localmail

maintainer varsuite · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads and executes a prebuilt proprietary AppImage binary from download.localmail.dev, which is the project's own release host but is not a well-known, widely-audited distribution channel. The AppImage is extracted and its contents installed system-wide under /opt/localmail. There is a sha256sum check, which mitigates substitution attacks at the network level, but the binary itself is closed-source and unauditable. The domain is the official project domain (matching the url= field), so this is not a random personal host, but it remains a single point of trust for an executed binary. This is a standard pattern for proprietary AppImage packaging in the AUR and represents the normal medium-level supply-chain concern inherent to any prebuilt binary from a small vendor — not an active attack or piracy concern.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:10 source=("https://download.localmail.dev/releases/${pkgver}/LocalMail.AppImage")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads and executes a prebuilt proprietary AppImage binary from download.localmail.dev, which is the project's own release host but is not a well-known, widely-audited distribution channel. The AppImage is extracted and its contents installed system-wide under /opt/localmail. There is a sha256sum check, which mitigates substitution attacks at the network level, but the binary itself is closed-source and unauditable. The domain is the official project domain (matching the url= field), so this is not a random personal host, but it remains a single point of trust for an executed binary. This is a standard pattern for proprietary AppImage packaging in the AUR and represents the normal medium-level supply-chain concern inherent to any prebuilt binary from a small vendor — not an active attack or piracy concern.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Jamie Woodruff <jamie@varsuite.co.uk>
    
      2pkgname=localmail
    
      3pkgver=1.1.7
    
      4pkgrel=1
    
      5pkgdesc="Local email testing for developers"
    
      6arch=('x86_64')
    
      7url="https://localmail.dev"
    
      8license=('custom:proprietary')
    
      9depends=('fuse2' 'hicolor-icon-theme')
    
      10source=("https://download.localmail.dev/releases/${pkgver}/LocalMail.AppImage")
    
      11sha256sums=('f9c164e71957f7fbbae55dc711c0602db59b84238f42abde50c0ef631d94a92d')
    
      12
    
      13prepare() {
    
      14  chmod +x "${srcdir}/LocalMail.AppImage"
    
      15  "${srcdir}/LocalMail.AppImage" --appimage-extract
    
      16}
    
      17
    
      18package() {
    
      19  install -d "${pkgdir}/opt/localmail"
    
      20  cp -r "${srcdir}/squashfs-root/"* "${pkgdir}/opt/localmail/"
    
      21
    
      22  install -d "${pkgdir}/usr/bin"
    
      23  ln -s /opt/localmail/localmail "${pkgdir}/usr/bin/localmail"
    
      24
    
      25  install -Dm644 /dev/stdin "${pkgdir}/usr/share/applications/localmail.desktop" << DESKTOP_EOF
    
      26[Desktop Entry]
    
      27Name=LocalMail
    
      28Comment=Local email testing for developers
    
      29Exec=/opt/localmail/localmail %U
    
      30Icon=localmail
    
      31Type=Application
    
      32Categories=Development;
    
      33StartupWMClass=LocalMail
    
      34DESKTOP_EOF
    
      35
    
      36  if [ -f "${srcdir}/squashfs-root/usr/share/icons/hicolor/512x512/apps/localmail.png" ]; then
    
      37    install -Dm644 "${srcdir}/squashfs-root/usr/share/icons/hicolor/512x512/apps/localmail.png"       "${pkgdir}/usr/share/icons/hicolor/512x512/apps/localmail.png"
    
      38  fi
    
      39
    
      40  # Fallback: use root icon from AppImage
    
      41  if [ ! -f "${pkgdir}/usr/share/icons/hicolor/512x512/apps/localmail.png" ]; then
    
      42    for fallback in "${srcdir}/squashfs-root/localmail.png" "${srcdir}/squashfs-root/.DirIcon"; do
    
      43      if [ -f "$fallback" ]; then
    
      44        install -Dm644 "$fallback" "${pkgdir}/usr/share/icons/hicolor/512x512/apps/localmail.png"
    
      45        break
    
      46      fi
    
      47    done
    
      48  fi
    
      49}
    
      50

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2