electrum-appimage

LOW

maintainer digital_mystik 3 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads an official AppImage and signature from the project's own domain (download.electrum.org), which is plausibly the project's release infrastructure; the source is not from a swappable host, and the AppImage is verified via PGP, making this a standard, safe AUR packaging pattern despite the non-whitelisted domain.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads an official AppImage and signature from the project's own domain (download.electrum.org), which is plausibly the project's release infrastructure; the source is not from a swappable host, and the AppImage is verified via PGP, making this a standard, safe AUR packaging pattern despite the non-whitelisted domain.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:18 source=("https://download.electrum.org/${pkgver}/${_appimage}"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: digital_mystik <dgtl underscore mystik at protonmail dot ch>
    
      2# Adapted from Dave Parrish's "A Better PKGBUILD Template for AppImage Packages"
    
      3
    
      4_pkgname=electrum
    
      5pkgname="${_pkgname}"-appimage
    
      6pkgver=4.8.0
    
      7pkgrel=1
    
      8pkgdesc="Electrum Bitcoin wallet with bundled libraries"
    
      9arch=('x86_64')
    
      10url="https://electrum.org"
    
      11license=('MIT')
    
      12provides=('electrum')
    
      13conflicts=('electrum' 'electrum-git')
    
      14options=(!strip)
    
      15_appimage="${_pkgname}-${pkgver}-${arch}.AppImage"
    
      16validpgpkeys=('6694D8DE7BE8EE5631BED9502BD5824B7F9470E6')
    
      17
    
      18source=("https://download.electrum.org/${pkgver}/${_appimage}"
    
      19        "${_appimage}.asc::https://download.electrum.org/${pkgver}/${_appimage}.ThomasV.asc"
    
      20        "${_pkgname}-${pkgver}-LICENCE::https://raw.githubusercontent.com/spesmilo/${_pkgname}/${pkgver}/LICENCE"
    
      21        )
    
      22
    
      23b2sums=('7a87ff9cdd6c9a402e67a6fe337c56a4edc9a1eed41bff1c0d81d5745d80443dd0d8740f4c1c90228b311127b66f3db0b85636c07e16e6d0af2d77a4deb36d9a'
    
      24        'SKIP' 
    
      25        '8e30e92bffb9b3c518bb106c23cbab40ceb9a1dace193bdbd7e979fa8116e76b47dfc99c5361020c58a7d0bb7de236e6dd7d8f3dfdb1b7fd16245135d53cec3f')
    
      26
    
      27noextract=("${_appimage}")
    
      28
    
      29prepare() {
    
      30    # Bypass integration
    
      31    chmod +x "${_appimage}"
    
      32    ./"${_appimage}" --appimage-extract &>/dev/null
    
      33}
    
      34
    
      35build() {
    
      36    # Adjust .desktop so it will work outside of AppImage container
    
      37    sed -i -E "s|Exec=AppRun|Exec=env DESKTOPINTEGRATION=false /usr/bin/${_pkgname}|"\
    
      38        "squashfs-root/${_pkgname}.desktop"
    
      39
    
      40    # Fix permissions; .AppImage permissions are 700 for all directories
    
      41    chmod -R a-x+rX squashfs-root/usr
    
      42}
    
      43
    
      44package() {
    
      45    # AppImage
    
      46    install -Dm755 "${srcdir}/${_appimage}" "${pkgdir}/opt/${pkgname}/${_pkgname}.AppImage"
    
      47    install -Dm644 "${srcdir}/${_pkgname}-${pkgver}-LICENCE" "${pkgdir}/usr/share/licenses/${_pkgname}-${pkgver}-LICENCE"
    
      48
    
      49    # Desktop file
    
      50    install -Dm644 "${srcdir}/squashfs-root/${_pkgname}.desktop"\
    
      51            "${pkgdir}/usr/share/applications/${_pkgname}.desktop"
    
      52
    
      53    # Icon
    
      54    install -dm755 "${pkgdir}/usr/share/icons"
    
      55    cp "${srcdir}/squashfs-root/${_pkgname}.png" "${pkgdir}/usr/share/icons/"
    
      56
    
      57    # Symlink executable
    
      58    install -dm755 "${pkgdir}/usr/bin"
    
      59    ln -s "/opt/${pkgname}/${_pkgname}.AppImage" "${pkgdir}/usr/bin/${_pkgname}"
    
      60}
    
      61

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2