lunacy-bin

maintainer smowtenshi · 18 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt binary .deb from lcdn.icons8.com, which is Icons8's own CDN (icons8.com is the official vendor of Lunacy). This is not a random personal host — it is the legitimate upstream distribution channel for Lunacy. However, it is still a prebuilt binary from a CDN rather than source code, and CDN hosts can in principle serve different content to different requesters. The sha256sums_x86_64 checksum provides integrity verification, which mitigates substitution risk significantly. The pattern (vendor CDN + pinned hash) is common for proprietary binary AUR packages (e.g., google-chrome, slack-desktop, zoom). The cheaper model's concern about 'non-whitelisted host' is largely a false positive since lcdn.icons8.com is the official Icons8 CDN. That said, it remains a closed-source prebuilt binary executed on the user's system, which is the inherent medium-level supply-chain concern for any proprietary binary package — not because of anything suspicious in the PKGBUILD itself, but because users must trust the vendor's binary. Rating medium is appropriate solely on the basis of it being an executed prebuilt binary from a proprietary vendor CDN, not due to any active malicious indicator.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:19 source_x86_64=(lunacy_x86_64_${pkgver}.deb::https://lcdn.icons8.com/setup/Lunacy_${pkgver}.deb)

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt binary .deb from lcdn.icons8.com, which is Icons8's own CDN (icons8.com is the official vendor of Lunacy). This is not a random personal host — it is the legitimate upstream distribution channel for Lunacy. However, it is still a prebuilt binary from a CDN rather than source code, and CDN hosts can in principle serve different content to different requesters. The sha256sums_x86_64 checksum provides integrity verification, which mitigates substitution risk significantly. The pattern (vendor CDN + pinned hash) is common for proprietary binary AUR packages (e.g., google-chrome, slack-desktop, zoom). The cheaper model's concern about 'non-whitelisted host' is largely a false positive since lcdn.icons8.com is the official Icons8 CDN. That said, it remains a closed-source prebuilt binary executed on the user's system, which is the inherent medium-level supply-chain concern for any proprietary binary package — not because of anything suspicious in the PKGBUILD itself, but because users must trust the vendor's binary. Rating medium is appropriate solely on the basis of it being an executed prebuilt binary from a proprietary vendor CDN, not due to any active malicious indicator.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: smowtenshi <smowtenshi at protonmail dot com>
    
      2# Contributor: Asim Bera <asimbera at outlook dot in>
    
      3
    
      4
    
      5pkgname=lunacy-bin
    
      6_pkgname=lunacy
    
      7pkgver=14.1
    
      8pkgrel=1
    
      9pkgdesc="Free design software that keeps your flow with AI tools and built-in graphics"
    
      10arch=('x86_64')
    
      11url="https://icons8.com/lunacy"
    
      12license=('custom: commercial')
    
      13depends=('gcc-libs' 'hicolor-icon-theme' 'zlib' 'fontconfig')
    
      14provides=('lunacy')
    
      15
    
      16options=(!debug)
    
      17
    
      18source=(lunacy-mimetype.xml)
    
      19source_x86_64=(lunacy_x86_64_${pkgver}.deb::https://lcdn.icons8.com/setup/Lunacy_${pkgver}.deb)
    
      20
    
      21sha256sums=('0c6ff2c10a75e19f3051c22b6002a78033a7508ad4bb5d234e85cdad22b0f4d0')
    
      22sha256sums_x86_64=('ae23a5bdddd9c5d0b0e697b9bf44748ea54ca4e14e8957eac66821f18aa73ddd')
    
      23
    
      24package() {
    
      25  #echo "  -> Extracting the data.tar.xz..."
    
      26  bsdtar -xf data.tar.zst -C "$pkgdir/"
    
      27
    
      28  install -d "${pkgdir}/usr/bin"
    
      29  ln -s /opt/icons8/${_pkgname}/Lunacy "${pkgdir}"/usr/bin/lunacy
    
      30
    
      31  install -m644 lunacy-mimetype.xml  "${pkgdir}/usr/share/mime/packages/${_pkgname}.xml"
    
      32}
    
      33

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2