lightning-matrix-appimage

MEDIUM

maintainer traysh 0 votes scanned 2026-08-24 17:24:12.078683

View on AUR

Why flagged

The package installs a prebuilt AppImage from GitHub releases, which is an unverifiable executable binary; if compromised, it could execute arbitrary code, though the source is from the project's official repository.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package installs a prebuilt AppImage from GitHub releases, which is an unverifiable executable binary; if compromised, it could execute arbitrary code, though the source is from the project's official repository.

PKGBUILD

      1# Maintainer: Danilo Luvizotto <danilo.luvizotto@gmail.com>
    
      2
    
      3_pkgname=lightning-matrix
    
      4pkgname=${_pkgname}-appimage
    
      5pkgver=0.7.6
    
      6pkgrel=1
    
      7pkgdesc='Native Qt 6 Matrix desktop client using the official Rust Matrix SDK (prebuilt AppImage)'
    
      8arch=('x86_64')
    
      9url='https://www.lightning-matrix.org/'
    
      10license=('GPL-3.0-or-later')
    
      11depends=('fuse2' 'hicolor-icon-theme' 'zlib')
    
      12provides=("${_pkgname}=${pkgver}")
    
      13conflicts=("${_pkgname}")
    
      14options=('!strip' '!debug')
    
      15
    
      16_appimage="Lightning-${pkgver}-${CARCH}.AppImage"
    
      17_sumfile="SHA256SUMS-${pkgver}"
    
      18_release_url="https://github.com/Mizerd/lightning/releases/download/v${pkgver}"
    
      19
    
      20source_x86_64=(
    
      21  "${_appimage}::${_release_url}/${_appimage}"
    
      22  "${_sumfile}::${_release_url}/SHA256SUMS"
    
      23)
    
      24noextract=("${_appimage}")
    
      25
    
      26sha256sums_x86_64=('4e7059c38944ae785ed81f67fe1adcaedff94e920c2f3816a9ee2f797e67a8c5'
    
      27                   '92deee5ffeb34471b122d793fd9fbd3e613a28a44f672031571afe735bf210ff')
    
      28
    
      29prepare() {
    
      30  local expected
    
      31
    
      32  expected="$(awk -v f="${_appimage}" '
    
      33    $2 == f || $2 == "*" f { print $1; exit }
    
      34  ' "${_sumfile}")"
    
      35
    
      36  if [[ ! ${expected} =~ ^[[:xdigit:]]{64}$ ]]; then
    
      37    printf 'ERROR: Could not find a valid SHA-256 for %s in %s\n' \
    
      38      "${_appimage}" "${_sumfile}" >&2
    
      39    return 1
    
      40  fi
    
      41
    
      42  printf '%s  %s\n' "${expected}" "${_appimage}" | sha256sum -c -
    
      43
    
      44  chmod +x "${_appimage}"
    
      45  rm -rf squashfs-root
    
      46  "./${_appimage}" --appimage-extract >/dev/null
    
      47}
    
      48
    
      49package() {
    
      50  install -Dm755 "${_appimage}" \
    
      51    "${pkgdir}/opt/${pkgname}/Lightning.AppImage"
    
      52
    
      53  install -dm755 "${pkgdir}/usr/bin"
    
      54  ln -s "/opt/${pkgname}/Lightning.AppImage" \
    
      55    "${pkgdir}/usr/bin/lightning"
    
      56  ln -s "/opt/${pkgname}/Lightning.AppImage" \
    
      57    "${pkgdir}/usr/bin/lightning-matrix"
    
      58
    
      59  # Use the upstream desktop metadata, but point Exec at the AUR wrapper name
    
      60  # rather than the generic internal binary name `matrix-client`.
    
      61  install -Dm644 /dev/stdin \
    
      62    "${pkgdir}/usr/share/applications/lightning.desktop" <<'DESKTOP'
    
      63[Desktop Entry]
    
      64Type=Application
    
      65Name=Lightning
    
      66GenericName=Matrix Client
    
      67Comment=Native Qt Matrix chat client
    
      68Exec=lightning --backend=rust
    
      69Icon=lightning
    
      70Terminal=false
    
      71Categories=Network;Chat;InstantMessaging;
    
      72Keywords=Matrix;Chat;Messaging;
    
      73StartupNotify=true
    
      74StartupWMClass=matrix-client
    
      75DESKTOP
    
      76
    
      77  # AppImages normally expose their application icon at the root. Fall back to
    
      78  # an icon shipped under usr/share if the release layout changes.
    
      79  local icon=''
    
      80  for candidate in \
    
      81    squashfs-root/lightning.svg \
    
      82    squashfs-root/lightning.png \
    
      83    squashfs-root/usr/share/icons/hicolor/scalable/apps/lightning.svg \
    
      84    squashfs-root/usr/share/pixmaps/lightning.png; do
    
      85    if [[ -f ${candidate} ]]; then
    
      86      icon=${candidate}
    
      87      break
    
      88    fi
    
      89  done
    
      90
    
      91  if [[ -z ${icon} ]]; then
    
      92    icon="$(find squashfs-root -type f \
    
      93      \( -iname 'lightning.svg' -o -iname 'lightning.png' \) \
    
      94      -print -quit)"
    
      95  fi
    
      96
    
      97  if [[ -n ${icon} ]]; then
    
      98    case ${icon##*.} in
    
      99      svg)
    
      100        install -Dm644 "${icon}" \
    
      101          "${pkgdir}/usr/share/icons/hicolor/scalable/apps/lightning.svg"
    
      102        ;;
    
      103      png)
    
      104        install -Dm644 "${icon}" \
    
      105          "${pkgdir}/usr/share/pixmaps/lightning.png"
    
      106        ;;
    
      107    esac
    
      108  else
    
      109    printf 'WARNING: upstream AppImage contains no Lightning icon\n' >&2
    
      110  fi
    
      111}
    
      112

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-24 17:24:12	Medium	2