755 "citra-qt.AppImage"    "$pkgdir/usr/bin/citra-qt"
    
      35 install -D -m 755 "scripting/citra.py"    -t "$pkgdir/usr/bin"
    
      36 install -D -m 644 "dist/citra.png"        -t "$pkgdir/usr/share/pixmaps"
    
      37 install -D -m 644 "$srcdir/citra.desktop" -t "$pkgdir/usr/share/applications"
    
      38}
    
      39
    
      40

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2