overte-appimage

maintainer kleintux · 3 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt AppImage binary from a DigitalOcean Spaces bucket (overte-public.fra1.digitaloceanspaces.com) controlled by the Overte project, extracts and installs it as an executable. While this is the project's own official release infrastructure (not a random personal host), it is still an object storage bucket rather than a GitHub release artifact, meaning there is no cryptographic provenance chain (no GPG signature verification). The sha256sum provides integrity checking against silent replacement only if the checksum itself is trustworthy. The AppImage is executed during prepare() via --appimage-extract, meaning arbitrary code in the AppImage runs at build time. This is a standard AppImage packaging pattern in the AUR, but the combination of a binary-only artifact from a cloud storage bucket with no signature verification is a genuine medium-severity supply-chain concern: if the bucket is compromised or the object is replaced, the sha256sum in the PKGBUILD would need to be updated to catch it, and there is no out-of-band verification. The host appears to be the official Overte project storage, which reduces (but does not eliminate) the risk compared to a truly personal/unofficial host.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source_x86_64=("${_appimage}::https://overte-public.fra1.digitaloceanspaces.com/build/overte/release/${pkgver}/Overte-${pkgver}-x86_64.AppImage")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt AppImage binary from a DigitalOcean Spaces bucket (overte-public.fra1.digitaloceanspaces.com) controlled by the Overte project, extracts and installs it as an executable. While this is the project's own official release infrastructure (not a random personal host), it is still an object storage bucket rather than a GitHub release artifact, meaning there is no cryptographic provenance chain (no GPG signature verification). The sha256sum provides integrity checking against silent replacement only if the checksum itself is trustworthy. The AppImage is executed during prepare() via --appimage-extract, meaning arbitrary code in the AppImage runs at build time. This is a standard AppImage packaging pattern in the AUR, but the combination of a binary-only artifact from a cloud storage bucket with no signature verification is a genuine medium-severity supply-chain concern: if the bucket is compromised or the object is replaced, the sha256sum in the PKGBUILD would need to be updated to catch it, and there is no out-of-band verification. The host appears to be the official Overte project storage, which reduces (but does not eliminate) the risk compared to a truly personal/unofficial host.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: <reg-archlinux AT klein DOT tuxli DOT ch> 
    
      2
    
      3_pkgname=overte
    
      4_pkgname_addition="-nodebug"
    
      5pkgname=${_pkgname}-appimage
    
      6pkgver=2026.04.1
    
      7pkgrel=1
    
      8pkgdesc="Overte open source virtual worlds platform. "
    
      9arch=('x86_64')
    
      10url="https://github.com/overte-org/overte"
    
      11license=('Apache-2.0')
    
      12options=(!strip)
    
      13_appimage="${pkgname}-${pkgver}.AppImage"
    
      14source_x86_64=("${_appimage}::https://overte-public.fra1.digitaloceanspaces.com/build/overte/release/${pkgver}/Overte-${pkgver}-x86_64.AppImage")
    
      15noextract=("${_appimage}")
    
      16sha256sums_x86_64=('dc39f5b4694a1c48cfb1454a8922f6a25fa4db5820bf937113ebf4086aa99145')
    
      17
    
      18prepare() {
    
      19    chmod +x "${_appimage}"
    
      20    ./"${_appimage}" --appimage-extract
    
      21}
    
      22
    
      23build() {
    
      24    # Adjust .desktop so it will work outside of AppImage container
    
      25    sed -i -E "s|Exec=AppRun|Exec=env DESKTOPINTEGRATION=false /usr/bin/${_pkgname^} %u|"\
    
      26        "squashfs-root/org.overte.interface.desktop"
    
      27    # Fix permissions; .AppImage permissions are 700 for all directories
    
      28    chmod -R a-x+rX squashfs-root/usr
    
      29}
    
      30
    
      31package() {
    
      32    # AppImage
    
      33    install -Dm755 "${srcdir}/${_appimage}" "${pkgdir}/opt/${pkgname}/${pkgname}.AppImage"
    
      34
    
      35    # Desktop file
    
      36    install -Dm644 "${srcdir}/squashfs-root/org.overte.interface.desktop"\
    
      37            "${pkgdir}/usr/share/applications/${_pkgname^}.desktop"
    
      38
    
      39    # Symlink executable
    
      40    install -dm755 "${pkgdir}/usr/bin"
    
      41    ln -s "/opt/${pkgname}/${pkgname}.AppImage" "${pkgdir}/usr/bin/${_pkgname^}"
    
      42}
    
      43

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2