deemix-gui-appimage

maintainer awhb · 5 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt Electron AppImage binary from archive.org (an unofficial, user-uploaded mirror) rather than from the upstream GitLab releases. The binary is then extracted and installed as an executable application. While sha256 and md5 checksums are present (providing some integrity guarantee against accidental corruption or simple substitution), archive.org is not a controlled release host — anyone could have uploaded this file, and the original upstream (gitlab.com/RemixDev/deemix-gui) is the authoritative source. The package version is pinned to a date (20221215) with no direct link to a tagged GitLab release asset, making provenance verification difficult. Executing an untrusted prebuilt AppImage binary from a non-official host is a genuine supply-chain concern, even with checksums, because the checksums only verify the file matches what was originally uploaded to archive.org, not that it matches an official upstream release. This is a real medium-severity concern.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 source=("https://archive.org/download/deemix/gui/${_originalappimagefilename}")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt Electron AppImage binary from archive.org (an unofficial, user-uploaded mirror) rather than from the upstream GitLab releases. The binary is then extracted and installed as an executable application. While sha256 and md5 checksums are present (providing some integrity guarantee against accidental corruption or simple substitution), archive.org is not a controlled release host — anyone could have uploaded this file, and the original upstream (gitlab.com/RemixDev/deemix-gui) is the authoritative source. The package version is pinned to a date (20221215) with no direct link to a tagged GitLab release asset, making provenance verification difficult. Executing an untrusted prebuilt AppImage binary from a non-official host is a genuine supply-chain concern, even with checksums, because the checksums only verify the file matches what was originally uploaded to archive.org, not that it matches an official upstream release. This is a real medium-severity concern.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: awhb
    
      2
    
      3_pkgname="deemix-gui"
    
      4_carchbase="x86"
    
      5_carchbit="64"
    
      6_originalappimagefilename="linux-x${_carchbit}-latest.AppImage"
    
      7_appimage="${_pkgname}.AppImage"
    
      8
    
      9pkgname="${_pkgname}-appimage"
    
      10pkgver=20221215
    
      11pkgrel=6
    
      12pkgdesc="A gui electron app for the deemix lib"
    
      13arch=("${_carchbase}_${_carchbit}")
    
      14url="https://gitlab.com/RemixDev/deemix-gui"
    
      15license=("GPL3")
    
      16depends=("alsa-lib" "dbus-glib" "gtk3" "libdbusmenu-gtk2" "libindicator-gtk2" "nss")
    
      17source=("https://archive.org/download/deemix/gui/${_originalappimagefilename}")
    
      18sha256sums=('7b69de7a6b00cc69e20695c83d86ca9392d01e860bbc58f9ffc42ccc27284d83')
    
      19md5sums=('1b51eeaa29ecea32af2c08f262fd576b')
    
      20
    
      21prepare() {
    
      22    mv ./${_originalappimagefilename} ./${_appimage}
    
      23    chmod u+x ./${_appimage}
    
      24    ./${_appimage} --appimage-extract
    
      25}
    
      26
    
      27package() {
    
      28    install -dm755 "${pkgdir}/usr/bin"
    
      29    install -dm755 "${pkgdir}/usr/lib"
    
      30    install -dm755 "${pkgdir}/usr/share"
    
      31    install -dm755 "${pkgdir}/usr/share/applications"
    
      32    install -dm755 "${pkgdir}/usr/share/licenses"
    
      33    install -dm755 "${pkgdir}/usr/share/licenses/${_pkgname}"
    
      34
    
      35    cp -a "../LICENSE" "${pkgdir}/usr/share/licenses/${_pkgname}/LICENSE"
    
      36
    
      37    cp -a "${srcdir}/squashfs-root" "${pkgdir}/usr/lib/${_pkgname}"
    
      38    find "${pkgdir}/usr/lib/${_pkgname}" -type d -exec chmod 755 "{}" \;
    
      39
    
      40    cp -a "${srcdir}/squashfs-root/usr/share/icons" "${pkgdir}/usr/share"
    
      41    chmod -R 755 "${pkgdir}/usr/share/icons"
    
      42
    
      43    sed -i -e "s/AppRun/deemix-gui/" "${pkgdir}/usr/lib/${_pkgname}/${_pkgname}.desktop"
    
      44    ln -s "/usr/lib/${_pkgname}/${_pkgname}.desktop" "${pkgdir}/usr/share/applications/${_pkgname}.desktop"
    
      45    ln -s "/usr/lib/${_pkgname}/${_pkgname}" "${pkgdir}/usr/bin/${_pkgname}"
    
      46}
    
      47

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2