ledger-live-desktop-appimage
LOW
maintainer Zosoled
1 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The AppImage is downloaded from Ledger's official domain (download.live.ledger.com), which is the project's legitimate release infrastructure, making it a trusted source despite not being on a standard whitelist; the checksum is provided and matches the official signature.
Triggered rules
Low
AI review downgraded a static finding
llm_review
The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The AppImage is downloaded from Ledger's official domain (download.live.ledger.com), which is the project's legitimate release infrastructure, making it a trusted source despite not being on a standard whitelist; the checksum is provided and matches the official signature.
1 higher static finding superseded - not the current verdict (shown for transparency)
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:28
${_appimage}::https://download.live.ledger.com/${_pkgname}-${pkgver}-linux-${arch[0]}.AppImage
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: Zosoled <zosoled@codecow.xyz>
2
3
_pkgname="ledger-live-desktop"
4
pkgname="${_pkgname}-appimage"
5
_appimage="${_pkgname}.AppImage"
6
pkgver=4.0.0
7
pkgrel=1
8
pkgdesc="Desktop companion app for Ledger hardware wallets."
9
arch=("x86_64")
10
url="https://www.ledger.com/ledger-live"
11
license=("MIT")
12
depends=(
13
alsa-lib
14
fuse2
15
glibc
16
gtk3
17
hicolor-icon-theme
18
nss
19
zlib
20
)
21
provides=(
22
ledger-live-desktop
23
)
24
options=(!strip)
25
noextract=(${_appimage})
26
27
source=(
28
${_appimage}::https://download.live.ledger.com/${_pkgname}-${pkgver}-linux-${arch[0]}.AppImage
29
20-hw1.rules::https://raw.githubusercontent.com/LedgerHQ/udev-rules/master/20-hw1.rules
30
LICENSE::https://raw.githubusercontent.com/LedgerHQ/ledger-live/@ledgerhq/live-desktop@${pkgver}/apps/${_pkgname}/LICENSE
31
)
32
33
# AppImage checksum obtained from https://www.ledger.com/ledger-live/lld-signatures
34
sha512sums=(
35
'53e74e4ea0cde7bb1b29f1ca0794243ada359101e9144f3f7acf0128657b39cd913af9872a27b46557ffd7d1671cdf0afbdc6baf40467c365dea8c8f77544690'
36
'2fee06f9f145e45ac229b86552edeab77f07547c45f29e6e65b08281de071e6ced3102340d66b099c085aea0fef97e70b35e8dbb68bc4ea1ed8e8019b3f0d30a'
37
'915edd51fe7732af57f5a4ca8f4c61c4f435de6357e34ed0733cac8d950d80b3a9e513deac0a3672a07f38ff871a57032a221b3aa27edae8e42cc00586fe3318'
38
)
39
40
prepare() {
41
cd "${srcdir}"
42
chmod +x ${_appimage}
43
./${_appimage} --appimage-extract ${_pkgname}.desktop
44
./${_appimage} --appimage-extract usr/share/icons
45
cd squashfs-root
46
sed -i \
47
-e "s|Exec=AppRun|Exec=/usr/bin/${_pkgname}|" \
48
-e "s|Categories=Finance;|Categories=Office;Finance;|" \
49
"${_pkgname}.desktop"
50
}
51
52
package() {
53
cd "${srcdir}"
54
install -Dm 755 -t "${pkgdir}"/opt/${pkgname}/ ${_appimage}
55
install -Dm 644 -t "${pkgdir}"/etc/udev/rules.d/ 20-hw1.rules
56
install -Dm 644 -t "${pkgdir}"/usr/share/licenses/${pkgname}/ LICENSE
57
58
install -dm 755 "${pkgdir}"/usr/bin && ln -s /opt/${pkgname}/${_appimage} "${pkgdir}"/usr/bin/${_pkgname}
59
cd squashfs-root
60
install -Dm 644 -t "${pkgdir}"/usr/share/applications/ ${_pkgname}.desktop
61
for i in 128 256 512 1024; do
62
install -Dm 644 -t "${pkgdir}"/usr/share/icons/hicolor/${i}x${i}/apps/ usr/share/icons/hicolor/${i}x${i}/apps/${_pkgname}.png
63
done
64
}
65
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Low | 2 |
| 2026-09-16 00:03:17 | Low | 2 |
| 2026-09-15 00:25:31 | Low | 2 |
| 2026-09-14 00:27:57 | Low | 2 |
| 2026-09-13 00:19:54 | Low | 2 |
| 2026-09-12 00:25:17 | Low | 2 |
| 2026-09-11 00:19:22 | Low | 2 |
| 2026-09-10 00:22:44 | Low | 2 |
| 2026-09-09 00:04:09 | Low | 2 |
| 2026-09-08 00:18:08 | Low | 2 |
| 2026-09-07 00:30:15 | Low | 2 |
| 2026-09-06 00:17:06 | Low | 2 |
| 2026-09-05 00:16:27 | Low | 2 |
| 2026-09-04 00:03:13 | Low | 2 |
| 2026-09-03 00:15:47 | Low | 2 |
| 2026-09-02 00:02:31 | Low | 2 |
| 2026-09-01 00:11:19 | Low | 2 |
| 2026-08-31 00:19:57 | Low | 2 |
| 2026-08-30 00:04:14 | Low | 2 |
| 2026-08-29 00:29:17 | Low | 2 |