infra-appimage

maintainer Nanozuki · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt AppImage binary from download.infra.app (the official vendor download domain) and installs it as the main executable. The sha512sums are present, so integrity is pinned at package-build time. However, the source URLs use 'latest' in the filename rather than a versioned path, meaning the checksums will mismatch on any update but the current pinned hashes do provide some protection. The real concern is that an AppImage is a self-contained executable blob whose contents are not audited; if the upstream host is compromised or the maintainer fails to update the checksums when upstream rotates the binary, users could receive arbitrary code. The host (download.infra.app) appears to be the official vendor CDN, not a personal or unofficial mirror, which reduces but does not eliminate supply-chain risk. Overall this is a legitimate medium: a prebuilt binary from an official-looking vendor host with checksum pinning, but the 'latest' URL pattern is a maintenance hazard and the AppImage is opaque executed code.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 'https://download.infra.app/linux/infra_latest_amd64.deb'

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt AppImage binary from download.infra.app (the official vendor download domain) and installs it as the main executable. The sha512sums are present, so integrity is pinned at package-build time. However, the source URLs use 'latest' in the filename rather than a versioned path, meaning the checksums will mismatch on any update but the current pinned hashes do provide some protection. The real concern is that an AppImage is a self-contained executable blob whose contents are not audited; if the upstream host is compromised or the maintainer fails to update the checksums when upstream rotates the binary, users could receive arbitrary code. The host (download.infra.app) appears to be the official vendor CDN, not a personal or unofficial mirror, which reduces but does not eliminate supply-chain risk. Overall this is a legitimate medium: a prebuilt binary from an official-looking vendor host with checksum pinning, but the 'latest' URL pattern is a maintenance hazard and the AppImage is opaque executed code.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Nanozuki <pt.wenhan@gmail.com>
    
      2
    
      3pkgname=infra-appimage
    
      4pkgver=0.46.0
    
      5pkgrel=1
    
      6pkgdesc="Infra App for Linux"
    
      7arch=('i686' 'x86_64')
    
      8url="https://infra.app"
    
      9license=('custom')
    
      10groups=('')
    
      11depends=()
    
      12optdepends=()
    
      13options=('!strip' '!emptydirs')
    
      14install=${pkgname}.install
    
      15source=(
    
      16	'https://download.infra.app/linux/infra_latest_amd64.deb'
    
      17	'https://download.infra.app/linux/infra-latest.AppImage'
    
      18)
    
      19sha512sums=(
    
      20	'6c7c1fa0335b786ba069da70696fa673420d620e603cfc055177fe7979a80710dd200e15e8c4f361152e7957fa56fe6c0fa31089a892fc4dd1c8a2dac4bc7972'
    
      21	'0d0f0a71f5acc6cd6c232f5500a220db7672e8621ac96777afe6d30ec07656f0ebeea96cf824dc021d652d6c8834a06571d2036fa93b4963ee8a6a5f5f510a7f'
    
      22)
    
      23
    
      24package(){
    
      25	# Extract package data
    
      26	tar xf data.tar.xz -C "${pkgdir}"
    
      27	rm -f "${pkgdir}/usr/bin/infra"
    
      28	install -D -m755 "infra-latest.AppImage" "${pkgdir}/usr/bin/infra"
    
      29	install -D -m644 "${pkgdir}/usr/lib/infra/LICENSES.chromium.html" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      30	install -D -m644 "${pkgdir}/usr/share/doc/infra/copyright" "${pkgdir}/usr/share/licenses/${pkgname}/COPYRIGHT"
    
      31	rm -rf "${pkgdir}/usr/lib"
    
      32}
    
      33

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2