flomo-bin

maintainer zxp19821005 · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt Windows .exe installer from a personal GitHub repository (github.com/zxp19821005/My_AUR_Files) maintained by the same person as the AUR package maintainer, not from the official flomoapp.com vendor. The exe is extracted with 7zip, its app.asar is unpacked and patched, then repacked and installed. The core concern is that the binary originates from an unofficial personal host rather than the upstream vendor's official release channel — if that personal repo is compromised or the release asset is swapped, users would execute arbitrary code. The sha256sum provides some integrity protection but does not establish authenticity. This is a classic AUR pattern for Electron apps that don't publish Linux builds, but the supply-chain risk is real: the trusted party is the AUR maintainer's personal GitHub rather than the software vendor. This warrants MEDIUM severity.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:26 "LICENSE.html::https://help.flomoapp.com/legal/"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads a prebuilt Windows .exe installer from a personal GitHub repository (github.com/zxp19821005/My_AUR_Files) maintained by the same person as the AUR package maintainer, not from the official flomoapp.com vendor. The exe is extracted with 7zip, its app.asar is unpacked and patched, then repacked and installed. The core concern is that the binary originates from an unofficial personal host rather than the upstream vendor's official release channel — if that personal repo is compromised or the release asset is swapped, users would execute arbitrary code. The sha256sum provides some integrity protection but does not establish authenticity. This is a classic AUR pattern for Electron apps that don't publish Linux builds, but the supply-chain risk is real: the trusted party is the AUR maintainer's personal GitHub rather than the software vendor. This warrants MEDIUM severity.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: zxp19821005 <zxp19821005 at 163 dot com>
    
      2pkgname=flomo-bin
    
      3_pkgname=Flomo
    
      4_zhsname='浮墨笔记'
    
      5pkgver=5.26.51
    
      6_electronversion=36
    
      7pkgrel=1
    
      8pkgdesc="A new generation of cloud knowledge base for personal note-taking and knowledge creation, team collaboration and knowledge accumulation.(Prebuilt version.Use system-wide electron)新一代云端知识库，用于个人笔记与知识创作，团队协同与知识沉淀"
    
      9arch=('x86_64')
    
      10url="https://flomoapp.com/"
    
      11_dlurl="https://github.com/zxp19821005/My_AUR_Files"
    
      12license=('LicenseRef-custom')
    
      13conflicts=("${pkgname%-bin}")
    
      14prodives=("${pkgname%-bin}=${pkgver}")
    
      15depends=(
    
      16    "electron${_electronversion}"
    
      17)
    
      18makedepends=(
    
      19    'gendesk'
    
      20    'asar'
    
      21    'icoutils'
    
      22    '7zip'
    
      23)
    
      24source=(
    
      25    "${pkgname%-bin}-${pkgver}.exe::${_dlurl}/releases/download/${pkgname%-bin}/${pkgname%-bin}-${pkgver}.exe"
    
      26    "LICENSE.html::https://help.flomoapp.com/legal/"
    
      27    "${pkgname%-bin}.sh"
    
      28)
    
      29sha256sums=('92f23cde4f0c31e0bea6ba2b7c55e442245b3ba3a782fb72a58551d58f23ae40'
    
      30            '262c2023c95bc543072bfc997e80076548e5472ba344052b2fc18a1557de13b6'
    
      31            'a774c2f54fbbeeaac3cefc0f7250796d30c86d27f0fd40b7eaf9c0fdb021623d')
    
      32_get_electron_version() {
    
      33    _electronversion="$(strings "${srcdir}/tmp/${pkgname%-bin}.exe" | grep '^Chrome/[0-9.]* Electron/[0-9]' | cut -d'/' -f3 | cut -d'.' -f1)"
    
      34    echo -e "The electron version is: \033[1;31m${_electronversion}\033[0m"
    
      35}
    
      36prepare() {
    
      37    sed -i -e "
    
      38        s/@electronversion@/${_electronversion}/g
    
      39        s/@appname@/${pkgname%-bin}/g
    
      40        s/@runname@/app.asar/g
    
      41        s/@cfgdirname@/${pkgname%-bin}卡片笔记/g
    
      42        s/@options@/env ELECTRON_OZONE_PLATFORM_HINT=auto/g
    
      43    " "${srcdir}/${pkgname%-bin}.sh"
    
      44    gendesk -q -f -n \
    
      45        --pkgname="${pkgname%-bin}" \
    
      46        --pkgdesc="${pkgdesc}" \
    
      47        --categories="Office" \
    
      48        --name="${pkgname%-bin}" \
    
      49        --exec="${pkgname%-bin} %U" \
    
      50        --custom="Name[zh_CN]=${_zhsname}"
    
      51    7z x -aoa "${srcdir}/${pkgname%-bin}-${pkgver}.exe"
    
      52    install -Dm755 -d "${srcdir}/tmp"
    
      53    7z x -aoa "${srcdir}/\$PLUGINSDIR/app-64.7z" -o"${srcdir}/tmp"
    
      54    _get_electron_version
    
      55    asar e "${srcdir}/tmp/resources/app.asar" "${srcdir}/app.asar.unpacked"
    
      56    rm -rf "${srcdir}/tmp/resources/app.asar"
    
      57    find "${srcdir}/app.asar.unpacked" -type f -name "*.gz" -exec rm -rf {} +
    
      58    sed -i -e "
    
      59        s/icon.ico/icon.png/g
    
      60        s/process.resourcesPath/\'\/usr\/lib\/${pkgname%-bin}\'/g
    
      61    " "${srcdir}/app.asar.unpacked/background.js"
    
      62    sed -i 's/"icons\/"+e/"icons\/icon.png"/g' "${srcdir}/app.asar.unpacked/background.js"
    
      63    cp "${srcdir}/app.asar.unpacked/icons/32x32.png" "${srcdir}/app.asar.unpacked/icons/darkTemplate.png"
    
      64    cp "${srcdir}/app.asar.unpacked/icons/32x32.png" "${srcdir}/app.asar.unpacked/icons/icon.png"
    
      65    asar p "${srcdir}/app.asar.unpacked" "${srcdir}/tmp/resources/app.asar"
    
      66}
    
      67package() {
    
      68    install -Dm755 "${srcdir}/${pkgname%-bin}.sh" "${pkgdir}/usr/bin/${pkgname%-bin}"
    
      69    install -Dm755 -d "${pkgdir}/usr/lib/${pkgname%-bin}"
    
      70	local _app_dir=$(find "${srcdir}" -type f -name "resources.pak" -exec dirname {} + | head -n 1)
    
      71	cp -a "${_app_dir}/resources/". "${pkgdir}/usr/lib/${pkgname%-bin}/"
    
      72    icon_sizes=(16x16 24x24 32x32 48x48 64x64 128x128 256x256 512x512 1024x1024)
    
      73    for _icons in "${icon_sizes[@]}";do
    
      74        install -Dm644 "${srcdir}/app.asar.unpacked/icons/${_icons}.png" \
    
      75            "${pkgdir}/usr/share/icons/hicolor/${_icons}/apps/${pkgname%-bin}.png"
    
      76    done
    
      77    install -Dm644 "${srcdir}/${pkgname%-bin}.desktop" -t "${pkgdir}/usr/share/applications"
    
      78    install -Dm644 "${srcdir}/LICENSE.html" -t "${pkgdir}/usr/share/licenses/${pkgname}"
    
      79}
    
      80

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2