fastmail

maintainer phnx47 · 5 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a Fastmail AppImage from the official fastmailcdn.com domain, which is plausibly Fastmail's own infrastructure; the AppImage is extracted and installed without executing arbitrary remote code, and the checksum is verified, making this a standard repackaging of an official binary with low risk.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a Fastmail AppImage from the official fastmailcdn.com domain, which is plausibly Fastmail's own infrastructure; the AppImage is extracted and installed without executing arbitrary remote code, and the checksum is verified, making this a standard repackaging of an official binary with low risk.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source=("${_appimg}::https://dl.fastmailcdn.com/desktop/production/linux/x64/${_appimg}"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Serge K <arch@phnx47.net>
    
      2
    
      3# Auto Upgrade: https://github.com/phnx47/pkgbuilds
    
      4
    
      5pkgname=fastmail
    
      6pkgver=1.5.1
    
      7pkgrel=1
    
      8pkgdesc='Email made better'
    
      9license=('custom:fastmail')
    
      10url='https://www.fastmail.com'
    
      11arch=('x86_64')
    
      12options=('!strip')
    
      13depends=('gtk3' 'nss' 'alsa-lib')
    
      14makedepends=('desktop-file-utils')
    
      15_appimg="com.fastmail.Fastmail-${pkgver}.AppImage"
    
      16source=("${_appimg}::https://dl.fastmailcdn.com/desktop/production/linux/x64/${_appimg}"
    
      17        "LICENSE.md") # https://www.fastmail.com/policies/terms-of-service/
    
      18sha512sums=('f142d795209e4ff3253b4aa6730287826692899bf3edd01618b896aa83a8ad2916b0d67ef5d46ed8f85998191d53793447671626c03ac40e1456266d39270fd1'
    
      19            'c544bd5496ec83a0b2475eb12070951ac92da66a6314357165ba517f986412f2c54b303186efc2c068562ac345108eeef56e7926a920cbbd820e700607d8b220')
    
      20
    
      21prepare() {
    
      22  chmod +x "${_appimg}"
    
      23  "./${_appimg}" --appimage-extract
    
      24
    
      25  cd squashfs-root
    
      26  desktop-file-edit \
    
      27    --set-key=Exec \
    
      28    --set-value="${pkgname} %U" \
    
      29    --set-key=Name \
    
      30    --set-value="Fastmail" \
    
      31    --remove-key=X-AppImage-Version \
    
      32    ${pkgname}.desktop
    
      33
    
      34  rm "AppRun" "resources/app-update.yml"
    
      35}
    
      36
    
      37package() {
    
      38  install -d "${pkgdir}/opt/${pkgname}"
    
      39  cp -a "squashfs-root/." "${pkgdir}/opt/${pkgname}/"
    
      40
    
      41  install -d "${pkgdir}/usr/bin"
    
      42  ln -s "/opt/${pkgname}/${pkgname}" "${pkgdir}/usr/bin/${pkgname}"
    
      43
    
      44  install -d "${pkgdir}/usr/share/applications"
    
      45  ln -s "/opt/${pkgname}/${pkgname}.desktop" "${pkgdir}/usr/share/applications/${pkgname}.desktop"
    
      46
    
      47  for i in 16 24 32 48 64 128 256 512 1024; do
    
      48    install -d "${pkgdir}/usr/share/icons/hicolor/${i}x${i}/apps"
    
      49    ln -s "/opt/${pkgname}/usr/share/icons/hicolor/${i}x${i}/apps/${pkgname}.png" "${pkgdir}/usr/share/icons/hicolor/${i}x${i}/apps/${pkgname}.png"
    
      50  done
    
      51
    
      52  find "${pkgdir}" -type d -exec chmod 755 {} +
    
      53
    
      54  install -Dm 644 LICENSE.md "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.md"
    
      55}
    
      56

Changes since previous scan

--- PKGBUILD @ 2026-07-16 07:51
+++ PKGBUILD @ 2026-08-03 00:08
@@ -3,7 +3,7 @@
 # Auto Upgrade: https://github.com/phnx47/pkgbuilds
 
 pkgname=fastmail
-pkgver=1.5.0
+pkgver=1.5.1
 pkgrel=1
 pkgdesc='Email made better'
 license=('custom:fastmail')
@@ -15,7 +15,7 @@
 _appimg="com.fastmail.Fastmail-${pkgver}.AppImage"
 source=("${_appimg}::https://dl.fastmailcdn.com/desktop/production/linux/x64/${_appimg}"
         "LICENSE.md") # https://www.fastmail.com/policies/terms-of-service/
-sha512sums=('0e9fdf0ebb99446fd8e0ad6aa8ea05f1e267088901c105a2c7883966b38911fc90bbb39d591b43daf71eeaad3e36e306216129638830faf21262b97a894bd207'
+sha512sums=('f142d795209e4ff3253b4aa6730287826692899bf3edd01618b896aa83a8ad2916b0d67ef5d46ed8f85998191d53793447671626c03ac40e1456266d39270fd1'
             'c544bd5496ec83a0b2475eb12070951ac92da66a6314357165ba517f986412f2c54b303186efc2c068562ac345108eeef56e7926a920cbbd820e700607d8b220')
 
 prepare() {

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 11:51:28	MEDIUM	1
2026-07-16 07:51:00	MEDIUM	1