folio-bin

MEDIUM

maintainer nvidiahater 0 votes scanned 2026-09-15 17:20:16.402287

View on AUR

Why flagged

The package downloads a prebuilt AppImage from an untrusted host (GitHub releases), which is then patched and repackaged; this supply-chain risk is elevated by the binary modification and lack of verifiable source build.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package downloads a prebuilt AppImage from an untrusted host (GitHub releases), which is then patched and repackaged; this supply-chain risk is elevated by the binary modification and lack of verifiable source build.

PKGBUILD

      1pkgname=folio-bin
    
      2pkgver=26.01
    
      3pkgrel=1
    
      4pkgdesc="Markdown note-taking application for GNOME using native Arch Linux libraries"
    
      5arch=('x86_64')
    
      6url="https://github.com/toolstack/Folio"
    
      7license=('GPL-3.0-or-later')
    
      8depends=(
    
      9  'dconf'
    
      10  'glib2'
    
      11  'glibc'
    
      12  'gtk4'
    
      13  'gtksourceview5'
    
      14  'libadwaita'
    
      15  'libgee'
    
      16  'pango'
    
      17)
    
      18makedepends=('perl')
    
      19provides=("folio=${pkgver}")
    
      20conflicts=('folio')
    
      21options=('!debug')
    
      22source=("${url}/releases/download/${pkgver}/Folio-${pkgver}-x86_64.AppImage")
    
      23noextract=("Folio-${pkgver}-x86_64.AppImage")
    
      24sha256sums=('1ada0025ec3fdbe79511b52d9db7025d0ef30e0eaed738b0d297d3268e524364')
    
      25
    
      26prepare() {
    
      27  local appimage="${srcdir}/Folio-${pkgver}-x86_64.AppImage"
    
      28  local binary="${srcdir}/squashfs-root/usr/local/bin/com.toolstack.Folio"
    
      29  local original_size
    
      30
    
      31  chmod +x "${appimage}"
    
      32  cd "${srcdir}"
    
      33  "${appimage}" --appimage-extract >/dev/null
    
      34
    
      35  if [[ "$(grep -aoF '/usr/local/share/locale' "${binary}" | wc -l)" -ne 1 ]]; then
    
      36    error 'Unexpected Folio locale path count'
    
      37    return 1
    
      38  fi
    
      39
    
      40  original_size="$(stat -c %s "${binary}")"
    
      41  perl -pi -e 's{/usr/local/share/locale}{/usr/share/locale\x00\x00\x00\x00\x00\x00}' "${binary}"
    
      42  if [[ "$(stat -c %s "${binary}")" -ne "${original_size}" ]]; then
    
      43    error 'Patching the Folio locale path changed the binary size'
    
      44    return 1
    
      45  fi
    
      46}
    
      47
    
      48check() {
    
      49  local appdir="${srcdir}/squashfs-root/usr/local"
    
      50  local binary
    
      51  local log
    
      52
    
      53  for binary in com.toolstack.Folio folio-search-provider; do
    
      54    log="${srcdir}/${binary}.ldd.log"
    
      55    if ! ldd -r "${appdir}/bin/${binary}" > "${log}"; then
    
      56      cat "${log}"
    
      57      return 1
    
      58    fi
    
      59    if grep -Eq 'not found|undefined symbol' "${log}"; then
    
      60      cat "${log}"
    
      61      return 1
    
      62    fi
    
      63    if readelf -d "${appdir}/bin/${binary}" | grep -Eq '\((RPATH|RUNPATH)\)'; then
    
      64      error "${binary} contains an AppImage library search path"
    
      65      return 1
    
      66    fi
    
      67  done
    
      68
    
      69  if grep -aFq '/usr/local/' "${appdir}/bin/com.toolstack.Folio"; then
    
      70    error 'Folio still contains an /usr/local path'
    
      71    return 1
    
      72  fi
    
      73
    
      74  glib-compile-schemas --strict --dry-run "${appdir}/share/glib-2.0/schemas"
    
      75}
    
      76
    
      77package() {
    
      78  local appdir="${srcdir}/squashfs-root/usr/local"
    
      79
    
      80  install -Dm755 "${appdir}/bin/com.toolstack.Folio" \
    
      81    "${pkgdir}/usr/bin/com.toolstack.Folio"
    
      82  install -Dm755 "${appdir}/bin/folio-search-provider" \
    
      83    "${pkgdir}/usr/bin/folio-search-provider"
    
      84
    
      85  install -d "${pkgdir}/usr/share"
    
      86  cp -r "${appdir}/share/." "${pkgdir}/usr/share/"
    
      87  rm "${pkgdir}/usr/share/glib-2.0/schemas/gschemas.compiled"
    
      88
    
      89  sed -i 's#/usr/local/bin/#/usr/bin/#g' \
    
      90    "${pkgdir}/usr/share/applications/com.toolstack.Folio.desktop" \
    
      91    "${pkgdir}/usr/share/applications/com.toolstack.Folio-editor.desktop" \
    
      92    "${pkgdir}/usr/share/dbus-1/services/com.toolstack.Folio.service"
    
      93}
    
      94

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-15 17:20:16	Medium	2