criptext-bin

MEDIUM

maintainer ajgraves 9 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The PKGBUILD downloads a prebuilt AppImage binary from cdn.criptext.com (the official Criptext CDN, not a personal/unofficial host), extracts it, and installs it system-wide. While cdn.criptext.com is the vendor's own CDN rather than a random personal host, it is still a prebuilt binary blob being executed during the build process (AppImage --appimage-extract runs the binary). The sha512sums are present and pin the specific artifact, which mitigates substitution risk significantly. However, the pattern of downloading and executing a prebuilt binary from a CDN (even an official one) rather than building from source is a legitimate medium-severity supply-chain concern: if the CDN were compromised or the checksum were updated to match a malicious binary, arbitrary code would execute. This is a standard -bin package pattern in AUR and the checksums provide meaningful protection, but the risk is real enough to remain medium rather than clean.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source=("${pkgname%-bin}-${pkgver}-${pkgrel}.AppImage::https://cdn.criptext.com/Criptext-Email-Desktop/linux/Criptext-${pkgver}.AppImage"

Medium AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 75%): The PKGBUILD downloads a prebuilt AppImage binary from cdn.criptext.com (the official Criptext CDN, not a personal/unofficial host), extracts it, and installs it system-wide. While cdn.criptext.com is the vendor's own CDN rather than a random personal host, it is still a prebuilt binary blob being executed during the build process (AppImage --appimage-extract runs the binary). The sha512sums are present and pin the specific artifact, which mitigates substitution risk significantly. However, the pattern of downloading and executing a prebuilt binary from a CDN (even an official one) rather than building from source is a legitimate medium-severity supply-chain concern: if the CDN were compromised or the checksum were updated to match a malicious binary, arbitrary code would execute. This is a standard -bin package pattern in AUR and the checksums provide meaningful protection, but the risk is real enough to remain medium rather than clean.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Aaron J Graves <linux@ajgraves.com>
    
      2pkgname=criptext-bin
    
      3pkgver=0.31.0
    
      4pkgrel=2
    
      5pkgdesc='Official Criptext encrypted email client'
    
      6arch=('x86_64')
    
      7url='https://criptext.com/'
    
      8license=('GPL2')
    
      9provides=("${pkgname}")
    
      10conflicts=("${pkgname}")
    
      11depends=('electron' 'libsecret')
    
      12optdepends=('org.freedesktop.secrets: for storing passwords'
    
      13            'gnome-keyring: for storing passwords in GNOME Keyring')
    
      14options=(!strip)
    
      15source=("${pkgname%-bin}-${pkgver}-${pkgrel}.AppImage::https://cdn.criptext.com/Criptext-Email-Desktop/linux/Criptext-${pkgver}.AppImage"
    
      16	"criptext"
    
      17	"LICENSE")
    
      18sha512sums=('450a07133c32a86ece652aec68583421006d6571a5e24cf4963bc7bd746f6ccafc4590ea52d0868ffa0e82367d916d4bb050c57e66ea32bc7458ec87f6ce8e48'
    
      19	    '1665c4e992f91c00aab96a39b62c736731727a371c146923cf575d64a7e723f082170f115dc2fe87c6b5510a2f2e0fb12f111e947f6d2da994472d48887a2f5b'
    
      20	    'aee80b1f9f7f4a8a00dcf6e6ce6c41988dcaedc4de19d9d04460cbfb05d99829ffe8f9d038468eabbfba4d65b38e8dbef5ecf5eb8a1b891d9839cda6c48ee957')
    
      21
    
      22prepare() {
    
      23  chmod +x ${srcdir}/${pkgname%-bin}-${pkgver}-${pkgrel}.AppImage
    
      24  ${srcdir}/${pkgname%-bin}-${pkgver}-${pkgrel}.AppImage --appimage-extract
    
      25
    
      26  # Update .desktop file
    
      27  sed -i 's|Exec=AppRun|Exec=/usr/bin/criptext|g' \
    
      28	"${srcdir}/squashfs-root/${pkgname%-bin}.desktop"
    
      29}
    
      30
    
      31package() {
    
      32  find ${srcdir}/squashfs-root/{locales,resources,usr/share/icons}/ -type d -exec chmod 755 {} +
    
      33  install -d ${pkgdir}/opt/${pkgname}
    
      34  cp -r ${srcdir}/squashfs-root/* ${pkgdir}/opt/${pkgname}
    
      35  rm -r ${pkgdir}/opt/${pkgname}/usr/
    
      36
    
      37  install -d ${pkgdir}/usr/share/icons
    
      38  cp -r ${srcdir}/squashfs-root/usr/share/icons/hicolor ${pkgdir}/usr/share/icons/hicolor
    
      39
    
      40  install -Dm644 "${srcdir}/squashfs-root/${pkgname%-bin}.desktop" -t "${pkgdir}/usr/share/applications"
    
      41
    
      42  install -Dm755 ${srcdir}/criptext ${pkgdir}/usr/bin/criptext
    
      43  install -Dm444 ${srcdir}/LICENSE ${pkgdir}/usr/share/licenses/${pkgname}/LICENSE
    
      44}
    
      45
    
      46

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Medium	2
2026-10-31 00:07:41	Medium	2
2026-10-30 00:29:30	Medium	2
2026-10-29 00:13:55	Medium	2
2026-10-28 00:06:54	Medium	2
2026-10-27 00:23:28	Medium	2
2026-10-26 00:12:40	Medium	2
2026-10-25 00:20:48	Medium	2
2026-10-24 00:14:55	Medium	2
2026-10-23 00:02:19	Medium	2
2026-10-22 00:13:10	Medium	2
2026-10-21 00:12:50	Medium	2
2026-10-20 00:10:31	Medium	2
2026-10-19 00:03:55	Medium	2
2026-10-18 00:06:55	Medium	2
2026-10-17 00:21:55	Medium	2
2026-10-16 00:12:47	Medium	2
2026-10-15 00:28:05	Medium	2
2026-10-14 00:06:47	Medium	2
2026-10-13 00:23:45	Medium	2