ledger-live-bin
LOW
maintainer phnx47
62 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads a prebuilt AppImage from Ledger's official domain (download.live.ledger.com), which is the project's own release infrastructure; despite the static analyzer flag for a non-standard host, this is a legitimate source for the software, and the checksums are provided, making it a low-risk, standard AUR binary package.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-2507) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt AppImage from Ledger's official domain (download.live.ledger.com), which is the project's own release infrastructure; despite the static analyzer flag for a non-standard host, this is a legitimate source for the software, and the checksums are provided, making it a low-risk, standard AUR binary package.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:21
source=("${_appimg}::https://download.live.ledger.com/${_appimg}"
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Serge <arch@phnx47.net>
2
# Contributor: Stephen Argent <steve [at] tuxcon [dot] com>
3
4
# Auto Upgrade: https://github.com/phnx47/pkgbuilds
5
6
_appname=ledger-live-desktop
7
_pkgname=ledger-live
8
pkgname="${_pkgname}-bin"
9
pkgver=4.19.1
10
pkgrel=1
11
pkgdesc='Maintain your Ledger devices'
12
license=('MIT')
13
url='https://shop.ledger.com/pages/ledger-wallet-download'
14
arch=('x86_64')
15
depends=('gtk3' 'nss' 'alsa-lib' 'ledger-udev')
16
makedepends=('desktop-file-utils')
17
options=('!strip')
18
provides=("${_pkgname}")
19
conflicts=("${_pkgname}")
20
_appimg="ledger-live-desktop-${pkgver}-linux-${arch[0]}.AppImage"
21
source=("${_appimg}::https://download.live.ledger.com/${_appimg}"
22
"LICENSE::https://raw.githubusercontent.com/LedgerHQ/ledger-live/refs/tags/%40ledgerhq/live-desktop%40${pkgver}/apps/ledger-live-desktop/LICENSE")
23
# https://www.ledger.com/ledger-live/lld-signatures
24
sha512sums=('b269ee6972b8ced9a2cdb0f22022805673adcacb2e4824da1d32649475906b462be7d33ec6955293e00f1730a2f24447b9ecd21ca035b243c84d6a18e2c0bdd5'
25
'915edd51fe7732af57f5a4ca8f4c61c4f435de6357e34ed0733cac8d950d80b3a9e513deac0a3672a07f38ff871a57032a221b3aa27edae8e42cc00586fe3318')
26
27
prepare() {
28
chmod +x "${_appimg}"
29
"./${_appimg}" --appimage-extract
30
31
cd squashfs-root
32
desktop-file-edit \
33
--set-key=Exec \
34
--set-value="${_appname} %U" \
35
--add-category=Network \
36
--remove-key=X-AppImage-Version \
37
"${_appname}.desktop"
38
39
rm "AppRun" "resources/app-update.yml"
40
}
41
42
package() {
43
install -d "${pkgdir}/opt/${_pkgname}"
44
cp -a "squashfs-root/." "${pkgdir}/opt/${_pkgname}/"
45
46
install -d "${pkgdir}/usr/bin"
47
ln -s "/opt/${_pkgname}/${_appname}" "${pkgdir}/usr/bin/"
48
49
install -d "${pkgdir}/usr/share/applications"
50
ln -s "/opt/${_pkgname}/${_appname}.desktop" "${pkgdir}/usr/share/applications/"
51
52
for i in 128 256 512 1024; do
53
install -d "${pkgdir}/usr/share/icons/hicolor/${i}x${i}/apps"
54
ln -s "/opt/${_pkgname}/usr/share/icons/hicolor/${i}x${i}/apps/${_appname}.png" "${pkgdir}/usr/share/icons/hicolor/${i}x${i}/apps/"
55
done
56
57
find "${pkgdir}" -type d -exec chmod 755 {} +
58
59
install -Dm644 "LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
60
}
61
Changes since previous scan
--- PKGBUILD @ 2026-09-14 00:27+++ PKGBUILD @ 2026-09-17 00:27@@ -6,7 +6,7 @@ _appname=ledger-live-desktop _pkgname=ledger-live pkgname="${_pkgname}-bin"-pkgver=4.17.1+pkgver=4.19.1 pkgrel=1 pkgdesc='Maintain your Ledger devices' license=('MIT')@@ -18,11 +18,10 @@ provides=("${_pkgname}") conflicts=("${_pkgname}") _appimg="ledger-live-desktop-${pkgver}-linux-${arch[0]}.AppImage"-_license_sha='a04d86c' source=("${_appimg}::https://download.live.ledger.com/${_appimg}"- "LICENSE-${_license_sha}::https://raw.githubusercontent.com/LedgerHQ/ledger-live/${_license_sha}/apps/ledger-live-desktop/LICENSE")+ "LICENSE::https://raw.githubusercontent.com/LedgerHQ/ledger-live/refs/tags/%40ledgerhq/live-desktop%40${pkgver}/apps/ledger-live-desktop/LICENSE") # https://www.ledger.com/ledger-live/lld-signatures-sha512sums=('90bea020ace6e787ec74772301c2aa82e95c663aba5ef169dcdc8ba9abb38d45e224281e0df0e47050d0156ed9f0e9385c51c876e90d5fed63766b811312496b'+sha512sums=('b269ee6972b8ced9a2cdb0f22022805673adcacb2e4824da1d32649475906b462be7d33ec6955293e00f1730a2f24447b9ecd21ca035b243c84d6a18e2c0bdd5' '915edd51fe7732af57f5a4ca8f4c61c4f435de6357e34ed0733cac8d950d80b3a9e513deac0a3672a07f38ff871a57032a221b3aa27edae8e42cc00586fe3318') prepare() {@@ -57,6 +56,6 @@ find "${pkgdir}" -type d -exec chmod 755 {} + - install -Dm644 "LICENSE-${_license_sha}" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"+ install -Dm644 "LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE" } Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 21:18:01 | Medium | 1 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 23:15:20 | Medium | 1 |
| 2026-08-26 00:12:07 | Clean | 2 |
| 2026-08-25 01:25:31 | Medium | 1 |
| 2026-08-21 00:01:35 | Clean | 2 |
| 2026-08-20 11:11:30 | Medium | 1 |
| 2026-08-20 00:05:13 | Low | 2 |
| 2026-08-19 00:15:45 | Low | 2 |
| 2026-08-18 00:03:42 | Low | 2 |
| 2026-08-17 00:18:29 | Low | 2 |