linphone-desktop-appimage-stable

maintainer thomasandres · 4 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt x86_64 AppImage binary from download.linphone.org, which is the official Linphone project download server (Belledonne Communications, the upstream vendor). This is not a personal or unofficial host. However, the sha256sum is set to 'SKIP', meaning there is no integrity verification of the downloaded binary. The AppImage is then made executable and extracted (--appimage-extract) during prepare(), and the binary is installed to /opt/appimages and executed via a wrapper script. The combination of an executed binary with no checksum verification is a genuine supply-chain concern: if the download is intercepted (MITM) or the host is compromised, arbitrary code would execute on the user's system with no integrity check. While the host is the official vendor server, the missing checksum elevates this above 'clean' or 'low'. This is a real medium-severity concern, not a false positive.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source=("https://download.linphone.org/releases/linux/app/Linphone-${pkgver}-x86_64.AppImage"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt x86_64 AppImage binary from download.linphone.org, which is the official Linphone project download server (Belledonne Communications, the upstream vendor). This is not a personal or unofficial host. However, the sha256sum is set to 'SKIP', meaning there is no integrity verification of the downloaded binary. The AppImage is then made executable and extracted (--appimage-extract) during prepare(), and the binary is installed to /opt/appimages and executed via a wrapper script. The combination of an executed binary with no checksum verification is a genuine supply-chain concern: if the download is intercepted (MITM) or the host is compromised, arbitrary code would execute on the user's system with no integrity check. While the host is the official vendor server, the missing checksum elevates this above 'clean' or 'low'. This is a real medium-severity concern, not a false positive.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer:  Thomas Andres <thomas at andres dot in>
    
      2# Contributor: lynix <lynix47@gmail.com>
    
      3
    
      4pkgname=linphone-desktop-appimage-stable
    
      5pkgver=6.1.2
    
      6pkgrel=1
    
      7pkgdesc="A free VoIP and video softphone based on the SIP protocol (AppImage version. Stable release)"
    
      8arch=('x86_64')
    
      9url='https://www.linphone.org'
    
      10license=('GPL2')
    
      11depends=('fuse2')
    
      12provides=('linphone-desktop=${pkgver}' 'linphone=${pkgver}')
    
      13conflicts=('linphone-desktop-appimage' 'linphone-desktop-all' 'linphone-desktop-git' 'linphone-desktop-all-git' 'linphone-git')
    
      14source=("https://download.linphone.org/releases/linux/app/Linphone-${pkgver}-x86_64.AppImage"
    
      15        'linphone.sh')
    
      16sha256sums=('SKIP'
    
      17         '1238a372faa4d6de8569b508c95ac39b7d21d3619660740b3ac4306642076bd2')
    
      18options=(!strip)
    
      19_image="$(basename "${source[0]}")"
    
      20
    
      21prepare() {
    
      22  cd "${srcdir}"
    
      23  chmod +x "${_image}"
    
      24  ./"${_image}" --appimage-extract
    
      25}
    
      26
    
      27package() {
    
      28  install -Dm755 "${srcdir}/${_image}" "${pkgdir}/opt/appimages/linphone.AppImage"
    
      29  install -Dm755 "${srcdir}/linphone.sh" "${pkgdir}/usr/bin/linphone"
    
      30  install -dm755 "${pkgdir}/usr/share/"
    
      31  cp -r --no-preserve=mode,ownership "${srcdir}/squashfs-root/usr/share/icons" "${pkgdir}/usr/share/"
    
      32  install -Dm644 "${srcdir}/squashfs-root/linphone.desktop" "${pkgdir}/usr/share/applications/linphone.desktop"
    
      33}
    
      34
    
      35# vim:set ts=2 sw=2 et:
    
      36

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2