hamconnect-bin

MEDIUM

maintainer lycanananas 0 votes scanned 2026-10-06 08:02:16.298752

View on AUR

Why flagged

The package downloads a prebuilt AppImage from a non-standard, project-specific host (hamaward.cloud) which is not on the whitelist and could allow silent swapping of an unverifiable executable; this constitutes a supply-chain risk despite otherwise legitimate use.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source_x86_64=("HamConnect-${pkgver}-linux.AppImage::https://hamaward.cloud/static/HC/HamConnect-${pkgver}-linux.AppImage")

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt AppImage from a non-standard, project-specific host (hamaward.cloud) which is not on the whitelist and could allow silent swapping of an unverifiable executable; this constitutes a supply-chain risk despite otherwise legitimate use.

PKGBUILD

1 offending line(s) highlighted

      1pkgname=hamconnect-bin
    
      2pkgver=25.12.0
    
      3pkgrel=7
    
      4pkgdesc='HamConnect is an application that connects your local logger with hamaward.cloud'
    
      5arch=('x86_64')
    
      6url='https://hamaward.cloud/'
    
      7license=('unknown')
    
      8depends=('brotli' 'bzip2' 'freetype2' 'glibc' 'harfbuzz'
    
      9         'hicolor-icon-theme' 'libgcc' 'libglvnd' 'libstdc++'
    
      10         'libx11' 'libxcb' 'zlib')
    
      11options=('!strip')
    
      12source_x86_64=("HamConnect-${pkgver}-linux.AppImage::https://hamaward.cloud/static/HC/HamConnect-${pkgver}-linux.AppImage")
    
      13sha256sums_x86_64=('293f0fd67cc6c3cfc6dffa9d80201d237d9a5eef8b6e0052574c98dab7fae44a')
    
      14
    
      15prepare() {
    
      16  chmod +x "${srcdir}/HamConnect-${pkgver}-linux.AppImage"
    
      17  "${srcdir}/HamConnect-${pkgver}-linux.AppImage" --appimage-extract
    
      18}
    
      19
    
      20package() {
    
      21  install -dm755 "${pkgdir}/opt/hamconnect"
    
      22  cp -a squashfs-root/. "${pkgdir}/opt/hamconnect/"
    
      23  rm "${pkgdir}/opt/hamconnect/HamConnect-${pkgver}-x86_64.AppImage"
    
      24
    
      25  install -dm755 "${pkgdir}/usr/bin"
    
      26  ln -s /opt/hamconnect/AppRun "${pkgdir}/usr/bin/hamconnect"
    
      27
    
      28  install -Dm644 squashfs-root/appicon.png \
    
      29    "${pkgdir}/usr/share/icons/hicolor/512x512/apps/hamconnect.png"
    
      30  install -dm755 "${pkgdir}/usr/share/applications"
    
      31  sed -e 's|^Exec=.*|Exec=sh -c "exec hamconnect >/dev/null 2>\&1"|' \
    
      32      -e 's|^Icon=.*|Icon=hamconnect|' \
    
      33      -e 's|^Terminal=.*|Terminal=false|' \
    
      34      -e '/^X-AppImage-/d' \
    
      35      squashfs-root/HamConnect.desktop > "${pkgdir}/usr/share/applications/hamconnect.desktop"
    
      36}

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-06 08:02:16	Medium	3