delta-app

maintainer lauramasseron · 5 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt AppImage binary from static-assets.getdelta.io, which is the official CDN/asset host for the Delta cryptocurrency portfolio tracker app (getdelta.io). The host is not a random personal server but the vendor's own asset distribution domain. However, the binary is executed during the build process (chmod +x + --appimage-extract) to extract its contents, and the entire extracted binary is then installed to /opt. The integrity check uses only MD5 (weak, but present). This is a standard pattern for AppImage packaging in the AUR and the host appears to be the legitimate upstream vendor host. The cheaper model's concern about supply-chain risk is valid in principle for any prebuilt binary, but this is the normal vendor distribution channel, not an unofficial or personal host. This rates as medium rather than clean because: (1) it's a closed-source prebuilt binary executed during packaging, (2) MD5 is a weak integrity guarantee, and (3) there is no GPG signature verification. These are real but common AUR concerns for proprietary AppImage packages, not indicators of active malice.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source=("https://static-assets.getdelta.io/desktop_app/$_pkgname-$pkgver-$arch.AppImage")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 78%): The PKGBUILD downloads a prebuilt AppImage binary from static-assets.getdelta.io, which is the official CDN/asset host for the Delta cryptocurrency portfolio tracker app (getdelta.io). The host is not a random personal server but the vendor's own asset distribution domain. However, the binary is executed during the build process (chmod +x + --appimage-extract) to extract its contents, and the entire extracted binary is then installed to /opt. The integrity check uses only MD5 (weak, but present). This is a standard pattern for AppImage packaging in the AUR and the host appears to be the legitimate upstream vendor host. The cheaper model's concern about supply-chain risk is valid in principle for any prebuilt binary, but this is the normal vendor distribution channel, not an unofficial or personal host. This rates as medium rather than clean because: (1) it's a closed-source prebuilt binary executed during packaging, (2) MD5 is a weak integrity guarantee, and (3) there is no GPG signature verification. These are real but common AUR concerns for proprietary AppImage packages, not indicators of active malice.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Emanuel Fernandes <efernandes@tektorque.com>
    
      2
    
      3pkgname=delta-app
    
      4_pkgname=Delta
    
      5pkgver=1.0.0
    
      6pkgrel=1
    
      7pkgdesc="Cryptocurrency portfolio tracker"
    
      8arch=('x86_64')
    
      9url='https://getdelta.io'
    
      10license=('custom')
    
      11makedepends=('gendesk')
    
      12source=("https://static-assets.getdelta.io/desktop_app/$_pkgname-$pkgver-$arch.AppImage")
    
      13md5sums=('7ec5f287c880aa23fc6b8d9747bb0271')
    
      14options=(!strip)
    
      15
    
      16prepare() {
    
      17	gendesk -f -n \
    
      18                --name "Delta" \
    
      19                --pkgname "$pkgname" \
    
      20                --pkgdesc "$pkgdesc" \
    
      21                --categories="Utility;Office"
    
      22}
    
      23
    
      24package() {
    
      25	_appImage="$_pkgname-$pkgver-$arch.AppImage"
    
      26
    
      27	# Extract files
    
      28	chmod +x "$srcdir/$_appImage"
    
      29	`$srcdir/$_appImage --appimage-extract`
    
      30	mv "$srcdir/squashfs-root" "$srcdir/$pkgname"
    
      31
    
      32	# Install Icon
    
      33	install -Dm644 "$srcdir/$pkgname/usr/share/icons/hicolor/512x512/apps/delta.png" "$pkgdir/usr/share/pixmaps/$pkgname.png"
    
      34
    
      35	install -d "$pkgdir/opt/$pkgname"
    
      36	cp -a "$srcdir/$pkgname/." "$pkgdir/opt/$pkgname/"
    
      37	chmod -R +rx "$pkgdir/opt/$pkgname"
    
      38
    
      39	install -d "$pkgdir/usr/bin"
    
      40	ln -s "/opt/$pkgname/app/delta" "$pkgdir/usr/bin/$pkgname"
    
      41	install -Dm644 "$srcdir/$pkgname.desktop" "$pkgdir/usr/share/applications/$pkgname.desktop"
    
      42}
    
      43

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2