echoed-appimage

maintainer in6kiar · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged Downloads and executes a prebuilt AppImage binary from software.echoed.gg, a non-standard host unrelated to major official infrastructure; while a SHA256 checksum is provided and the host appears to be the project's own download server, the package is new with few votes and the binary is run directly, making it an unverifiable prebuilt executable from a potentially swappable host.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 "${_appimage}::https://software.echoed.gg/v${pkgver}/Echoed_${pkgver}_amd64.AppImage"

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

MEDIUM AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): Downloads and executes a prebuilt AppImage binary from software.echoed.gg, a non-standard host unrelated to major official infrastructure; while a SHA256 checksum is provided and the host appears to be the project's own download server, the package is new with few votes and the binary is run directly, making it an unverifiable prebuilt executable from a potentially swappable host.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: in6kiar
    
      2
    
      3_pkgname=echoed
    
      4pkgname="${_pkgname}-appimage"
    
      5pkgver=1.7.4
    
      6pkgrel=1
    
      7pkgdesc="Lightweight Discord alternative — No Ads, No Tracking, Built on Tauri"
    
      8arch=('x86_64')
    
      9url="https://echoed.gg"
    
      10license=('custom')
    
      11depends=('fuse2' 'hicolor-icon-theme')
    
      12options=(!strip !debug)
    
      13_appimage="${_pkgname}-${pkgver}-amd64.AppImage"
    
      14source_x86_64=(
    
      15  "${_appimage}::https://software.echoed.gg/v${pkgver}/Echoed_${pkgver}_amd64.AppImage"
    
      16)
    
      17noextract=("${_appimage}")
    
      18sha256sums_x86_64=('562ff69fd033d6e777eeaba5a0407b558b08e39d28ff5b22c8c5dc6cffc6e2cd')
    
      19
    
      20prepare() {
    
      21  chmod +x "${_appimage}"
    
      22  ./"${_appimage}" --appimage-extract
    
      23}
    
      24
    
      25build() {
    
      26  local desktop_file
    
      27  desktop_file=$(find "${srcdir}/squashfs-root" -maxdepth 2 -name "*.desktop" | head -1)
    
      28
    
      29  if [[ -n "$desktop_file" ]]; then
    
      30    # Исправляем Exec + добавляем LD_PRELOAD
    
      31    sed -i -E "s|Exec=AppRun.*|Exec=env LD_PRELOAD=/usr/lib/libwayland-client.so DESKTOPINTEGRATION=0 APPIMAGELAUNCHER_DISABLE=1 /usr/bin/${_pkgname} %U|" \
    
      32      "$desktop_file"
    
      33
    
      34    # Ставим правильные категории для KDE
    
      35    if grep -q '^Categories=' "$desktop_file"; then
    
      36      sed -i -E 's|^Categories=.*|Categories=Network;InstantMessaging;|' "$desktop_file"
    
      37    else
    
      38      echo "Categories=Network;InstantMessaging;" >> "$desktop_file"
    
      39    fi
    
      40
    
      41    # На всякий случай задаём имя приложения
    
      42    sed -i -E "s|^Name=.*|Name=Echoed|" "$desktop_file" || true
    
      43  fi
    
      44
    
      45  # Чиним права
    
      46  chmod -R a-x+rX "${srcdir}/squashfs-root/usr" 2>/dev/null || true
    
      47}
    
      48
    
      49package() {
    
      50  # AppImage
    
      51  install -Dm755 "${srcdir}/${_appimage}" \
    
      52    "${pkgdir}/opt/${pkgname}/${pkgname}.AppImage"
    
      53
    
      54  # Обёртка
    
      55  install -dm755 "${pkgdir}/usr/bin"
    
      56  cat > "${pkgdir}/usr/bin/${_pkgname}" << 'EOF'
    
      57#!/bin/bash
    
      58export LD_PRELOAD=/usr/lib/libwayland-client.so${LD_PRELOAD:+:$LD_PRELOAD}
    
      59exec /opt/echoed-appimage/echoed-appimage.AppImage "$@"
    
      60EOF
    
      61  chmod 755 "${pkgdir}/usr/bin/${_pkgname}"
    
      62
    
      63  # Desktop-файл
    
      64  local desktop_file
    
      65  desktop_file=$(find "${srcdir}/squashfs-root" -maxdepth 2 -name "*.desktop" | head -1)
    
      66
    
      67  if [[ -n "$desktop_file" ]]; then
    
      68    install -Dm644 "$desktop_file" \
    
      69      "${pkgdir}/usr/share/applications/${_pkgname}.desktop"
    
      70  fi
    
      71
    
      72  # Иконки
    
      73  if [[ -d "${srcdir}/squashfs-root/usr/share/icons" ]]; then
    
      74    cp -a "${srcdir}/squashfs-root/usr/share/icons" "${pkgdir}/usr/share/"
    
      75  fi
    
      76}
    
      77

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	3
2026-08-02 00:16:08	MEDIUM	3
2026-08-01 13:24:03	MEDIUM	3
2026-08-01 13:20:32	MEDIUM	3