hamrs-appimage
MEDIUM
maintainer not_anonymous
1 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads a prebuilt AppImage from a non-standard host (S3 bucket), which is an unverifiable executable that could be silently swapped, posing a supply-chain risk despite checksums being present.
Triggered rules
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:19
source=("https://$__pkgname-dist.s3.amazonaws.com/$_pkgname-$pkgver-linux-x86_64.AppImage"
Medium
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-07-25) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt AppImage from a non-standard host (S3 bucket), which is an unverifiable executable that could be silently swapped, posing a supply-chain risk despite checksums being present.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: not_anonymous <nmlibertarian@gmail.com>
2
# Contributor: Sean Snell <ssnell@lakecs.net>
3
# Submission: not_anonymous <nmlibertarian@gmail.com>
4
5
pkgname=hamrs-appimage
6
_pkgname=hamrs-pro
7
__pkgname=hamrs
8
_install_path="/opt/appimages"
9
pkgver=2.51.0
10
pkgrel=1
11
pkgdesc="Ham Radio portable logger tailored for activities like Parks on the Air, Field Day, and others."
12
arch=('x86_64')
13
url="https://hamrs.app/"
14
license=('LicenseRef-custom:electron')
15
depends=('fuse2' 'hicolor-icon-theme' 'zlib' 'hamradio-menus')
16
provides=('hamrs')
17
conflicts=('hamrs')
18
options=(!strip)
19
source=("https://$__pkgname-dist.s3.amazonaws.com/$_pkgname-$pkgver-linux-x86_64.AppImage"
20
"hamrs-pro.png")
21
22
prepare() {
23
chmod a+x "$_pkgname-$pkgver-linux-$arch.AppImage"
24
"./$_pkgname-$pkgver-linux-$arch.AppImage" --appimage-extract > /dev/null
25
sed 's|AppRun|/opt/appimages/hamrs-pro.AppImage|g;s|Utility|HamRadio|g' -i "$srcdir/squashfs-root/$_pkgname.desktop"
26
}
27
28
package() {
29
install -Dm755 "$srcdir/$_pkgname-$pkgver-linux-$arch.AppImage" "$pkgdir/$_install_path/$_pkgname.AppImage"
30
install -Dm644 "$srcdir/squashfs-root/$_pkgname.desktop" "$pkgdir/usr/share/applications/$_pkgname.desktop"
31
32
for _icons in 1024x1024;do
33
install -Dm644 "$srcdir/squashfs-root/usr/share/icons/hicolor/$_icons/apps/$_pkgname.png" \
34
"$pkgdir/usr/share/icons/hicolor/$_icons/apps/$_pkgname.png"
35
done
36
install -Dm644 "$srcdir/$_pkgname.png" \
37
"$pkgdir/usr/share/icons/hicolor/32x32/apps/$_pkgname.png"
38
39
install -Dm644 "$srcdir/squashfs-root/LICENSE.electron.txt" -t "$pkgdir/usr/share/licenses/$pkgname"
40
}
41
md5sums=('23fa52cb61c5b2a575028efab9e683a0'
42
'8b675923edac47fcec1d0f79affde717')
43
sha256sums=('1627e4de962f4cbf5d82599bec5fc9528489147d6db8e0b5e7034ccdd8cb1c8a'
44
'34fd872afa2dc85872f8ec6f4f4cd4380d480cb4d069ecd869e2bb8ed2c4d97c')
45
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Medium | 2 |
| 2026-09-16 00:03:17 | Medium | 2 |
| 2026-09-15 00:25:31 | Medium | 2 |
| 2026-09-14 00:27:57 | Medium | 2 |
| 2026-09-13 00:19:54 | Medium | 2 |
| 2026-09-12 00:25:17 | Medium | 2 |
| 2026-09-11 00:19:22 | Medium | 2 |
| 2026-09-10 00:22:44 | Medium | 2 |
| 2026-09-09 00:04:09 | Medium | 2 |
| 2026-09-08 00:18:08 | Medium | 2 |
| 2026-09-07 00:30:15 | Medium | 2 |
| 2026-09-06 00:17:06 | Medium | 2 |
| 2026-09-05 00:16:27 | Medium | 2 |
| 2026-09-04 00:03:13 | Medium | 2 |
| 2026-09-03 00:15:47 | Medium | 2 |
| 2026-09-02 00:02:31 | Medium | 2 |
| 2026-09-01 00:11:19 | Medium | 2 |
| 2026-08-31 00:19:57 | Medium | 2 |
| 2026-08-30 00:04:14 | Medium | 2 |
| 2026-08-29 00:29:17 | Medium | 2 |