maxx-desktop

LOW

maintainer Nebulosa 1 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The source is a prebuilt binary tarball downloaded from an AWS S3 bucket under the vendor's own CDN domain (cdn.maxxinteractive.com), which is the official distribution channel for MaXX Interactive Desktop. This is not a personal or unofficial host — it is the vendor's own CDN. Checksums are present (sha512sums and b2sums are both populated with real hashes, not SKIP), so integrity is verified. The package installs a proprietary prebuilt binary desktop environment, which is a legitimate if unusual pattern for AUR packages. The main concern is that it installs a large prebuilt binary blob from a vendor S3 bucket, but with checksums in place and the host being the official vendor CDN, this is standard practice for proprietary software distributed via AUR. The risk is low: if the vendor's S3 bucket were compromised the checksums would catch substitution. Rating as low rather than clean only because it is a large prebuilt binary blob with no source build, which is inherently less auditable than a source build.

Triggered rules

Low AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-4.6-sonnet-20260217) reviewed the full PKGBUILD and judged it LOW (confidence 82%): The source is a prebuilt binary tarball downloaded from an AWS S3 bucket under the vendor's own CDN domain (cdn.maxxinteractive.com), which is the official distribution channel for MaXX Interactive Desktop. This is not a personal or unofficial host — it is the vendor's own CDN. Checksums are present (sha512sums and b2sums are both populated with real hashes, not SKIP), so integrity is verified. The package installs a proprietary prebuilt binary desktop environment, which is a legitimate if unusual pattern for AUR packages. The main concern is that it installs a large prebuilt binary blob from a vendor S3 bucket, but with checksums in place and the host being the official vendor CDN, this is standard practice for proprietary software distributed via AUR. The risk is low: if the vendor's S3 bucket were compromised the checksums would catch substitution. Rating as low rather than clean only because it is a large prebuilt binary blob with no source build, which is inherently less auditable than a source build.

1 higher static finding superseded - not the current verdict (shown for transparency)

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:94 source=("$pkgname-$pkgver.gz::https://s3.ca-central-1.amazonaws.com/cdn.maxxinteractive.com/$pkgname-installer/$_name-Desktop-v$pkgver-LINUX-${arch[0]}-tar.gz")

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Vaporeon <vaporeon@vaporeon.io>
    
      2# Co-maintainer: Nebulosa <nebulosa2007 at yandex dot ru>
    
      3
    
      4pkgname=maxx-desktop
    
      5_name="MaXX"
    
      6pkgver=2.2.0
    
      7pkgrel=8
    
      8pkgdesc="MaXX Interactive Desktop"
    
      9arch=(x86_64)
    
      10url="https://docs.maxxinteractive.com/"
    
      11license=(LicenseRef-MaXX-license)
    
      12depends=(
    
alsa-utils
    
at-spi2-core
    
cairo
    
curl
    
fontconfig
    
freeglut
    
freetype2
    
gcc                      # ?? needed in MaXX/bin64/desktopenv:293
    
gcc-libs
    
gdk-pixbuf2
    
# giflib4                # obsolete building issue
    
glib2
    
glibc
    
glu
    
glew
    
gtk2
    
gtk3
    
imlib2
    
# java-runtime            # needed for MaXX/java/*.jar, skipping for now for shrink dependencies size
    
libglvnd
    
libjpeg6-turbo
    
libice
    
libid3tag
    
libnotify
    
libpng
    
libpng15
    
libtiff5
    
libsm
    
libwebp
    
libx11
    
libxau
    
libxaw
    
libxcb
    
libxcomposite
    
libxcrypt-compat
    
libxdamage
    
libxext
    
libxfixes
    
libxft
    
libxi
    
libxinerama
    
libxkbfile
    
libxml2-legacy
    
libxmu
    
libxp
    
libxpm
    
libxrandr
    
libxrender
    
libxss
    
libxt
    
libxxf86vm
    
libwebp
    
ncurses5-compat-libs
    
noto-fonts
    
noto-fonts-extra
    
openmotif
    
pango
    
pcre
    
perl
    
sh
    
ttf-dejavu
    
wayland                   # ?? for dunst
    
xorg-server
    
xorg-xinit
    
xorg-xrdb
    
xorg-xsetroot
    
xz
    
zlib
    
      81)
    
