localmail

MEDIUM

maintainer varsuite 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The PKGBUILD downloads and executes a prebuilt proprietary AppImage binary from download.localmail.dev, which is the project's own release host but is not a well-known, widely-audited distribution channel. The AppImage is extracted and its contents installed system-wide under /opt/localmail. There is a sha256sum check, which mitigates substitution attacks at the network level, but the binary itself is closed-source and unauditable. The domain is the official project domain (matching the url= field), so this is not a random personal host, but it remains a single point of trust for an executed binary. This is a standard pattern for proprietary AppImage packaging in the AUR and represents the normal medium-level supply-chain concern inherent to any prebuilt binary from a small vendor — not an active attack or piracy concern.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:10 source=("https://download.localmail.dev/releases/${pkgver}/LocalMail.AppImage")

Medium AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads and executes a prebuilt proprietary AppImage binary from download.localmail.dev, which is the project's own release host but is not a well-known, widely-audited distribution channel. The AppImage is extracted and its contents installed system-wide under /opt/localmail. There is a sha256sum check, which mitigates substitution attacks at the network level, but the binary itself is closed-source and unauditable. The domain is the official project domain (matching the url= field), so this is not a random personal host, but it remains a single point of trust for an executed binary. This is a standard pattern for proprietary AppImage packaging in the AUR and represents the normal medium-level supply-chain concern inherent to any prebuilt binary from a small vendor — not an active attack or piracy concern.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Jamie Woodruff <jamie@varsuite.co.uk>
    
      2pkgname=localmail
    
      3pkgver=1.1.7
    
      4pkgrel=1
    
      5pkgdesc="Local email testing for developers"
    
      6arch=('x86_64')
    
      7url="https://localmail.dev"
    
      8license=('custom:proprietary')
    
      9depends=('fuse2' 'hicolor-icon-theme')
    
      10source=("https://download.localmail.dev/releases/${pkgver}/LocalMail.AppImage")
    
      11sha256sums=('f9c164e71957f7fbbae55dc711c0602db59b84238f42abde50c0ef631d94a92d')
    
      12
    
      13prepare() {
    
      14  chmod +x "${srcdir}/LocalMail.AppImage"
    
      15  "${srcdir}/LocalMail.AppImage" --appimage-extract
    
      16}
    
      17
    
      18package() {
    
      19  install -d "${pkgdir}/opt/localmail"
    
      20  cp -r "${srcdir}/squashfs-root/"* "${pkgdir}/opt/localmail/"
    
      21
    
      22  install -d "${pkgdir}/usr/bin"
    
      23  ln -s /opt/localmail/localmail "${pkgdir}/usr/bin/localmail"
    
      24
    
      25  install -Dm644 /dev/stdin "${pkgdir}/usr/share/applications/localmail.desktop" << DESKTOP_EOF
    
      26[Desktop Entry]
    
      27Name=LocalMail
    
      28Comment=Local email testing for developers
    
      29Exec=/opt/localmail/localmail %U
    
      30Icon=localmail
    
      31Type=Application
    
      32Categories=Development;
    
      33StartupWMClass=LocalMail
    
      34DESKTOP_EOF
    
      35
    
      36  if [ -f "${srcdir}/squashfs-root/usr/share/icons/hicolor/512x512/apps/localmail.png" ]; then
    
      37    install -Dm644 "${srcdir}/squashfs-root/usr/share/icons/hicolor/512x512/apps/localmail.png"       "${pkgdir}/usr/share/icons/hicolor/512x512/apps/localmail.png"
    
      38  fi
    
      39
    
      40  # Fallback: use root icon from AppImage
    
      41  if [ ! -f "${pkgdir}/usr/share/icons/hicolor/512x512/apps/localmail.png" ]; then
    
      42    for fallback in "${srcdir}/squashfs-root/localmail.png" "${srcdir}/squashfs-root/.DirIcon"; do
    
      43      if [ -f "$fallback" ]; then
    
      44        install -Dm644 "$fallback" "${pkgdir}/usr/share/icons/hicolor/512x512/apps/localmail.png"
    
      45        break
    
      46      fi
    
      47    done
    
      48  fi
    
      49}
    
      50

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2
2026-08-29 00:29:17	Medium	2