cursor-appimage

MEDIUM

maintainer ali.molaei 1 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads a prebuilt AppImage from a non-standard host (downloads.cursor.com) which is not on the standard whitelist; while the source is likely official, the unverifiable nature of the binary executable from a non-standard domain constitutes a supply-chain risk.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:22 "Cursor-${pkgver}.AppImage::https://downloads.cursor.com/production/${_commit}/linux/x64/Cursor-${pkgver}-x86_64.AppImage"

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt AppImage from a non-standard host (downloads.cursor.com) which is not on the standard whitelist; while the source is likely official, the unverifiable nature of the binary executable from a non-standard domain constitutes a supply-chain risk.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: kewl fft <kewl@alto.eu.org>
    
      2
    
      3pkgname=cursor-appimage
    
      4pkgver=3.27.14
    
      5pkgrel=1
    
      6_ver=3.27
    
      7_commit="69b724ebc67ec522c1b5d287a5025f7a7e81be97"
    
      8pkgdesc="Cursor AI code editor (AppImage, extracted)"
    
      9arch=('x86_64')
    
      10url="https://www.cursor.com"
    
      11license=('custom')
    
      12depends=('glibc' 'gtk3' 'nss' 'libxss' 'alsa-lib')
    
      13conflicts=('cursor-bin')
    
      14provides=('cursor')
    
      15options=(!strip)
    
      16_watch=(
    
      17  'https://api2.cursor.sh/updates/download/golden/linux-x64/cursor/${_ver}' 'header' 'regex' 'Cursor-([0-9.]+)-x86_64.AppImage' 'pkgver'
    
      18  'https://api2.cursor.sh/updates/download/golden/linux-x64/cursor/${_ver}' 'header' 'regex' 'location:.*production/([a-f0-9]+)/' '_commit'
    
      19)
    
      20
    
      21source=(
    
      22  "Cursor-${pkgver}.AppImage::https://downloads.cursor.com/production/${_commit}/linux/x64/Cursor-${pkgver}-x86_64.AppImage"
    
      23)
    
      24
    
      25sha512sums=('8078590e84ca94df21ab3bb168ab9bdcd35e9be359775ed846a5485af679584730e382fdd9d64a06dfe35dbb39630ff82d283ca46e0fb27656735e7305720961')
    
      26
    
      27prepare() {
    
      28  cd "${srcdir}"
    
      29  chmod +x Cursor-${pkgver}.AppImage
    
      30  ./Cursor-${pkgver}.AppImage --appimage-extract
    
      31}
    
      32
    
      33package() {
    
      34  install -d "${pkgdir}/opt/cursor"
    
      35  cp -a squashfs-root/* "${pkgdir}/opt/cursor/"
    
      36  chmod -R 755 "${pkgdir}/opt/cursor/"
    
      37
    
      38  # --- FIX APPIMAGE ---
    
      39  # Replace broken AppRun with working launcher
    
      40  cat > "${pkgdir}/opt/cursor/AppRun" <<'EOF'
    
      41#!/bin/bash
    
      42HERE="$(cd "$(dirname "$0")" && pwd)"
    
      43
    
      44export PATH="$HERE/usr/bin:$PATH"
    
      45export LD_LIBRARY_PATH="$HERE/usr/lib:$HERE/usr/lib64:$HERE/lib:$LD_LIBRARY_PATH"
    
      46export XDG_DATA_DIRS="$HERE/usr/share:$XDG_DATA_DIRS"
    
      47
    
      48exec "$HERE/usr/share/cursor/cursor" "$@"
    
      49EOF
    
      50
    
      51  chmod +x "${pkgdir}/opt/cursor/AppRun"
    
      52
    
      53  # chrome sandbox (required by Electron)
    
      54  if [[ -f "${pkgdir}/opt/cursor/chrome-sandbox" ]]; then
    
      55    chmod 4755 "${pkgdir}/opt/cursor/chrome-sandbox"
    
      56  fi
    
      57
    
      58  # CLI launcher
    
      59  install -Dm755 /dev/stdin "${pkgdir}/usr/bin/cursor" <<'EOF'
    
      60#!/bin/bash
    
      61exec /opt/cursor/AppRun "$@"
    
      62EOF
    
      63
    
      64  # Desktop entry
    
      65  install -Dm644 squashfs-root/cursor.desktop \
    
      66    "${pkgdir}/usr/share/applications/cursor.desktop"
    
      67
    
      68  sed -i 's|^Exec=.*|Exec=cursor %F|' \
    
      69    "${pkgdir}/usr/share/applications/cursor.desktop"
    
      70
    
      71  sed -i 's|^Icon=.*|Icon=cursor|' \
    
      72    "${pkgdir}/usr/share/applications/cursor.desktop"
    
      73
    
      74  # Icons
    
      75  for size in 16 32 48 64 128 256 512; do
    
      76    icon="squashfs-root/usr/share/icons/hicolor/${size}x${size}/apps/cursor.png"
    
      77    [[ -f "$icon" ]] && install -Dm644 "$icon" \
    
      78      "${pkgdir}/usr/share/icons/hicolor/${size}x${size}/apps/cursor.png"
    
      79  done
    
      80}
    
      81

Changes since previous scan

--- PKGBUILD @ 2026-10-31 00:07
+++ PKGBUILD @ 2026-11-01 00:21
@@ -1,10 +1,10 @@
 # Maintainer: kewl fft <kewl@alto.eu.org>
 
 pkgname=cursor-appimage
-pkgver=3.25.6
+pkgver=3.27.14
 pkgrel=1
-_ver=3.25
-_commit="f0df777c412b670d09e3eaf214967d779e67c088"
+_ver=3.27
+_commit="69b724ebc67ec522c1b5d287a5025f7a7e81be97"
 pkgdesc="Cursor AI code editor (AppImage, extracted)"
 arch=('x86_64')
 url="https://www.cursor.com"
@@ -22,7 +22,7 @@
   "Cursor-${pkgver}.AppImage::https://downloads.cursor.com/production/${_commit}/linux/x64/Cursor-${pkgver}-x86_64.AppImage"
 )
 
-sha512sums=('986d5d79d88286097b2a59b71aa9d9d8a14b75d911d1ceb638d88274c61edc473e0b26b4d478218bd8fcac6e9016dfbbda3277c651a271feed07c62969fd7260')
+sha512sums=('8078590e84ca94df21ab3bb168ab9bdcd35e9be359775ed846a5485af679584730e382fdd9d64a06dfe35dbb39630ff82d283ca46e0fb27656735e7305720961')
 
 prepare() {
   cd "${srcdir}"

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Medium	2
2026-10-31 07:58:04	Medium	2
2026-10-31 00:07:41	Medium	2
2026-10-30 00:29:30	Medium	2
2026-10-29 00:13:55	Medium	2
2026-10-28 00:06:54	Medium	2
2026-10-27 05:46:44	Medium	2
2026-10-27 00:23:28	Medium	2
2026-10-26 00:12:40	Medium	2
2026-10-25 00:20:48	Medium	2
2026-10-24 00:14:55	Medium	2
2026-10-23 00:02:19	Medium	2
2026-10-22 00:13:10	Medium	2
2026-10-21 00:12:50	Medium	2
2026-10-20 00:10:31	Medium	2
2026-10-19 00:03:55	Medium	2
2026-10-18 00:06:55	Medium	2
2026-10-17 07:17:15	Medium	2
2026-10-17 00:21:55	Medium	2
2026-10-16 00:12:47	Medium	2