      82optdepends=(
    
'blender: Open-source 3D computer graphics'
    
'firefox: Web browser'
    
'gimp: Image editor'
    
'inkscape: Vector image editor'
    
'libreoffice-fresh: Office suite'
    
'lightdm: Login manager'
    
'pavucontrol: Sound audio mixer'
    
'vlc: Multi-media'
    
'xpdf: PDF viewer'
    
      92)
    
      93options=(!debug)
    
      94source=("$pkgname-$pkgver.gz::https://s3.ca-central-1.amazonaws.com/cdn.maxxinteractive.com/$pkgname-installer/$_name-Desktop-v$pkgver-LINUX-${arch[0]}-tar.gz")
    
      95noextract=("$pkgname-$pkgver.gz")
    
      96sha512sums=('4c869dd59ce33f9786e3a35bc11833a2e8f67705d9d235e0875ae5bbdbbafb02c9736bc7d0419112c0ad95b76de944044269607e78d7f08390ff778f6cb513d9')
    
      97b2sums=('6db87f67b9eb960967ca5eb93e13ebe6c532d7d7a5f7f06344bed04909d0856b62faa422501b8738b9ba23f0526cc13d7a9a16140fc1455bff3708f62c1d71c2')
    
      98
    
      99package() {
    
install -vd "$pkgdir"/opt
    
tar zxf "$pkgname-$pkgver.gz" \
    
  --no-same-owner \
    
  --exclude="java" \
    
  --exclude="include/Vue/Grafix/Platform/Vulkan" \
    
  --exclude="share/icons/hicolor" \
    
  --exclude="share/man" \
    
  --exclude="share/misc/HOME/rox.sourceforge.net/SendTo" \
    
  --exclude="share/misc/HOME/rox.sourceforge.net/Templates" \
    
  --exclude="share/msettings/FileTypes" \
    
  --exclude=".directory" \
    
  --exclude=".ms.swp" \
    
  --exclude=".dumpster" \
    
  -C "$pkgdir"/opt # Except conflict files from other packages and other rubbish files
    
      114
    
# Fix non UTF-8 name
    
mv "$pkgdir"/opt/$_name/share/wallpapers/Octane-Wallpapers/pexels-c{á,a}tia-matos-1072179.jpg
    
      117
    
# Fix permissions
    
chmod go+r "$pkgdir"/opt/$_name/share/misc/HOME/rox.sourceforge.net/MIME-types/{application_x-,}executable
    
find "$pkgdir"/opt/$_name/share/inventor/data/models/ -type d -exec chmod go+x {} \;
    
      121
    
install -vDm 644 "$pkgdir"/opt/$_name/doc/LICENSE -t "$pkgdir"/usr/share/licenses/$pkgname/
    
      123
    
install -vd "$pkgdir"/usr/share/icons
    
cd "$pkgdir"/opt/$_name/share/icons
    
for _iconfolder in Irix XCursor-Pro-Red redSGI sgi; do
    
  ln -s "/opt/$_name/share/icons/$_iconfolder" "$pkgdir/usr/share/icons/$_iconfolder"
    
done
    
      129
    
install -vDm 644 "$pkgdir"/{opt/$_name,usr}/share/xsessions/${pkgname//-/.}
    
      131}
    
      132

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Low	2
2026-09-16 00:03:17	Low	2
2026-09-15 00:25:31	Low	2
2026-09-14 00:27:57	Low	2
2026-09-13 00:19:54	Low	2
2026-09-12 00:25:17	Low	2
2026-09-11 00:19:22	Low	2
2026-09-10 00:22:44	Low	2
2026-09-09 00:04:09	Low	2
2026-09-08 00:18:08	Low	2
2026-09-07 00:30:15	Low	2
2026-09-06 00:17:06	Low	2
2026-09-05 00:16:27	Low	2
2026-09-04 00:03:13	Low	2
2026-09-03 00:15:47	Low	2
2026-09-02 00:02:31	Low	2
2026-09-01 00:11:19	Low	2
2026-08-31 00:19:57	Low	2
2026-08-30 00:04:14	Low	2
2026-08-29 00:29:17	Low	2