electrum-appimage

maintainer digital_mystik · 3 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads an official AppImage and signature from the project's own domain (download.electrum.org), which is plausibly the project's release infrastructure; the source is not from a swappable host, and the AppImage is verified via PGP, making this a standard, safe AUR packaging pattern despite the non-whitelisted domain.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads an official AppImage and signature from the project's own domain (download.electrum.org), which is plausibly the project's release infrastructure; the source is not from a swappable host, and the AppImage is verified via PGP, making this a standard, safe AUR packaging pattern despite the non-whitelisted domain.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:18 source=("https://download.electrum.org/${pkgver}/${_appimage}"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: digital_mystik <dgtl underscore mystik at protonmail dot ch>
    
      2# Adapted from Dave Parrish's "A Better PKGBUILD Template for AppImage Packages"
    
      3
    
      4_pkgname=electrum
    
      5pkgname="${_pkgname}"-appimage
    
      6pkgver=4.8.0
    
      7pkgrel=1
    
      8pkgdesc="Electrum Bitcoin wallet with bundled libraries"
    
      9arch=('x86_64')
    
      10url="https://electrum.org"
    
      11license=('MIT')
    
      12provides=('electrum')
    
      13conflicts=('electrum' 'electrum-git')
    
      14options=(!strip)
    
      15_appimage="${_pkgname}-${pkgver}-${arch}.AppImage"
    
      16validpgpkeys=('6694D8DE7BE8EE5631BED9502BD5824B7F9470E6')
    
      17
    
      18source=("https://download.electrum.org/${pkgver}/${_appimage}"
    
      19        "${_appimage}.asc::https://download.electrum.org/${pkgver}/${_appimage}.ThomasV.asc"
    
      20        "${_pkgname}-${pkgver}-LICENCE::https://raw.githubusercontent.com/spesmilo/${_pkgname}/${pkgver}/LICENCE"
    
      21        )
    
      22
    
      23b2sums=('7a87ff9cdd6c9a402e67a6fe337c56a4edc9a1eed41bff1c0d81d5745d80443dd0d8740f4c1c90228b311127b66f3db0b85636c07e16e6d0af2d77a4deb36d9a'
    
      24        'SKIP' 
    
      25        '8e30e92bffb9b3c518bb106c23cbab40ceb9a1dace193bdbd7e979fa8116e76b47dfc99c5361020c58a7d0bb7de236e6dd7d8f3dfdb1b7fd16245135d53cec3f')
    
      26
    
      27noextract=("${_appimage}")
    
      28
    
      29prepare() {
    
      30    # Bypass integration
    
      31    chmod +x "${_appimage}"
    
      32    ./"${_appimage}" --appimage-extract &>/dev/null
    
      33}
    
      34
    
      35build() {
    
      36    # Adjust .desktop so it will work outside of AppImage container
    
      37    sed -i -E "s|Exec=AppRun|Exec=env DESKTOPINTEGRATION=false /usr/bin/${_pkgname}|"\
    
      38        "squashfs-root/${_pkgname}.desktop"
    
      39
    
      40    # Fix permissions; .AppImage permissions are 700 for all directories
    
      41    chmod -R a-x+rX squashfs-root/usr
    
      42}
    
      43
    
      44package() {
    
      45    # AppImage
    
      46    install -Dm755 "${srcdir}/${_appimage}" "${pkgdir}/opt/${pkgname}/${_pkgname}.AppImage"
    
      47    install -Dm644 "${srcdir}/${_pkgname}-${pkgver}-LICENCE" "${pkgdir}/usr/share/licenses/${_pkgname}-${pkgver}-LICENCE"
    
      48
    
      49    # Desktop file
    
      50    install -Dm644 "${srcdir}/squashfs-root/${_pkgname}.desktop"\
    
      51            "${pkgdir}/usr/share/applications/${_pkgname}.desktop"
    
      52
    
      53    # Icon
    
      54    install -dm755 "${pkgdir}/usr/share/icons"
    
      55    cp "${srcdir}/squashfs-root/${_pkgname}.png" "${pkgdir}/usr/share/icons/"
    
      56
    
      57    # Symlink executable
    
      58    install -dm755 "${pkgdir}/usr/bin"
    
      59    ln -s "/opt/${pkgname}/${_pkgname}.AppImage" "${pkgdir}/usr/bin/${_pkgname}"
    
      60}
    
      61

Changes since previous scan

--- PKGBUILD @ 2026-06-19 19:07
+++ PKGBUILD @ 2026-08-03 00:08
@@ -3,7 +3,7 @@
 
 _pkgname=electrum
 pkgname="${_pkgname}"-appimage
-pkgver=4.7.2
+pkgver=4.8.0
 pkgrel=1
 pkgdesc="Electrum Bitcoin wallet with bundled libraries"
 arch=('x86_64')
@@ -20,7 +20,7 @@
         "${_pkgname}-${pkgver}-LICENCE::https://raw.githubusercontent.com/spesmilo/${_pkgname}/${pkgver}/LICENCE"
         )
 
-b2sums=('2e917ab3f8234db0363b29ff49a3e1354a8b5ed59be6cdc405bcf3f636f81c55bf569d136378183ac62f9ddd4e5e87a8df1b3ad32600d7b03666215ef667aac5'
+b2sums=('7a87ff9cdd6c9a402e67a6fe337c56a4edc9a1eed41bff1c0d81d5745d80443dd0d8740f4c1c90228b311127b66f3db0b85636c07e16e6d0af2d77a4deb36d9a'
         'SKIP' 
         '8e30e92bffb9b3c518bb106c23cbab40ceb9a1dace193bdbd7e979fa8116e76b47dfc99c5361020c58a7d0bb7de236e6dd7d8f3dfdb1b7fd16245135d53cec3f')
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 19:16:23	MEDIUM	1
2026-06-19 19:07:35	CLEAN	2
2026-06-18 16:11:54	MEDIUM	1