open-pha

maintainer Junder · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt AppImage binary from a CloudFront CDN URL (d22j4f41zcdpc.cloudfront.net), which appears to be Kenexis's own distribution infrastructure for their Open PHA software. CloudFront is commonly used by vendors to distribute software, and the URL pattern is consistent with a vendor-controlled S3/CloudFront bucket. A sha256sum is provided, which mitigates silent replacement risk at the point of download. However, the binary is a closed-source commercial AppImage executed directly on the user's system with no way to verify it matches any published source. The host is not an official, well-known software distribution platform (like GitHub releases), and the bucket ID is opaque. This is a real supply-chain concern: if the CloudFront distribution is compromised or the bucket is misconfigured, a malicious AppImage could be served. This is a textbook medium-risk pattern — an executed binary from a non-standard/unofficial host — not clearly malicious but not clean either.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source_x86_64=("${_appimage}::https://d22j4f41zcdpc.cloudfront.net/Open+PHA-${pkgver}.AppImage")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt AppImage binary from a CloudFront CDN URL (d22j4f41zcdpc.cloudfront.net), which appears to be Kenexis's own distribution infrastructure for their Open PHA software. CloudFront is commonly used by vendors to distribute software, and the URL pattern is consistent with a vendor-controlled S3/CloudFront bucket. A sha256sum is provided, which mitigates silent replacement risk at the point of download. However, the binary is a closed-source commercial AppImage executed directly on the user's system with no way to verify it matches any published source. The host is not an official, well-known software distribution platform (like GitHub releases), and the bucket ID is opaque. This is a real supply-chain concern: if the CloudFront distribution is compromised or the bucket is misconfigured, a malicious AppImage could be served. This is a textbook medium-risk pattern — an executed binary from a non-standard/unofficial host — not clearly malicious but not clean either.

PKGBUILD

1 offending line(s) highlighted

      1# Based on the template from https://daveparrish.net/posts/2019-11-16-Better-AppImage-PKGBUILD-template.html
    
      2
    
      3
    
      4_pkgname=open-pha
    
      5
    
      6pkgname="${_pkgname}"
    
      7pkgver=2.2.18
    
      8pkgrel=1
    
      9pkgdesc="A comprehensive PHA, HAZOP and LOPA software solution from Kenexis"
    
      10arch=('x86_64')
    
      11url="https://www.kenexis.com/software/openpha/"
    
      12license=('custom:Commercial')
    
      13depends=('zlib' 'fuse2')
    
      14options=('!strip' '!debug')
    
      15_appimage="${pkgname}-${pkgver}.AppImage"
    
      16source_x86_64=("${_appimage}::https://d22j4f41zcdpc.cloudfront.net/Open+PHA-${pkgver}.AppImage")
    
      17noextract=("${_appimage}")
    
      18sha256sums_x86_64=('2ae2bd7696785e04527cf674145f45999a1586c3b493885bc42d3f9943846d5e')
    
      19
    
      20
    
      21prepare() {
    
      22    chmod +x "${_appimage}"
    
      23    ./"${_appimage}" --appimage-extract
    
      24}
    
      25
    
      26build() {
    
      27    # Adjust .desktop so it will work outside of AppImage container
    
      28    sed -i -E "s|Exec=AppRun|Exec=env DESKTOPINTEGRATION=false /usr/bin/${_pkgname} %u|"\
    
      29        "squashfs-root/${_pkgname}.desktop"
    
      30    # Fix permissions; .AppImage permissions are 700 for all directories
    
      31    chmod -R a-x+rX squashfs-root/usr
    
      32}
    
      33
    
      34package() {
    
      35    # AppImage
    
      36    install -Dm755 "${srcdir}/${_appimage}" "${pkgdir}/opt/${pkgname}/${pkgname}.AppImage"
    
      37
    
      38    # Desktop file
    
      39    install -Dm644 "${srcdir}/squashfs-root/${_pkgname}.desktop"\
    
      40            "${pkgdir}/usr/share/applications/${_pkgname}.desktop"
    
      41
    
      42    # Icon 
    
      43    install -dm755 "${pkgdir}/usr/share/"
    
      44    cp -a "${srcdir}/squashfs-root/usr/share/icons" "${pkgdir}/usr/share/"
    
      45    mkdir -p "${pkgdir}/usr/share/pixmaps/"
    
      46    install -Dm644 "${srcdir}/squashfs-root/usr/share/icons/hicolor/128x128/apps/open-pha.png" "${pkgdir}/usr/share/pixmaps"
    
      47
    
      48    # Symlink executable
    
      49    install -dm755 "${pkgdir}/usr/bin"
    
      50    ln -s "/opt/${pkgname}/${pkgname}.AppImage" "${pkgdir}/usr/bin/${_pkgname}"
    
      51}
    
      52

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2