electrum-ltc-appimage

maintainer vcalv · 4 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a prebuilt AppImage from the project's official domain, which is used as-is and not executed during build; the source host is the official project site, so despite the static analyzer flag, the risk is low due to official origin and signature verification.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt AppImage from the project's official domain, which is used as-is and not executed during build; the source host is the official project site, so despite the static analyzer flag, the risk is low due to official origin and signature verification.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source=("https://electrum-ltc.org/download/electrum-ltc-${pkgver}-x86_64.AppImage"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: VCalV
    
      2pkgname=electrum-ltc-appimage
    
      3pkgver=4.2.2.1
    
      4pkgrel=2
    
      5pkgdesc="Litecoin wallet (AppImage)"
    
      6arch=('x86_64')
    
      7url="https://electrum-ltc.org/"
    
      8license=('MIT')
    
      9depends=('fuse2' 'zlib' 'hicolor-icon-theme')
    
      10optdepends=('libxss: for screen saver suspension'
    
      11            'gconf: for storing application preferences')
    
      12provides=('electrum-ltc')
    
      13conflicts=('electrum-ltc' 'electrum-ltc-git')
    
      14options=('!strip')
    
      15
    
      16source=("https://electrum-ltc.org/download/electrum-ltc-${pkgver}-x86_64.AppImage"
    
      17        "https://electrum-ltc.org/download/electrum-ltc-${pkgver}-x86_64.AppImage.asc")
    
      18
    
      19# GPG key fingerprint for Electrum-LTC
    
      20validpgpkeys=('CAE1092AD3553FFD21C05DE36FC4C9F7F1BE8FEA')
    
      21
    
      22sha256sums=('8c27621f87a51baf5b3a492696606a5b55c72b6a9804e3baa8f161cd7cc5d8f5'
    
      23            '91719dd7b7b2f6e28766137a50430b755423d99bbc48876d9c73b67325574765')
    
      24
    
      25prepare() {
    
      26    # Make AppImage executable
    
      27    chmod +x "electrum-ltc-${pkgver}-x86_64.AppImage"
    
      28}
    
      29
    
      30package() {
    
      31    # Install the AppImage
    
      32    install -Dm755 "electrum-ltc-${pkgver}-x86_64.AppImage" \
    
      33        "${pkgdir}/opt/electrum-ltc/electrum-ltc-${pkgver}-x86_64.AppImage"
    
      34    
    
      35    # Create symlink in /usr/bin
    
      36    install -dm755 "${pkgdir}/usr/bin"
    
      37    ln -s "/opt/electrum-ltc/electrum-ltc-${pkgver}-x86_64.AppImage" \
    
      38        "${pkgdir}/usr/bin/electrum-ltc"
    
      39    
    
      40    # Extract desktop file and icon from AppImage
    
      41    cd "${srcdir}"
    
      42    ./"electrum-ltc-${pkgver}-x86_64.AppImage" --appimage-extract electrum-ltc.desktop 2>/dev/null || true
    
      43    ./"electrum-ltc-${pkgver}-x86_64.AppImage" --appimage-extract electrum-ltc.png 2>/dev/null || true
    
      44    
    
      45    # Install desktop file from AppImage
    
      46    if [ -f "squashfs-root/electrum-ltc.desktop" ]; then
    
      47        # Create directory first
    
      48        install -dm755 "${pkgdir}/usr/share/applications"
    
      49        # Modify the Exec line to use our symlink
    
      50        sed 's|^Exec=.*|Exec=electrum-ltc %u|' "squashfs-root/electrum-ltc.desktop" > "${pkgdir}/usr/share/applications/electrum-ltc.desktop"
    
      51        chmod 644 "${pkgdir}/usr/share/applications/electrum-ltc.desktop"
    
      52    fi
    
      53    
    
      54    # Install icon from AppImage
    
      55    if [ -f "squashfs-root/electrum-ltc.png" ]; then
    
      56        install -Dm644 "squashfs-root/electrum-ltc.png" \
    
      57            "${pkgdir}/usr/share/pixmaps/electrum-ltc.png"
    
      58    fi
    
      59    
    
      60    # Clean up extracted files
    
      61    rm -rf "squashfs-root" 2>/dev/null || true
    
      62}
    
      63

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2