outline-manager-appimage

maintainer Felixoid · 5 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt AppImage binary from an AWS S3 bucket (s3.amazonaws.com/outline-releases) controlled by Jigsaw-Code (Google), which is the legitimate upstream vendor for Outline Manager. The sha256sum is pinned, providing integrity verification. However, the source is a prebuilt binary AppImage rather than source code, and it is executed during prepare() via --appimage-extract. The S3 bucket is the official release channel referenced in the upstream GitHub repo (Jigsaw-Code/outline-releases), making this more of a 'binary blob from vendor' pattern than a truly unofficial host. The risk is real but typical for AppImage packaging: if the S3 bucket or the sha256 were compromised, arbitrary code would execute. The sha256 pin mitigates substitution attacks. This is a standard medium-risk pattern for prebuilt binary packaging, not a clear attack.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 source=("${_app_image}::https://s3.amazonaws.com/outline-releases/manager/linux/${pkgver}/${_build_version}/Outline-Manager.AppImage")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt AppImage binary from an AWS S3 bucket (s3.amazonaws.com/outline-releases) controlled by Jigsaw-Code (Google), which is the legitimate upstream vendor for Outline Manager. The sha256sum is pinned, providing integrity verification. However, the source is a prebuilt binary AppImage rather than source code, and it is executed during prepare() via --appimage-extract. The S3 bucket is the official release channel referenced in the upstream GitHub repo (Jigsaw-Code/outline-releases), making this more of a 'binary blob from vendor' pattern than a truly unofficial host. The risk is real but typical for AppImage packaging: if the S3 bucket or the sha256 were compromised, arbitrary code would execute. The sha256 pin mitigates substitution attacks. This is a standard medium-risk pattern for prebuilt binary packaging, not a clear attack.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: DuckSoft <realducksoft at gmail dot com>
    
      2_name=outline-manager
    
      3pkgname=${_name}-appimage
    
      4pkgver=1.19.0
    
      5pkgrel=1
    
      6pkgdesc="Creates and manages Outline servers, powered by Shadowsocks."
    
      7arch=('x86_64')
    
      8url="https://github.com/Jigsaw-Code/outline-server"
    
      9license=('Apache')
    
      10makedepends=('git')
    
      11options=(!strip)
    
      12provides=(${_name})
    
      13conficts=(${_name})
    
      14# See https://github.com/Jigsaw-Code/outline-releases/blob/master/manager/latest-linux.yml
    
      15_app_image="Outline-Manager-v${pkgver}.AppImage"
    
      16_build_version=1
    
      17source=("${_app_image}::https://s3.amazonaws.com/outline-releases/manager/linux/${pkgver}/${_build_version}/Outline-Manager.AppImage")
    
      18sha256sums=(46f6e2c5be6e05f286405c9436c1592b2bed9337a4ad8fe59756cc2ac6a19eda)
    
      19
    
      20#######################################
    
      21# To get all available download links #
    
      22#######################################
    
      23# usage: bash -c '. PKGBUILD; get_version_links'
    
      24get_version_links() {
    
      25  docker run -i --entrypoint=python public.ecr.aws/lambda/python:3.12 <<EOF
    
      26from pprint import pprint
    
      27from boto3 import client
    
      28from botocore import UNSIGNED
    
      29from botocore.client import Config
    
      30s3c = client('s3',config=Config(signature_version=UNSIGNED))
    
      31pprint([o['Key'] for o in s3c.list_objects_v2(Bucket='outline-releases', Prefix='manager/linux')['Contents'] if o['Key'].endswith('.AppImage')])
    
      32EOF
    
      33}
    
      34#######################################
    
      35
    
      36prepare() {
    
      37  chmod +x ${_app_image}
    
      38  ./${_app_image} --appimage-extract usr/share/icons/hicolor > /dev/null
    
      39  ./${_app_image} --appimage-extract '@outlineserver_manager.desktop' > /dev/null
    
      40  mv 'squashfs-root/@outlineserver_manager.desktop' "squashfs-root/${_name}.desktop"
    
      41
    
      42  sed -i -E "s|Exec=AppRun|Exec=env DESKTOPINTEGRATION=false /usr/bin/${_name}|"\
    
      43        "squashfs-root/${_name}.desktop"
    
      44}
    
      45
    
      46
    
      47package() {
    
      48 cd squashfs-root
    
      49 find "usr/share/icons/hicolor" -type f -exec install -Dm644 "{}" "${pkgdir}/{}" \;
    
      50 install -Dm644 "${_name}.desktop" "${pkgdir}/usr/share/applications/${_name}.desktop"
    
      51 cd ${srcdir}
    
      52
    
      53 install -Dm755 -t "$pkgdir/opt/${_name}/" "$srcdir/${_app_image}"
    
      54 mkdir -p "$pkgdir/usr/bin"
    
      55 ln -sf "/opt/${_name}/${_app_image}" "$pkgdir/usr/bin/${_name}"
    
      56}
    
      57

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2