nperf-gui-appimage

maintainer AlperShal · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt AppImage binary from repo.nperf.com, which appears to be nperf's own distribution infrastructure (nperf is a legitimate network speed test service), but it is not a widely recognized official host like GitHub releases or a major distro mirror. The binary is executed during prepare() via --appimage-extract to unpack assets, and then installed as a setuid-755 executable. Only an MD5 checksum is provided for integrity verification, which is cryptographically weak. The core concern is a closed-source prebuilt binary from a vendor-controlled but non-auditable host with only MD5 verification — a real supply-chain risk if the host is compromised or the binary is silently swapped. However, repo.nperf.com is plausibly the vendor's own release server (analogous to how other vendors host AppImages on their own infrastructure), so this is not clearly malicious. The medium rating is appropriate: executed binary from a non-standard host with weak integrity verification.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source=("https://repo.nperf.com/linux/nperf/nPerf-${pkgver}-${arch}.AppImage")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt AppImage binary from repo.nperf.com, which appears to be nperf's own distribution infrastructure (nperf is a legitimate network speed test service), but it is not a widely recognized official host like GitHub releases or a major distro mirror. The binary is executed during prepare() via --appimage-extract to unpack assets, and then installed as a setuid-755 executable. Only an MD5 checksum is provided for integrity verification, which is cryptographically weak. The core concern is a closed-source prebuilt binary from a vendor-controlled but non-auditable host with only MD5 verification — a real supply-chain risk if the host is compromised or the binary is silently swapped. However, repo.nperf.com is plausibly the vendor's own release server (analogous to how other vendors host AppImages on their own infrastructure), so this is not clearly malicious. The medium rating is appropriate: executed binary from a non-standard host with weak integrity verification.

PKGBUILD

1 offending line(s) highlighted

      1#  Maintainer: Alper Şal <alper@sal.web.tr>
    
      2
    
      3_pkgname=nperf-gui
    
      4pkgname=nperf-gui-appimage
    
      5pkgver=2.15.9
    
      6pkgrel=1
    
      7pkgdesc="Nperf wide-area network speed test application."
    
      8arch=('x86_64')
    
      9#url="https://www.nperf.com/"
    
      10license=('GPL')
    
      11depends=('fuse')
    
      12provides=('nperf-gui')
    
      13_filename="nPerf-${pkgver}-${arch}.AppImage"
    
      14source=("https://repo.nperf.com/linux/nperf/nPerf-${pkgver}-${arch}.AppImage")
    
      15md5sums=('dfa4b6419f2fae2992595701d0735ff5')
    
      16options=(!strip)
    
      17prepare() 
    
      18{
    
      19  cd "${srcdir}"
    
      20  chmod +x ${_filename}
    
      21  eval ./${_filename} --appimage-extract "*/*/*/*/*x*/apps/*.png"
    
      22  eval ./${_filename} --appimage-extract "*/*/applications/*.desktop"
    
      23}
    
      24
    
      25package() 
    
      26{
    
      27  # Install AppImage
    
      28  install -Dm755 "${srcdir}/${_filename}" "${pkgdir}/opt/appimages/${_filename}"
    
      29
    
      30  # Install Exec Script
    
      31  ExecScript="#!/bin/sh\nexec /opt/appimages/${_filename} \"\$@\""
    
      32  install -dm755 "${pkgdir}/usr/bin"
    
      33  echo -e $ExecScript > "${pkgdir}/usr/bin/${_pkgname}"
    
      34  chmod 755 "${pkgdir}/usr/bin/${_pkgname}"
    
      35
    
      36  # Install global Desktop-Integration
    
      37#   _sizes=('256x256' '128x128' '64x64' '48x48' '32x32' '22x22' '16x16')
    
      38#   for _size in ${_sizes[@]}; do
    
      39#   install -Dm644 "${srcdir}/squashfs-root/usr/share/icons/hicolor/${_size}/apps/nPerf.png" "${pkgdir}/usr/share/icons/hicolor/${_size}/apps/nPerf.png"
    
      40#   done
    
      41  install -Dm644 "${srcdir}/squashfs-root/usr/share/applications/com.nperf.tester.desktop" "${pkgdir}/usr/share/applications/com.nperf.tester.desktop"
    
      42}

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2