koda-desktop-bin

MEDIUM

maintainer AkkyMa 0 votes scanned 2026-11-05 14:11:32.048450

View on AUR

Why flagged

Prebuilt AppImage binary downloaded from a non-standard, project-affiliated but unverifiable Nexus repository host (nexus.kodacode.online) that an unrelated party could silently swap; the AppImage is extracted and installed as an executable, though a sha256 checksum is provided which partially mitigates the risk.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:12 source_x86_64=("Koda-Desktop-${pkgver}.AppImage::https://nexus.kodacode.online/repository/koda-desktop/tags/v1.3.2/linux/Koda-Desktop-1.3.2.AppImage")

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review llm_review

An AI model (anthropic/claude-sonnet-4.6) reviewed this and agrees it is MEDIUM (confidence 70%): Prebuilt AppImage binary downloaded from a non-standard, project-affiliated but unverifiable Nexus repository host (nexus.kodacode.online) that an unrelated party could silently swap; the AppImage is extracted and installed as an executable, though a sha256 checksum is provided which partially mitigates the risk.

PKGBUILD

1 offending line(s) highlighted

      1pkgname=koda-desktop-bin
    
      2pkgver=1.3.2
    
      3pkgrel=1
    
      4pkgdesc='Koda AI desktop client (prebuilt AppImage)'
    
      5arch=('x86_64')
    
      6url='https://www.kodacode.ru/'
    
      7license=('ISC')
    
      8depends=('fuse2')
    
      9provides=('koda-desktop')
    
      10conflicts=('koda-desktop')
    
      11options=('!strip')
    
      12source_x86_64=("Koda-Desktop-${pkgver}.AppImage::https://nexus.kodacode.online/repository/koda-desktop/tags/v1.3.2/linux/Koda-Desktop-1.3.2.AppImage")
    
      13sha256sums_x86_64=('8774da266acd14c7945920337c854c4e6c1a5cf490f760f6e061a9fc62d1253f')
    
      14
    
      15prepare() {
    
      16  chmod +x "Koda-Desktop-${pkgver}.AppImage"
    
      17  ./"Koda-Desktop-${pkgver}.AppImage" --appimage-extract >/dev/null
    
      18}
    
      19
    
      20package() {
    
      21  install -Dm755 "Koda-Desktop-${pkgver}.AppImage" "${pkgdir}/opt/koda-desktop/Koda-Desktop.AppImage"
    
      22  install -d "${pkgdir}/usr/bin"
    
      23  ln -s /opt/koda-desktop/Koda-Desktop.AppImage "${pkgdir}/usr/bin/koda-desktop"
    
      24
    
      25  desktop_file="$(find squashfs-root -type f -name '*.desktop' -print -quit)"
    
      26  if [[ -n "${desktop_file}" ]]; then
    
      27    install -Dm644 "${desktop_file}" "${pkgdir}/usr/share/applications/koda-desktop.desktop"
    
      28    sed -i -E 's|^Exec=.*|Exec=/usr/bin/koda-desktop %U|' "${pkgdir}/usr/share/applications/koda-desktop.desktop"
    
      29  fi
    
      30  while IFS= read -r icon; do
    
      31    relative="${icon#squashfs-root/usr/share/icons/}"
    
      32    install -Dm644 "${icon}" "${pkgdir}/usr/share/icons/${relative}"
    
      33  done < <(find squashfs-root/usr/share/icons -type f \( -name '*.png' -o -name '*.svg' \) 2>/dev/null || true)
    
      34}
    
      35

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-05 14:11:32	Medium	3
2026-11-05 14:09:10	Medium	3