imago-bin

maintainer rayanderoos · 0 votes · scanned 2026-08-03 00:08:14.047287

HIGH

Why flagged This PKGBUILD is genuinely high risk for multiple reasons: (1) The only source is a local file named 'generator' with a SKIP'd checksum — there is no upstream URL, no integrity verification, and no way to audit what this script does. (2) The package() function explicitly calls 'sudo "$srcdir/generator"' — running an unverified, unaudited local script as root during the build phase. This is a severe violation of packaging norms; makepkg itself runs as a non-root user and calling sudo inside package() to escalate privileges is a classic malware pattern. (3) The 'generator' script presumably downloads the AppImage at build time (since no AppImage URL appears in sources), meaning the actual binary payload is fetched dynamically from an unspecified location with no checksum. This combination — opaque local script, sudo escalation, dynamic payload fetch, SKIP'd checksum — constitutes a genuine high-severity supply-chain risk regardless of whether the maintainer's intent is benign.

Triggered rules

MEDIUM Recently orphaned & re-adopted orphaned_readopted

This package was orphaned and re-adopted within the last 30 days — a window where ownership transfers can introduce malicious changes.

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

HIGH AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (anthropic/claude-sonnet-4.6) reviewed it and judged it HIGH (confidence 95%): This PKGBUILD is genuinely high risk for multiple reasons: (1) The only source is a local file named 'generator' with a SKIP'd checksum — there is no upstream URL, no integrity verification, and no way to audit what this script does. (2) The package() function explicitly calls 'sudo "$srcdir/generator"' — running an unverified, unaudited local script as root during the build phase. This is a severe violation of packaging norms; makepkg itself runs as a non-root user and calling sudo inside package() to escalate privileges is a classic malware pattern. (3) The 'generator' script presumably downloads the AppImage at build time (since no AppImage URL appears in sources), meaning the actual binary payload is fetched dynamically from an unspecified location with no checksum. This combination — opaque local script, sudo escalation, dynamic payload fetch, SKIP'd checksum — constitutes a genuine high-severity supply-chain risk regardless of whether the maintainer's intent is benign.

PKGBUILD

      1# Maintainer: AVN Bramg <anvilnu@gmail.com>
    
      2pkgname=imago-bin
    
      3pkgver=1.0.2
    
      4pkgrel=1
    
      5pkgdesc="Desktop image editor with layers, selection, 55+ effects and local AI (Paint.NET-style)"
    
      6arch=('x86_64')
    
      7url="https://anvilnu.github.io/Imago/"
    
      8license=('GPL3')
    
      9# El AppImage empaqueta Qt, Python y sus dependencias; del sistema solo hacen
    
      10# falta la caché de iconos y fontconfig para la integración de escritorio.
    
      11depends=('hicolor-icon-theme' 'fontconfig')
    
      12provides=('imago')
    
      13conflicts=('imago')
    
      14# Binario ya compilado (PyInstaller): no debe reprocesarse.
    
      15options=('!strip')
    
      16source=(
    
      17  'generator'
    
      18)
    
      19sha256sums=(
    
      20  'SKIP'
    
      21)
    
      22
    
      23package() {
    
      24  sudo "$srcdir/generator"
    
      25  cd "$srcdir"
    
      26  chmod +x "Imago-${pkgver}-x86_64.AppImage"
    
      27  "./Imago-${pkgver}-x86_64.AppImage" --appimage-extract >/dev/null
    
      28
    
      29  # Aplicación (bundle PyInstaller) en /opt.
    
      30  install -d "$pkgdir/opt/imago"
    
      31  cp -a squashfs-root/usr/lib/imago/. "$pkgdir/opt/imago/"
    
      32
    
      33  # Lanzador en el PATH (el .desktop usa Exec=imago).
    
      34  install -d "$pkgdir/usr/bin"
    
      35  ln -s /opt/imago/Imago "$pkgdir/usr/bin/imago"
    
      36
    
      37  # Integración de escritorio: lanzador, icono y metadatos AppStream.
    
      38  install -Dm644 squashfs-root/usr/share/applications/io.github.anvilnu.imago.desktop \
    
      39    "$pkgdir/usr/share/applications/io.github.anvilnu.imago.desktop"
    
      40  install -Dm644 squashfs-root/usr/share/icons/hicolor/64x64/apps/io.github.anvilnu.imago.png \
    
      41    "$pkgdir/usr/share/icons/hicolor/64x64/apps/io.github.anvilnu.imago.png"
    
      42  install -Dm644 squashfs-root/usr/share/metainfo/io.github.anvilnu.imago.metainfo.xml \
    
      43    "$pkgdir/usr/share/metainfo/io.github.anvilnu.imago.metainfo.xml"
    
      44
    
      45  # Licencia (viaja dentro del bundle).
    
      46  install -Dm644 squashfs-root/usr/lib/imago/LICENSE \
    
      47    "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
    
      48}
    
      49
    
      50

Changes since previous scan

--- PKGBUILD @ 2026-07-30 00:17
+++ PKGBUILD @ 2026-08-03 00:08
@@ -13,10 +13,15 @@
 conflicts=('imago')
 # Binario ya compilado (PyInstaller): no debe reprocesarse.
 options=('!strip')
-source=("Imago-${pkgver}-x86_64.AppImage::https://github.com/anvilnu/Imago/releases/download/v${pkgver}/Imago-${pkgver}-x86_64.AppImage")
-sha256sums=('7afdec00b54f195292a0ce1fb70e3d83818050f7454bfddf9a419b684bb5e5b4')
+source=(
+  'generator'
+)
+sha256sums=(
+  'SKIP'
+)
 
 package() {
+  sudo "$srcdir/generator"
   cd "$srcdir"
   chmod +x "Imago-${pkgver}-x86_64.AppImage"
   "./Imago-${pkgver}-x86_64.AppImage" --appimage-extract >/dev/null
@@ -42,3 +47,4 @@
     "$pkgdir/usr/share/licenses/$pkgname/LICENSE"
 }
 
+

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	HIGH	3
2026-08-02 00:16:08	HIGH	3
2026-08-01 00:11:18	HIGH	3
2026-07-31 00:14:10	HIGH	3
2026-07-30 23:19:23	HIGH	3
2026-07-30 23:17:02	HIGH	3
2026-07-30 17:15:21	MEDIUM	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 11:27:50	LOW	2