open-interpreter-desktop-bin

maintainer ofluffydev · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads a prebuilt AppImage binary from openinterpreter.com with sha256sums=('SKIP'), meaning no integrity verification is performed. The binary is then installed and executed directly. While openinterpreter.com is the official upstream vendor site, the combination of a moving 'latest' URL (no versioned/pinned download) and a skipped checksum means there is no way to verify what binary is actually being installed at any given time. If the upstream host is compromised or the URL is redirected, an arbitrary executable would be installed and run on the user's system. This is a genuine supply-chain concern: an executed binary from an unverifiable source with no checksum. The official-looking domain reduces but does not eliminate the risk — the lack of any integrity check is the core issue. This is a textbook medium-severity supply-chain risk.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:20 source=("Interpreter.AppImage::https://openinterpreter.com/download/linux/appimage")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 85%): This PKGBUILD downloads a prebuilt AppImage binary from openinterpreter.com with sha256sums=('SKIP'), meaning no integrity verification is performed. The binary is then installed and executed directly. While openinterpreter.com is the official upstream vendor site, the combination of a moving 'latest' URL (no versioned/pinned download) and a skipped checksum means there is no way to verify what binary is actually being installed at any given time. If the upstream host is compromised or the URL is redirected, an arbitrary executable would be installed and run on the user's system. This is a genuine supply-chain concern: an executed binary from an unverifiable source with no checksum. The official-looking domain reduces but does not eliminate the risk — the lack of any integrity check is the core issue. This is a textbook medium-severity supply-chain risk.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Kaden Frisk <fufferpish@gmail.com>
    
      2#
    
      3# NOTE: Upstream only provides a moving "latest" AppImage URL and no stable versioned downloads.
    
      4# This package therefore tracks "latest" and may require rebuilds to pull updates.
    
      5# To update: rebuild the package (e.g. makepkg -Csf).
    
      6
    
      7pkgname=open-interpreter-desktop-bin
    
      8pkgver=latest
    
      9pkgrel=1
    
      10pkgdesc="Open Interpreter Desktop Agent (AppImage, upstream is 'latest' only)"
    
      11arch=('x86_64')
    
      12url="https://openinterpreter.com/"
    
      13license=('custom')
    
      14depends=('fuse2')
    
      15provides=('interpreter-desktop')
    
      16conflicts=('interpreter-desktop')
    
      17options=(!strip !debug)
    
      18
    
      19# Moving target ("latest") — checksum cannot be pinned reliably.
    
      20source=("Interpreter.AppImage::https://openinterpreter.com/download/linux/appimage")
    
      21sha256sums=('SKIP')
    
      22
    
      23install="${pkgname}.install"
    
      24
    
      25package() {
    
      26  # AppImage
    
      27  install -Dm755 "${srcdir}/Interpreter.AppImage" \
    
      28    "${pkgdir}/opt/interpreter-desktop/Interpreter.AppImage"
    
      29
    
      30  # Convenience wrapper
    
      31  install -Dm755 /dev/stdin "${pkgdir}/usr/bin/interpreter-desktop" <<'EOF'
    
      32#!/bin/sh
    
      33exec /opt/interpreter-desktop/Interpreter.AppImage "$@"
    
      34EOF
    
      35
    
      36  # Desktop entry (no custom icon installed)
    
      37  install -Dm644 /dev/stdin "${pkgdir}/usr/share/applications/interpreter-desktop.desktop" <<'EOF'
    
      38[Desktop Entry]
    
      39Type=Application
    
      40Name=Interpreter: The Desktop Agent
    
      41Comment=Open Interpreter Desktop Agent
    
      42Exec=/opt/interpreter-desktop/Interpreter.AppImage
    
      43Terminal=false
    
      44Categories=Development;Utility;
    
      45Icon=utilities-terminal
    
      46StartupNotify=true
    
      47EOF
    
      48}

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2