criptext-bin

maintainer ajgraves · 9 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt AppImage binary from cdn.criptext.com (the official Criptext CDN, not a personal/unofficial host), extracts it, and installs it system-wide. While cdn.criptext.com is the vendor's own CDN rather than a random personal host, it is still a prebuilt binary blob being executed during the build process (AppImage --appimage-extract runs the binary). The sha512sums are present and pin the specific artifact, which mitigates substitution risk significantly. However, the pattern of downloading and executing a prebuilt binary from a CDN (even an official one) rather than building from source is a legitimate medium-severity supply-chain concern: if the CDN were compromised or the checksum were updated to match a malicious binary, arbitrary code would execute. This is a standard -bin package pattern in AUR and the checksums provide meaningful protection, but the risk is real enough to remain medium rather than clean.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source=("${pkgname%-bin}-${pkgver}-${pkgrel}.AppImage::https://cdn.criptext.com/Criptext-Email-Desktop/linux/Criptext-${pkgver}.AppImage"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 75%): The PKGBUILD downloads a prebuilt AppImage binary from cdn.criptext.com (the official Criptext CDN, not a personal/unofficial host), extracts it, and installs it system-wide. While cdn.criptext.com is the vendor's own CDN rather than a random personal host, it is still a prebuilt binary blob being executed during the build process (AppImage --appimage-extract runs the binary). The sha512sums are present and pin the specific artifact, which mitigates substitution risk significantly. However, the pattern of downloading and executing a prebuilt binary from a CDN (even an official one) rather than building from source is a legitimate medium-severity supply-chain concern: if the CDN were compromised or the checksum were updated to match a malicious binary, arbitrary code would execute. This is a standard -bin package pattern in AUR and the checksums provide meaningful protection, but the risk is real enough to remain medium rather than clean.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Aaron J Graves <linux@ajgraves.com>
    
      2pkgname=criptext-bin
    
      3pkgver=0.31.0
    
      4pkgrel=2
    
      5pkgdesc='Official Criptext encrypted email client'
    
      6arch=('x86_64')
    
      7url='https://criptext.com/'
    
      8license=('GPL2')
    
      9provides=("${pkgname}")
    
      10conflicts=("${pkgname}")
    
      11depends=('electron' 'libsecret')
    
      12optdepends=('org.freedesktop.secrets: for storing passwords'
    
      13            'gnome-keyring: for storing passwords in GNOME Keyring')
    
      14options=(!strip)
    
      15source=("${pkgname%-bin}-${pkgver}-${pkgrel}.AppImage::https://cdn.criptext.com/Criptext-Email-Desktop/linux/Criptext-${pkgver}.AppImage"
    
      16	"criptext"
    
      17	"LICENSE")
    
      18sha512sums=('450a07133c32a86ece652aec68583421006d6571a5e24cf4963bc7bd746f6ccafc4590ea52d0868ffa0e82367d916d4bb050c57e66ea32bc7458ec87f6ce8e48'
    
      19	    '1665c4e992f91c00aab96a39b62c736731727a371c146923cf575d64a7e723f082170f115dc2fe87c6b5510a2f2e0fb12f111e947f6d2da994472d48887a2f5b'
    
      20	    'aee80b1f9f7f4a8a00dcf6e6ce6c41988dcaedc4de19d9d04460cbfb05d99829ffe8f9d038468eabbfba4d65b38e8dbef5ecf5eb8a1b891d9839cda6c48ee957')
    
      21
    
      22prepare() {
    
      23  chmod +x ${srcdir}/${pkgname%-bin}-${pkgver}-${pkgrel}.AppImage
    
      24  ${srcdir}/${pkgname%-bin}-${pkgver}-${pkgrel}.AppImage --appimage-extract
    
      25
    
      26  # Update .desktop file
    
      27  sed -i 's|Exec=AppRun|Exec=/usr/bin/criptext|g' \
    
      28	"${srcdir}/squashfs-root/${pkgname%-bin}.desktop"
    
      29}
    
      30
    
      31package() {
    
      32  find ${srcdir}/squashfs-root/{locales,resources,usr/share/icons}/ -type d -exec chmod 755 {} +
    
      33  install -d ${pkgdir}/opt/${pkgname}
    
      34  cp -r ${srcdir}/squashfs-root/* ${pkgdir}/opt/${pkgname}
    
      35  rm -r ${pkgdir}/opt/${pkgname}/usr/
    
      36
    
      37  install -d ${pkgdir}/usr/share/icons
    
      38  cp -r ${srcdir}/squashfs-root/usr/share/icons/hicolor ${pkgdir}/usr/share/icons/hicolor
    
      39
    
      40  install -Dm644 "${srcdir}/squashfs-root/${pkgname%-bin}.desktop" -t "${pkgdir}/usr/share/applications"
    
      41
    
      42  install -Dm755 ${srcdir}/criptext ${pkgdir}/usr/bin/criptext
    
      43  install -Dm444 ${srcdir}/LICENSE ${pkgdir}/usr/share/licenses/${pkgname}/LICENSE
    
      44}
    
      45
    
      46

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2