dida-appimage

LOW

maintainer nth233 1 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads a prebuilt AppImage from the project's own CDN (cdn.dida365.cn), which is plausibly official; while the host is not on standard whitelists, the AppImage is checksummed and used transparently to extract and repackage contents, with no obfuscation or remote code execution.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt AppImage from the project's own CDN (cdn.dida365.cn), which is plausibly official; while the host is not on standard whitelists, the AppImage is checksummed and used transparently to extract and repackage contents, with no obfuscation or remote code execution.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:18 source=("${_pkgname}-${pkgver}-x86_64.AppImage::https://cdn.dida365.cn/download/linux/linux_appimage_x64/dida-${pkgver}-x86_64.AppImage")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: nth233 <fpg2012@foxmail.com>
    
      2
    
      3_pkgname=dida
    
      4_version=8.0.20
    
      5
    
      6pkgname="${_pkgname}"-appimage
    
      7pkgver="${_version}"
    
      8pkgrel=1
    
      9pkgdesc="滴答清单（官网 AppImage 版） / Dida (official AppImage version)"
    
      10arch=('x86_64')
    
      11url="https://www.dida365.com/"
    
      12license=('custom')
    
      13options=(!strip)
    
      14depends=('zlib' 'hicolor-icon-theme' 'fuse2')
    
      15provides=('dida')
    
      16conflicts=('dida-bin')
    
      17
    
      18source=("${_pkgname}-${pkgver}-x86_64.AppImage::https://cdn.dida365.cn/download/linux/linux_appimage_x64/dida-${pkgver}-x86_64.AppImage")
    
      19sha256sums=('17819b6f98fa11e72bf1ca05b30e3bf655a9ef6a21adda9f2ada4235d198c218')
    
      20
    
      21_appimage="dida-${pkgver}-x86_64.AppImage"
    
      22noextract=("${_appimage}")
    
      23
    
      24prepare() {
    
      25    chmod +x "${_appimage}"
    
      26    ./"${_appimage}" --appimage-extract
    
      27}
    
      28
    
      29build() {
    
      30    # Adjust .desktop so it will work outside of AppImage container
    
      31    sed -i \
    
      32        -e "s|Exec=AppRun|Exec=env DESKTOPINTEGRATION=false /usr/bin/${_pkgname}|" \
    
      33        -e "s|Icon=dida|Icon=/usr/share/icons/${_pkgname}.png|" \
    
      34        "squashfs-root/${_pkgname}.desktop"
    
      35
    
      36    # Fix permissions; .AppImage permissions are 700 for all directories
    
      37    chmod -R a-x+rX squashfs-root/usr
    
      38}
    
      39
    
      40package() {
    
      41    # AppImage
    
      42    install -Dm755 "${srcdir}/${_appimage}" "${pkgdir}/opt/${pkgname}/${pkgname}.AppImage"
    
      43    install -Dm644 "${srcdir}/squashfs-root/LICENSE.electron.txt" "${pkgdir}/opt/${pkgname}/LICENSE"
    
      44
    
      45    # Desktop file
    
      46    install -Dm644 "${srcdir}/squashfs-root/${_pkgname}.desktop" \
    
      47        "${pkgdir}/usr/share/applications/${_pkgname}.desktop"
    
      48
    
      49    # Icon images
    
      50    install -dm755 "${pkgdir}/usr/share/"
    
      51    cp -a "${srcdir}/squashfs-root/usr/share/icons" "${pkgdir}/usr/share/"
    
      52    ln -s "$(realpath "${srcdir}/squashfs-root/${_pkgname}.png" --relative-to "${srcdir}/squashfs-root/usr/share/icons")" \
    
      53        "${pkgdir}/usr/share/icons/${_pkgname}.png"
    
      54
    
      55    # Symlink executable
    
      56    install -dm755 "${pkgdir}/usr/bin"
    
      57    ln -s "/opt/${pkgname}/${pkgname}.AppImage" "${pkgdir}/usr/bin/${_pkgname}"
    
      58
    
      59    # Symlink license
    
      60    install -dm755 "${pkgdir}/usr/share/licenses/${pkgname}/"
    
      61    ln -s "/opt/${pkgname}/LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}"
    
      62}
    
      63

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Low	2
2026-10-31 00:07:41	Low	2
2026-10-30 00:29:30	Low	2
2026-10-29 00:13:55	Low	2
2026-10-28 00:06:54	Low	2
2026-10-27 00:23:28	Low	2
2026-10-26 00:12:40	Low	2
2026-10-25 00:20:48	Low	2
2026-10-24 00:14:55	Low	2
2026-10-23 00:02:19	Low	2
2026-10-22 00:13:10	Low	2
2026-10-21 00:12:50	Low	2
2026-10-20 00:10:31	Low	2
2026-10-19 00:03:55	Low	2
2026-10-18 00:06:55	Low	2
2026-10-17 00:21:55	Low	2
2026-10-16 00:12:47	Low	2
2026-10-15 00:28:05	Low	2
2026-10-14 00:06:47	Low	2
2026-10-13 00:23:45	Low	2