exam-env
maintainer ralphptorres
· 0 votes
· scanned 2026-08-03 00:08:14.047287
MEDIUM
View on AUR ↗
Why flagged
The package downloads a prebuilt AppImage from a GitHub release URL constructed via a variable, which is an unverifiable executable from a potentially swappable host; while GitHub is generally trusted, the indirect reference and lack of direct URL transparency introduce supply-chain risk.
Triggered rules
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:16
https://raw.githubusercontent${_url#*github}/refs/heads/main/LICENSE.md
MEDIUM
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt AppImage from a GitHub release URL constructed via a variable, which is an unverifiable executable from a potentially swappable host; while GitHub is generally trusted, the indirect reference and lack of direct URL transparency introduce supply-chain risk.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Ralph Torres <mail at ralphptorr dot es>
2
3
pkgname=exam-env
4
pkgver=2.1.0
5
pkgrel=1
6
pkgdesc='The freeCodeCamp Exam Environment desktop application'
7
arch=(x86_64)
8
url=https://freecodecamp.org
9
license=(BSD-3-Clause)
10
11
_pkgname=Exam.Environment
12
_pkgver=production
13
_url=https://github.com/freecodecamp/exam-env
14
source=(
15
$pkgname-$pkgver.AppImage::$_url/releases/download/$_pkgver/$pkgver/${_pkgname}_${pkgver}_amd64.AppImage
16
https://raw.githubusercontent${_url#*github}/refs/heads/main/LICENSE.md
17
)
18
sha256sums=(
19
66f2083d8618e721eb4f78a4d61d1e22cffb27a655fd5de1d148cddb1425cfa5
20
b078ff602cbd37a85255691adf62a6ee232dbfba6105220827c1352002ad2941
21
)
22
options=(!debug !strip)
23
24
package() {
25
cd "$srcdir"
26
27
chmod +x $pkgname-$pkgver.AppImage
28
./$pkgname-$pkgver.AppImage --appimage-extract
29
30
# NOTE: tauri has issues in wayland envs, use temp workaround.
31
# should be fine since exam-env runs in x11 anyway
32
# refer: https://github.com/freeCodeCamp/exam-env/issues/107
33
# refer: https://github.com/tauri-apps/tauri/issues/8541
34
rm squashfs-root/usr/lib/*wayland*so*
35
36
install -Dm755 -d "$pkgdir"/opt/$pkgname
37
cp -r squashfs-root/* "$pkgdir"/opt/$pkgname/
38
chmod +rx "$pkgdir"/opt/$pkgbase/AppRun.wrapped
39
install -Dm755 /dev/stdin "$pkgdir"/usr/bin/$pkgname <<EOF
40
#!/bin/sh
41
exec /opt/$pkgname/AppRun "\$@"
42
EOF
43
44
install -Dm644 -t "$pkgdir"/usr/share/licenses/$pkgname LICENSE.md
45
cd squashfs-root
46
install -Dm644 -T Exam\ Environment.desktop \
47
"$pkgdir"/usr/share/applications/$pkgname.desktop
48
dir=usr/share/icons/hicolor
49
install -Dm644 -t "$pkgdir"/$dir/32x32/apps $dir/32x32/apps/$pkgname.png
50
install -Dm644 -t "$pkgdir"/$dir/128x128/apps $dir/128x128/apps/$pkgname.png
51
install -Dm644 -t "$pkgdir"/$dir/256x256@2/apps $dir/256x256@2/apps/$pkgname.png
52
}
53
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | MEDIUM | 2 |
| 2026-08-02 00:16:08 | MEDIUM | 2 |
| 2026-08-01 00:11:18 | MEDIUM | 2 |
| 2026-07-31 00:14:10 | MEDIUM | 2 |
| 2026-07-30 00:17:23 | MEDIUM | 2 |
| 2026-07-29 00:25:53 | MEDIUM | 2 |
| 2026-07-28 00:07:28 | MEDIUM | 2 |
| 2026-07-27 00:24:32 | MEDIUM | 2 |
| 2026-07-26 00:07:32 | MEDIUM | 2 |
| 2026-07-25 00:13:44 | MEDIUM | 2 |
| 2026-07-24 00:02:28 | MEDIUM | 2 |
| 2026-07-23 00:14:47 | MEDIUM | 2 |
| 2026-07-22 00:29:32 | MEDIUM | 2 |
| 2026-07-21 00:24:15 | MEDIUM | 2 |
| 2026-07-20 00:19:49 | MEDIUM | 2 |
| 2026-07-19 00:17:08 | MEDIUM | 2 |
| 2026-07-18 00:14:48 | MEDIUM | 2 |
| 2026-07-17 00:06:16 | MEDIUM | 2 |
| 2026-07-16 00:05:41 | MEDIUM | 2 |
| 2026-07-15 00:09:25 | MEDIUM | 2 |