gyroflow-dev-appimage

maintainer edombek · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged nightly.link is a well-known third-party service that proxies GitHub Actions artifact downloads (artifacts are not available via a stable URL on GitHub itself), so it is commonly used in AUR packages for nightly/CI builds. However, it is still not the project's official release infrastructure — it serves whatever the latest CI artifact happens to be, with no pinned hash (sha256sums=SKIP). The AppImage is an executed binary pulled from an unofficial intermediary with no integrity check, which is a genuine supply-chain concern: if nightly.link or the upstream CI were compromised, or if the artifact were silently replaced, users would execute arbitrary code. The SKIP checksum means there is no way to detect substitution. This is a real medium-severity concern: an executed binary from a non-official host with no integrity verification.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:18 source=("Gyroflow-linux.zip::https://nightly.link/gyroflow/gyroflow/workflows/release/master/Gyroflow-linux.zip"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): nightly.link is a well-known third-party service that proxies GitHub Actions artifact downloads (artifacts are not available via a stable URL on GitHub itself), so it is commonly used in AUR packages for nightly/CI builds. However, it is still not the project's official release infrastructure — it serves whatever the latest CI artifact happens to be, with no pinned hash (sha256sums=SKIP). The AppImage is an executed binary pulled from an unofficial intermediary with no integrity check, which is a genuine supply-chain concern: if nightly.link or the upstream CI were compromised, or if the artifact were silently replaced, users would execute arbitrary code. The SKIP checksum means there is no way to detect substitution. This is a real medium-severity concern: an executed binary from a non-official host with no integrity verification.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Evgeniy Dombek <edombek@yandex.ru>
    
      2
    
      3_pkgname=gyroflow
    
      4pkgname=${_pkgname}-dev-appimage
    
      5pkgver=1.6.0
    
      6pkgrel=1
    
      7pkgdesc="Video stabilization using gyroscope data"
    
      8arch=("x86_64")
    
      9license=("GPL3")
    
      10options=('!strip' '!debug')
    
      11url="https://gyroflow.xyz/"
    
      12depends=("libc++" "qt6-base" "qt6-quick3d" "qt6-declarative" "qt6-3d" "pulseaudio" "libxkbcommon" "opencv" "ocl-icd" "ffmpeg")
    
      13optdepends=("opencl-driver: OpenCL driver for GPU accelerated stabilization"
    
      14            "libva-mesa-driver: VAAPI video acceleration for NVIDIA and AMD GPU"
    
      15            "intel-media-driver: VAAPI video acceleration for Intel GPU")
    
      16provides=("${_pkgname}")
    
      17conflicts=("${_pkgname}" "${_pkgname}-appimage" "${_pkgname}-git")
    
      18source=("Gyroflow-linux.zip::https://nightly.link/gyroflow/gyroflow/workflows/release/master/Gyroflow-linux.zip"
    
      19		"icon.svg::https://raw.githubusercontent.com/gyroflow/gyroflow/v${pkgver}/resources/icon.svg"
    
      20        "${_pkgname}.desktop")
    
      21
    
      22sha256sums=(SKIP
    
      23            '847ac94756cb80317c2cb716790c4fded707236eaecbf6c9611d27124c442578'
    
      24            '9e97420c0d48fa0959312d6566410f801d82423b4a3332fe9eddb33c04469779')
    
      25
    
      26package() {
    
      27  # move the entire distribution to /usr/share
    
      28  mkdir -p "${pkgdir}"/usr/share/
    
      29
    
      30  # desktop file
    
      31  install -Dm 644 ${srcdir}/"icon.svg" "${pkgdir}/usr/share/pixmaps/${_pkgname}.svg"
    
      32  install -Dm 644 "${srcdir}"/${_pkgname}.desktop \
    
      33    "${pkgdir}"/usr/share/applications/${_pkgname}.desktop
    
      34
    
      35  # binary
    
      36  mkdir -p "${pkgdir}"/usr/bin
    
      37  mv ${srcdir}/"Gyroflow-linux64.AppImage" "${pkgdir}"/usr/bin/${_pkgname}
    
      38}
    
      39

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2