lycheeslicer

MEDIUM

maintainer marsjan155 9 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads a prebuilt AppImage executable from a non-whitelisted, project-owned but non-standard host (DigitalOcean Spaces); if compromised, this could deliver malicious code, constituting a supply-chain risk.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:19 "https://mango-lychee.nyc3.cdn.digitaloceanspaces.com/${_appimage}"

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt AppImage executable from a non-whitelisted, project-owned but non-standard host (DigitalOcean Spaces); if compromised, this could deliver malicious code, constituting a supply-chain risk.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: LycheeSlicer
    
      2# Contributor: LycheeSlicer
    
      3pkgname=lycheeslicer
    
      4pkgver=8.0.3
    
      5pkgrel=1
    
      6pkgdesc="Lychee Slicer"
    
      7arch=('x86_64')
    
      8url="http://mango3d.io"
    
      9license=('custom')
    
      10depends=('alsa-lib' 'at-spi2-core' 'cairo' 'dbus' 'expat' 'gcc-libs' 'glib2' 'glibc' 'libcups'
    
      11	'libx11' 'libxcb' 'libxcomposite' 'libxdamage' 'libxext' 'libxfixes' 'libxkbcommon'
    
      12	'libxrandr' 'mesa' 'nspr' 'nss' 'pango' 'systemd-libs' 'xdg-utils')
    
      13makedepends=('squashfs-tools')
    
      14options=('!strip' '!emptydirs')
    
      15install=${pkgname}.install
    
      16_appimage="LycheeSlicer-${pkgver}-x86_64.GLIB-235.AppImage"
    
      17noextract=("${_appimage}")
    
      18source_x86_64=(
    
      19	"https://mango-lychee.nyc3.cdn.digitaloceanspaces.com/${_appimage}"
    
      20	"local://lycheeslicer.xml"
    
      21)
    
      22sha512sums_x86_64=(
    
      23	'c656c17a6c387c958b5c059df6f1b8b9448980f877dfefd0be783c293192836339c1b5ccdc51bfa24010cafaaf75c2463b847b042069d6396780b5b09d15a8d6'
    
      24	'aba52d9bd76619f66fac0688c1c04846e630f5b8acba6032c61f46a4bcf9ff9d5aa1eb11a3901e85bce33e179d4ccc1f574b06c9ad3f415a692ff4ad39c77f49'
    
      25)
    
      26
    
      27prepare() {
    
      28	# AppImage runtime can't extract its own payload, so unpack squashfs directly
    
      29	chmod +x "${_appimage}"
    
      30	local offset
    
      31	offset=$("./${_appimage}" --appimage-offset)
    
      32	rm -rf squashfs-root
    
      33	unsquashfs -q -n -o "${offset}" -d squashfs-root "${_appimage}"
    
      34}
    
      35
    
      36package() {
    
      37	install -dm755 "${pkgdir}/opt"
    
      38	cp -a squashfs-root/opt/Lychee "${pkgdir}/opt/LycheeSlicer"
    
      39	# Static libraries are build leftovers, not needed at runtime
    
      40	rm -f "${pkgdir}"/opt/LycheeSlicer/*.a
    
      41
    
      42	# Launcher (symlinked to /usr/bin/lycheeslicer in lycheeslicer.install), mirrors upstream AppRun
    
      43	install -Dm755 /dev/stdin "${pkgdir}/opt/LycheeSlicer/lycheeslicer" <<-'EOF'
    
      44		#!/bin/sh
    
      45		cd /opt/LycheeSlicer || exit 1
    
      46		exec ./LycheeSlicer --no-sandbox "$@"
    
      47	EOF
    
      48
    
      49	install -Dm644 /dev/stdin "${pkgdir}/usr/share/applications/lycheeslicer.desktop" <<-'EOF'
    
      50		[Desktop Entry]
    
      51		Name=Lychee Slicer
    
      52		GenericName=3D Printing Slicer
    
      53		Exec=lycheeslicer %u
    
      54		Icon=lycheeslicer
    
      55		Terminal=false
    
      56		Type=Application
    
      57		Categories=Graphics;3DGraphics;
    
      58		Keywords=3d;slicer;printing;
    
      59		MimeType=x-scheme-handler/lycheeslicer;
    
      60	EOF
    
      61
    
      62	install -Dm644 squashfs-root/usr/share/icons/hicolor/scalable/apps/LycheeSlicer.svg \
    
      63		"${pkgdir}/usr/share/icons/hicolor/scalable/apps/lycheeslicer.svg"
    
      64	install -Dm644 lycheeslicer.xml "${pkgdir}/usr/share/mime/packages/lycheeslicer.xml"
    
      65}
    
      66

Changes since previous scan

--- PKGBUILD @ 2026-10-22 00:13
+++ PKGBUILD @ 2026-11-01 00:21
@@ -1,7 +1,7 @@
 # Maintainer: LycheeSlicer
 # Contributor: LycheeSlicer
 pkgname=lycheeslicer
-pkgver=8.0.0
+pkgver=8.0.3
 pkgrel=1
 pkgdesc="Lychee Slicer"
 arch=('x86_64')
@@ -13,14 +13,14 @@
 makedepends=('squashfs-tools')
 options=('!strip' '!emptydirs')
 install=${pkgname}.install
-_appimage="LycheeSlicer-${pkgver}-x86_64.GLIBC-235.AppImage"
+_appimage="LycheeSlicer-${pkgver}-x86_64.GLIB-235.AppImage"
 noextract=("${_appimage}")
 source_x86_64=(
 	"https://mango-lychee.nyc3.cdn.digitaloceanspaces.com/${_appimage}"
 	"local://lycheeslicer.xml"
 )
 sha512sums_x86_64=(
-	'1392fa403726a51aa2964cc4ba19cb029167552be9019c6fbb4c529aebef0e59305573ad0291fde6d2e3cb1164dfe5a763e51f4b811cb4f44cde9e03178fc369'
+	'c656c17a6c387c958b5c059df6f1b8b9448980f877dfefd0be783c293192836339c1b5ccdc51bfa24010cafaaf75c2463b847b042069d6396780b5b09d15a8d6'
 	'aba52d9bd76619f66fac0688c1c04846e630f5b8acba6032c61f46a4bcf9ff9d5aa1eb11a3901e85bce33e179d4ccc1f574b06c9ad3f415a692ff4ad39c77f49'
 )
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Medium	2
2026-10-31 00:07:41	Medium	2
2026-10-30 00:29:30	Medium	2
2026-10-29 00:13:55	Medium	2
2026-10-28 00:06:54	Medium	2
2026-10-27 00:23:28	Medium	2
2026-10-26 00:12:40	Medium	2
2026-10-25 00:20:48	Medium	2
2026-10-24 00:14:55	Medium	2
2026-10-23 00:02:19	Medium	2
2026-10-22 17:35:31	Medium	2
2026-10-22 00:13:10	Medium	2
2026-10-21 00:12:50	Medium	2
2026-10-20 00:10:31	Medium	2
2026-10-19 00:03:55	Medium	2
2026-10-18 00:06:55	Medium	2
2026-10-17 00:21:55	Medium	2
2026-10-16 00:12:47	Medium	2
2026-10-15 00:28:05	Medium	2
2026-10-14 00:06:47	Medium	2