fastmail

MEDIUM

maintainer phnx47 5 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads a prebuilt AppImage from a Fastmail CDN, which is an unverifiable executable; if the host were compromised or the download intercepted, a malicious binary could be executed, constituting a supply-chain risk despite the official source.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source=("${_appimg}::https://dl.fastmailcdn.com/desktop/production/linux/x64/${_appimg}"

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt AppImage from a Fastmail CDN, which is an unverifiable executable; if the host were compromised or the download intercepted, a malicious binary could be executed, constituting a supply-chain risk despite the official source.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Serge <arch@phnx47.net>
    
      2
    
      3# Auto Upgrade: https://github.com/phnx47/pkgbuilds
    
      4
    
      5pkgname=fastmail
    
      6pkgver=1.7.0
    
      7pkgrel=1
    
      8pkgdesc='Email made better'
    
      9license=('custom:fastmail')
    
      10url='https://www.fastmail.com'
    
      11arch=('x86_64')
    
      12options=('!strip')
    
      13depends=('gtk3' 'nss' 'alsa-lib')
    
      14makedepends=('desktop-file-utils')
    
      15_appimg="com.fastmail.Fastmail-${pkgver}.AppImage"
    
      16source=("${_appimg}::https://dl.fastmailcdn.com/desktop/production/linux/x64/${_appimg}"
    
      17        "LICENSE.md") # https://www.fastmail.com/policies/terms-of-service/
    
      18sha512sums=('77644da6ad2274d715457890b386d239d2ebcbdbcf54e2809ce57179910163cba5b03ce24f50c4393433d05980f091a5ecc130b39adbdb4141317606270fa1b3'
    
      19            'e336da034d45735cf62687e8b917e9d995a446685b1341d823ea032f9256751a92ecf5501c48ed4daf18a76df30a3a89b4a6f07aa4f6b2c2d34224c352435d89')
    
      20
    
      21prepare() {
    
      22  chmod +x "${_appimg}"
    
      23  "./${_appimg}" --appimage-extract
    
      24
    
      25  cd squashfs-root
    
      26  desktop-file-edit \
    
      27    --set-key=Exec \
    
      28    --set-value="${pkgname} %U" \
    
      29    --set-key=Name \
    
      30    --set-value="Fastmail" \
    
      31    --remove-key=X-AppImage-Version \
    
      32    ${pkgname}.desktop
    
      33
    
      34  rm "AppRun" "resources/app-update.yml"
    
      35}
    
      36
    
      37package() {
    
      38  install -d "${pkgdir}/opt/${pkgname}"
    
      39  cp -a "squashfs-root/." "${pkgdir}/opt/${pkgname}/"
    
      40
    
      41  install -d "${pkgdir}/usr/bin"
    
      42  ln -s "/opt/${pkgname}/${pkgname}" "${pkgdir}/usr/bin/${pkgname}"
    
      43
    
      44  install -d "${pkgdir}/usr/share/applications"
    
      45  ln -s "/opt/${pkgname}/${pkgname}.desktop" "${pkgdir}/usr/share/applications/${pkgname}.desktop"
    
      46
    
      47  for i in 16 24 32 48 64 128 256 512 1024; do
    
      48    install -d "${pkgdir}/usr/share/icons/hicolor/${i}x${i}/apps"
    
      49    ln -s "/opt/${pkgname}/usr/share/icons/hicolor/${i}x${i}/apps/${pkgname}.png" "${pkgdir}/usr/share/icons/hicolor/${i}x${i}/apps/${pkgname}.png"
    
      50  done
    
      51
    
      52  find "${pkgdir}" -type d -exec chmod 755 {} +
    
      53
    
      54  install -Dm 644 LICENSE.md "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.md"
    
      55}
    
      56

Changes since previous scan

--- PKGBUILD @ 2026-08-31 00:19
+++ PKGBUILD @ 2026-09-17 00:27
@@ -3,7 +3,7 @@
 # Auto Upgrade: https://github.com/phnx47/pkgbuilds
 
 pkgname=fastmail
-pkgver=1.6.0
+pkgver=1.7.0
 pkgrel=1
 pkgdesc='Email made better'
 license=('custom:fastmail')
@@ -15,7 +15,7 @@
 _appimg="com.fastmail.Fastmail-${pkgver}.AppImage"
 source=("${_appimg}::https://dl.fastmailcdn.com/desktop/production/linux/x64/${_appimg}"
         "LICENSE.md") # https://www.fastmail.com/policies/terms-of-service/
-sha512sums=('8d392cc51a7d4a4d76d94dd54a2cbd4f1949d1e8b81a43acd499a43e01074c9304c6899dc9a76bdbf49d706bdf0cffe993ea3a49bc82b6f7ead030755b48017e'
+sha512sums=('77644da6ad2274d715457890b386d239d2ebcbdbcf54e2809ce57179910163cba5b03ce24f50c4393433d05980f091a5ecc130b39adbdb4141317606270fa1b3'
             'e336da034d45735cf62687e8b917e9d995a446685b1341d823ea032f9256751a92ecf5501c48ed4daf18a76df30a3a89b4a6f07aa4f6b2c2d34224c352435d89')
 
 prepare() {

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 17:46:09	Medium	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2