dezor

maintainer vitaliikuzhdin · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt proprietary AppImage binary from cdn.dezor.net, which is the project's own CDN but is not an independently verifiable official distribution channel (no GitHub releases, no distro mirror, no signed artifacts). The AppImage is executed during prepare() via --appimage-extract to unpack it, meaning arbitrary code in the AppImage runs at build time. The checksums (b2sums) are present and pin specific builds, which mitigates silent substitution risk but does not eliminate the concern that the CDN host could serve a malicious binary that the maintainer then updates the checksums for. This is a standard pattern for proprietary AppImage packaging in the AUR, but the combination of an unverifiable closed-source binary from a personal/project CDN that is executed at build time constitutes a genuine medium supply-chain risk — not a false positive. There is no evidence of active malice, obfuscation, or piracy.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 source_aarch64=("${_pkgsrc}-aarch64.AppImage::https://cdn.dezor.net/updates/net.dezor.browser/linux/${_Name}-v${pkgver}-arm64.AppImage")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt proprietary AppImage binary from cdn.dezor.net, which is the project's own CDN but is not an independently verifiable official distribution channel (no GitHub releases, no distro mirror, no signed artifacts). The AppImage is executed during prepare() via --appimage-extract to unpack it, meaning arbitrary code in the AppImage runs at build time. The checksums (b2sums) are present and pin specific builds, which mitigates silent substitution risk but does not eliminate the concern that the CDN host could serve a malicious binary that the maintainer then updates the checksums for. This is a standard pattern for proprietary AppImage packaging in the AUR, but the combination of an unverifiable closed-source binary from a personal/project CDN that is executed at build time constitutes a genuine medium supply-chain risk — not a false positive. There is no evidence of active malice, obfuscation, or piracy.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer:  Vitalii Kuzhdin <vitaliikuzhdin@gmail.com>
    
      2
    
      3_Name="Dezor"
    
      4pkgname="${_Name,,}"
    
      5pkgver=1.5.8
    
      6pkgrel=1
    
      7pkgdesc="The web browser including VPN & Adblocker"
    
      8arch=('aarch64' 'armv7h' 'x86_64')
    
      9url="https://www.dezor.net"
    
      10license=('custom:Proprietary')
    
      11depends=('glibc' 'zlib' 'hicolor-icon-theme')
    
      12provides=("${pkgname}-appimage")
    
      13conflicts=("${pkgname}-appimage")
    
      14replaces=("${pkgname}-appimage")
    
      15options=('!strip' '!debug')
    
      16_pkgsrc="${pkgname}-${pkgver}"
    
      17source_aarch64=("${_pkgsrc}-aarch64.AppImage::https://cdn.dezor.net/updates/net.dezor.browser/linux/${_Name}-v${pkgver}-arm64.AppImage")
    
      18source_armv7h=("${_pkgsrc}-armv7h.AppImage::https://cdn.dezor.net/updates/net.dezor.browser/linux/${_Name}-v${pkgver}-armv7l.AppImage")
    
      19source_x86_64=("${_pkgsrc}-x86_64.AppImage::https://cdn.dezor.net/updates/net.dezor.browser/linux/${_Name}-v${pkgver}-x86_64.AppImage")
    
      20b2sums_aarch64=('d25c720405cd42b5a207e0e0f0bbe960cd68c1a698be2f4b50137dad37458eb1afbd406ec33078660f24d98be538ebbead60e96aca3fd6eaf0c209f285e9f8de')
    
      21b2sums_armv7h=('d20f2b8f0b7ecb22c38cb045333bfb51978ff82ec95269742d0da749e074fbfc252ed5574a57787bec301f465421cd225f09b295f48c08b3d9d439c989b5534d')
    
      22b2sums_x86_64=('280766d69787c60147bc3b2432081c67807251fa90d7244e4697930235b06a1db788ce5b8ab0f37a04edb11cda7debededa0a6bd85b2b809475b436aaa085309')
    
      23
    
      24prepare() {
    
      25  cd "${srcdir}"
    
      26  chmod +x "${_pkgsrc}-${CARCH}.AppImage"
    
      27  ./"${_pkgsrc}-${CARCH}.AppImage" --appimage-extract > /dev/null
    
      28
    
      29  rm -rf "${_pkgsrc}-${CARCH}"
    
      30  mv -f "squashfs-root" "${_pkgsrc}-${CARCH}"
    
      31}
    
      32
    
      33build() {
    
      34  cd "${srcdir}"
    
      35  # Fix permissions; .AppImage permissions are 700 for all directories
    
      36  chmod -R a-x+rX "${_pkgsrc}-${CARCH}"/
    
      37
    
      38  cd "${_pkgsrc}-${CARCH}"
    
      39  sed -i "s/AppRun --no-sandbox/${pkgname}/g" "${pkgname}.desktop"
    
      40}
    
      41
    
      42package() {
    
      43  cd "${srcdir}"
    
      44  install -vDm755 "${_pkgsrc}-${CARCH}.AppImage" "${pkgdir}/opt/${pkgname}/${pkgname}.AppImage"
    
      45
    
      46  cd "${srcdir}/${_pkgsrc}-${CARCH}"
    
      47  install -vDm644 "${pkgname}.desktop" "${pkgdir}/usr/share/applications/${pkgname}.desktop"
    
      48
    
      49  find "usr/share" -type f -exec \
    
      50    install -vDm644 "{}" "${pkgdir}/{}" \;
    
      51
    
      52  install -vdm755 "${pkgdir}/usr/bin"
    
      53  ln -vsf "/opt/${pkgname}/${pkgname}.AppImage" "${pkgdir}/usr/bin/${pkgname}"
    
      54}
    
      55

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2