gourou-appimage

maintainer vcalv · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt AppImage binary from soutade.fr (the personal/project site of the upstream author 'soutade'), not from a forge/release page with strong provenance guarantees. The AppImage is extracted and its binaries are installed and executed. While soutade.fr appears to be the legitimate upstream author's own site (the forge URL also points to forge.soutade.fr), it is still a personal host rather than a major forge release asset, meaning there is no third-party integrity guarantee beyond the sha512sum check in the PKGBUILD. The sha512sum provides meaningful protection against tampering in transit, but does not protect against the host owner substituting the file. The AppImage contains executable code (acsmdownloader, adept_activate, etc.) that is run directly. This is a real, if modest, supply-chain concern: a personal binary host with no reproducible build, though the sha512sum mitigates MITM risk. Rated medium rather than high because there is no evidence of malice, the host is the upstream author's own domain, and a checksum is present.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 "https://soutade.fr/files/${__appimagename}.tar.gz"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt AppImage binary from soutade.fr (the personal/project site of the upstream author 'soutade'), not from a forge/release page with strong provenance guarantees. The AppImage is extracted and its binaries are installed and executed. While soutade.fr appears to be the legitimate upstream author's own site (the forge URL also points to forge.soutade.fr), it is still a personal host rather than a major forge release asset, meaning there is no third-party integrity guarantee beyond the sha512sum check in the PKGBUILD. The sha512sum provides meaningful protection against tampering in transit, but does not protect against the host owner substituting the file. The AppImage contains executable code (acsmdownloader, adept_activate, etc.) that is run directly. This is a real, if modest, supply-chain concern: a personal binary host with no reproducible build, though the sha512sum mitigates MITM risk. Rated medium rather than high because there is no evidence of malice, the host is the upstream author's own domain, and a checksum is present.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: VCalV
    
      2_pkgname=gourou
    
      3pkgname="${_pkgname}-appimage"
    
      4pkgver=0.8.7
    
      5__appimagename="libgourou_utils-${pkgver}-x86_64.AppImage"
    
      6pkgrel=4
    
      7pkgdesc="Download and decrypt adobe encrypted (acsm) pdf and epub files (no dependencies)"
    
      8arch=('x86_64')
    
      9license=('LGPL-3.0-only')
    
      10url="https://forge.soutade.fr/soutade/libgourou"
    
      11depends=('zlib' 'fuse2')
    
      12makedepends=()
    
      13conflicts=(gourou-git gourou gourou-bin)
    
      14provides=("gourou=${pkgver}")
    
      15options=(!strip)
    
      16source=(
    
      17	"https://soutade.fr/files/${__appimagename}.tar.gz"
    
      18)
    
      19sha512sums=(
    
      20        227de9e18ddf5da660712872b9765cbe52f96e09dfe6537069633cf70f24822e6c960b26b89c3fc61230cae38b3a6c30cbc82daa2df8b8fe966b1818f9ee58e3
    
      21)
    
      22
    
      23prepare() {
    
      24	cd "$srcdir"
    
      25	chmod +x "$__appimagename/$__appimagename"
    
      26	./"$__appimagename/$__appimagename" --appimage-extract utils >/dev/null
    
      27}
    
      28
    
      29package() {
    
      30	install -d "$pkgdir"/{usr/bin/,usr/share/man/man1/}
    
      31
    
      32	cd "$srcdir"
    
      33	__appimages="${pkgdir}/opt/${_pkgname}/"
    
      34	__squashfs="${srcdir}/squashfs-root/utils/"
    
      35
    
      36	install -d "${__appimages}"
    
      37
    
      38	# start by installing the actual image
    
      39	cp -a --no-preserve=ownership "$__appimagename/$__appimagename" "${__appimages}"
    
      40
    
      41	# install man pages
    
      42	cp --no-preserve=ownership "${__squashfs}"/man/* "$pkgdir"/usr/share/man/man1/
    
      43	gzip -9 "$pkgdir"/usr/share/man/man1/*
    
      44
    
      45	# create symlinks for executables
    
      46	for cmd in acsmdownloader adept_activate adept_remove adept_loan_mgt; do
    
      47		ln -s "/opt/${_pkgname}/${__appimagename}" "${pkgdir}/usr/bin/${cmd}"
    
      48	done
    
      49
    
      50	install -Dm444 "${__squashfs}"/LICENSE "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      51}
    
      52

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2