futubull-appimage

maintainer skychan · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads a prebuilt proprietary AppImage binary from softwaredownload.futunn.com (Futu's official software distribution CDN, not a personal/unofficial host) and executes it during the build phase both to extract assets and as the installed application. The sha512sums is set to SKIP, meaning there is no integrity verification whatsoever. While softwaredownload.futunn.com appears to be the legitimate vendor CDN for Futu/Futubull (a real Hong Kong brokerage), the combination of: (1) an executed prebuilt binary, (2) no checksum verification, and (3) the binary being installed system-wide and run as a financial trading application constitutes a genuine medium-severity supply-chain concern. If the CDN is compromised or the download is intercepted via MITM (no pinned hash to detect substitution), users would execute arbitrary code with their credentials in a financial context. This is a real concern, not a false positive, though it is a common pattern for AppImage-based AUR packages and not clearly malicious intent by the maintainer.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source=("https://softwaredownload.futunn.com/FTNN_desktop_${pkgver}_amd64.AppImage")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): This PKGBUILD downloads a prebuilt proprietary AppImage binary from softwaredownload.futunn.com (Futu's official software distribution CDN, not a personal/unofficial host) and executes it during the build phase both to extract assets and as the installed application. The sha512sums is set to SKIP, meaning there is no integrity verification whatsoever. While softwaredownload.futunn.com appears to be the legitimate vendor CDN for Futu/Futubull (a real Hong Kong brokerage), the combination of: (1) an executed prebuilt binary, (2) no checksum verification, and (3) the binary being installed system-wide and run as a financial trading application constitutes a genuine medium-severity supply-chain concern. If the CDN is compromised or the download is intercepted via MITM (no pinned hash to detect substitution), users would execute arbitrary code with their credentials in a financial context. This is a real concern, not a false positive, though it is a common pattern for AppImage-based AUR packages and not clearly malicious intent by the maintainer.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: skychan <diufanshu@gmail.com>
    
      2
    
      3pkgname=futubull-appimage
    
      4
    
      5pkgver=15.13.11208
    
      6pkgrel=1
    
      7pkgdesc="Futubull (富途牛牛) for Linux (AppImage) - Trade HK, US, CN (A-shares), options, ETFs across global markets platform"
    
      8arch=('x86_64')
    
      9url="https://github.com/skychan/futubull-appimage.git"
    
      10license=('MIT')
    
      11options=(!strip)
    
      12source=("https://softwaredownload.futunn.com/FTNN_desktop_${pkgver}_amd64.AppImage")
    
      13sha512sums=('SKIP')
    
      14
    
      15_filename="FTNN_desktop_${pkgver}_amd64.AppImage"
    
      16_squashfs_desktop_file="FTNN.desktop"
    
      17_squashfs_icon_file="FTNN.png"
    
      18_appimage_name="Futubull"
    
      19_install_path="/opt/appimages/${_appimage_name}"
    
      20_desktop_file="/usr/share/applications/${_squashfs_desktop_file}"
    
      21
    
      22package() {
    
      23    chmod +x "${_filename}"
    
      24
    
      25    # Extract desktop and icon files from AppImage
    
      26    ./${_filename} --appimage-extract "${_squashfs_desktop_file}" >/dev/null 2>&1
    
      27    ./${_filename} --appimage-extract "usr/share/icons/hicolor/*/apps/${_squashfs_icon_file}" >/dev/null 2>&1
    
      28
    
      29    # Fix .desktop Exec and Icon paths
    
      30    sed -i -E "s|Exec=.*|Exec=env DESKTOPINTEGRATION=0 APPIMAGELAUNCHER_DISABLE=1 /usr/bin/futubull|" "squashfs-root/${_squashfs_desktop_file}"
    
      31    sed -i -E "s|Icon=.*|Icon=${_squashfs_icon_file}|" "squashfs-root/${_squashfs_desktop_file}"
    
      32
    
      33    # Install AppImage binary
    
      34    install -Dm755 "${_filename}" "${pkgdir}/${_install_path}"
    
      35    install -dm755 "${pkgdir}/usr/bin/"
    
      36    ln -s "${_install_path}" "${pkgdir}/usr/bin/futubull"
    
      37
    
      38    # Install desktop entry
    
      39    install -Dm644 "squashfs-root/${_squashfs_desktop_file}" "${pkgdir}/${_desktop_file}"
    
      40
    
      41    # Install icons
    
      42    install -dm755 "${pkgdir}/usr/share/icons"
    
      43    cp -dpr --no-preserve=ownership "squashfs-root/usr/share/icons" "${pkgdir}/usr/share"
    
      44    chmod -R 755 "${pkgdir}/usr/share/icons"
    
      45    find "${pkgdir}/usr/share/icons" -type f -name "${_squashfs_icon_file}" -exec chmod 644 {} \;
    
      46
    
      47    # Disable AppImageLauncher integration prompts
    
      48    install -dm755 "${pkgdir}/usr/share/appimagekit"
    
      49
    
      50}
    
      51
    
      52

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2