markitdown-gui-appimage

maintainer Cleboost · 1 votes · scanned 2026-08-18 00:03:42.021799

MEDIUM

Why flagged The package installs an AppImage from a GitHub release, which is an unverifiable prebuilt binary from a potentially swappable host, posing a supply-chain risk if the source were compromised.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

MEDIUM AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 85%): The package installs an AppImage from a GitHub release, which is an unverifiable prebuilt binary from a potentially swappable host, posing a supply-chain risk if the source were compromised.

PKGBUILD

      1# Maintainer: Cleboost <clement.balarot@gmail.com>
    
      2# Contributor: missing-aur project <https://github.com/Cleboost/missing-aur>
    
      3
    
      4pkgname=markitdown-gui-appimage
    
      5pkgver=1.4.0
    
      6pkgrel=1
    
      7pkgdesc="Desktop GUI for MarkItDown with queue-based multi-file conversion to Markdown (AppImage)"
    
      8url="https://github.com/imadreamerboy/markitdown-gui"
    
      9arch=("x86_64")
    
      10depends=("fuse2")
    
      11options=("!strip")
    
      12license=("MIT")
    
      13
    
      14source=("markitdown-gui-appimage-${pkgver}.AppImage::${url}/releases/download/v.${pkgver}/MarkItDown-Linux-${pkgver}.AppImage" "markitdown-gui.png::https://raw.githubusercontent.com/imadreamerboy/markitdown-gui/main/markitdowngui/resources/markitdown-gui.png" "markitdown-gui.desktop::https://raw.githubusercontent.com/Cleboost/missing-aur/main/packages/markitdown-gui/markitdown-gui.desktop")
    
      15sha256sums=('8b3bc41fba83cfae871d36188f8472941af6dee656ade5d91d2630379515d592'
    
      16            '96a468a765aeffc2e65d43aabbd5edd52bbe053c70ec89b3f47bcf70eba843a2'
    
      17            'f72153d735a2f38258edbadcc55a02f818ecd63dd2c6a2f0d04383ecb9813144')
    
      18
    
      19prepare() {
    
      20  chmod +x "${srcdir}/markitdown-gui-appimage-${pkgver}.AppImage"
    
      21}
    
      22
    
      23package() {
    
      24  install -Dm755 "${srcdir}/markitdown-gui-appimage-${pkgver}.AppImage" "${pkgdir}/opt/markitdown-gui-appimage/markitdown-gui.AppImage"
    
      25  install -dm755 "${pkgdir}/usr/bin"
    
      26  ln -sf "/opt/markitdown-gui-appimage/markitdown-gui.AppImage" "${pkgdir}/usr/bin/markitdown-gui"
    
      27  install -Dm644 "${srcdir}/markitdown-gui.png" "${pkgdir}/usr/share/icons/hicolor/256x256/apps/markitdown-gui.png"
    
      28  install -Dm644 "${srcdir}/markitdown-gui.desktop" "${pkgdir}/usr/share/applications/markitdown-gui.desktop"
    
      29}
    
      30
    
      31

Changes since previous scan

--- PKGBUILD @ 2026-08-13 00:17
+++ PKGBUILD @ 2026-08-18 00:03
@@ -2,7 +2,7 @@
 # Contributor: missing-aur project <https://github.com/Cleboost/missing-aur>
 
 pkgname=markitdown-gui-appimage
-pkgver=1.3.2
+pkgver=1.4.0
 pkgrel=1
 pkgdesc="Desktop GUI for MarkItDown with queue-based multi-file conversion to Markdown (AppImage)"
 url="https://github.com/imadreamerboy/markitdown-gui"
@@ -12,7 +12,7 @@
 license=("MIT")
 
 source=("markitdown-gui-appimage-${pkgver}.AppImage::${url}/releases/download/v.${pkgver}/MarkItDown-Linux-${pkgver}.AppImage" "markitdown-gui.png::https://raw.githubusercontent.com/imadreamerboy/markitdown-gui/main/markitdowngui/resources/markitdown-gui.png" "markitdown-gui.desktop::https://raw.githubusercontent.com/Cleboost/missing-aur/main/packages/markitdown-gui/markitdown-gui.desktop")
-sha256sums=('e1f0a3cb8b6037927591948f0c7c1082a887be37bcd05150a2c16420672f9ed1'
+sha256sums=('8b3bc41fba83cfae871d36188f8472941af6dee656ade5d91d2630379515d592'
             '96a468a765aeffc2e65d43aabbd5edd52bbe053c70ec89b3f47bcf70eba843a2'
             'f72153d735a2f38258edbadcc55a02f818ecd63dd2c6a2f0d04383ecb9813144')
 

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	MEDIUM	2
2026-08-17 00:18:29	MEDIUM	2
2026-08-16 00:03:42	MEDIUM	2
2026-08-15 00:26:13	MEDIUM	2
2026-08-14 00:03:41	MEDIUM	2
2026-08-13 01:25:20	MEDIUM	2
2026-08-13 00:17:07	MEDIUM	2
2026-08-12 13:23:33	MEDIUM	2