dm-appimage

MEDIUM

maintainer Cleboost 0 votes scanned 2026-10-29 09:52:05.005162

View on AUR

Why flagged

The package downloads a prebuilt AppImage binary from GitHub releases, which is an unverifiable executable; if the source were compromised, it could execute arbitrary code, constituting a supply-chain risk.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 90%): The package downloads a prebuilt AppImage binary from GitHub releases, which is an unverifiable executable; if the source were compromised, it could execute arbitrary code, constituting a supply-chain risk.

PKGBUILD

      1# Maintainer: Cleboost <clement.balarot@gmail.com>
    
      2# Contributor: missing-aur project <https://github.com/Cleboost/missing-aur>
    
      3
    
      4pkgname=dm-appimage
    
      5pkgver=0.8.4
    
      6pkgrel=1
    
      7pkgdesc="Download manager with many connections, resume, and a queue (AppImage)"
    
      8url="https://github.com/pranavo72bex/Easy-Download-Manager"
    
      9arch=("x86_64" "aarch64")
    
      10depends=("fuse2" "xdg-utils")
    
      11optdepends=("yt-dlp: downloads from sites that serve video through a player" "noto-fonts-cjk: names in Chinese, Japanese and Korean")
    
      12provides=("dm")
    
      13conflicts=("dm")
    
      14options=("!strip")
    
      15license=("MIT")
    
      16
    
      17source_x86_64=("dm-appimage-${pkgver}-x86_64.AppImage::${url}/releases/download/desktop-v${pkgver}/dm_${pkgver}_x86_64.AppImage" "dm.png::https://raw.githubusercontent.com/pranavo72bex/Easy-Download-Manager/main/desktop/crates/dm-desktop/icons/128x128.png" "dm.desktop::https://raw.githubusercontent.com/pranavo72bex/Easy-Download-Manager/main/desktop/packaging/dm.desktop")
    
      18source_aarch64=("dm-appimage-${pkgver}-aarch64.AppImage::${url}/releases/download/desktop-v${pkgver}/dm_${pkgver}_aarch64.AppImage" "dm.png::https://raw.githubusercontent.com/pranavo72bex/Easy-Download-Manager/main/desktop/crates/dm-desktop/icons/128x128.png" "dm.desktop::https://raw.githubusercontent.com/pranavo72bex/Easy-Download-Manager/main/desktop/packaging/dm.desktop")
    
      19sha256sums_x86_64=('6412a3803dc499a986f1967961cec18a136f3864712524fc9c547505642e29fb'
    
      20                   '6cfe62be3bd360c122ae98af86d1eb096f64fc49a58e578de2c0ff3154699b2a'
    
      21                   'b3c89656576d20d5b5ceda5c0535640cfa70fbc70a97cf8909ed847267272913')
    
      22sha256sums_aarch64=('169ffa75222fc96e11594703229c4c532f5cfff21159af671a1479ca251303a3'
    
      23                    '6cfe62be3bd360c122ae98af86d1eb096f64fc49a58e578de2c0ff3154699b2a'
    
      24                    'b3c89656576d20d5b5ceda5c0535640cfa70fbc70a97cf8909ed847267272913')
    
      25
    
      26prepare() {
    
      27  if [ "${CARCH}" = "x86_64" ]; then
    
      28    chmod +x "${srcdir}/dm-appimage-${pkgver}-x86_64.AppImage"
    
      29  elif [ "${CARCH}" = "aarch64" ]; then
    
      30    chmod +x "${srcdir}/dm-appimage-${pkgver}-aarch64.AppImage"
    
      31  fi
    
      32}
    
      33
    
      34package() {
    
      35  if [ "${CARCH}" = "x86_64" ]; then
    
      36    install -Dm755 "${srcdir}/dm-appimage-${pkgver}-x86_64.AppImage" "${pkgdir}/opt/dm-appimage/dm.AppImage"
    
      37  elif [ "${CARCH}" = "aarch64" ]; then
    
      38    install -Dm755 "${srcdir}/dm-appimage-${pkgver}-aarch64.AppImage" "${pkgdir}/opt/dm-appimage/dm.AppImage"
    
      39  fi
    
      40  install -dm755 "${pkgdir}/usr/bin"
    
      41  ln -sf "/opt/dm-appimage/dm.AppImage" "${pkgdir}/usr/bin/dm"
    
      42  install -Dm644 "${srcdir}/dm.png" "${pkgdir}/usr/share/icons/hicolor/128x128/apps/dm.png"
    
      43  install -Dm644 "${srcdir}/dm.desktop" "${pkgdir}/usr/share/applications/dm.desktop"
    
      44}
    
      45
    
      46

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-29 09:52:05	Medium	2