pcloud-drive

maintainer zbe · 94 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt AppImage from a dynamically resolved pcloud.com subdomain via an API call, which is an unverifiable and potentially swappable source despite the host being related to the project; the AppImage is executed during prepare(), posing a supply-chain risk if the download were compromised.

Triggered rules

MEDIUM External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:20 _api_response="$(curl -s "https://api.pcloud.com/getpublinkdownload?code=${_api_code}")"

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:24 "${_appimage}::https://${_dlhost}${_dlpath}")

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt AppImage from a dynamically resolved pcloud.com subdomain via an API call, which is an unverifiable and potentially swappable source despite the host being related to the project; the AppImage is executed during prepare(), posing a supply-chain risk if the download were compromised.

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: zbe <aur at zbe dot bz>
    
      2# Maintainer: Winston Astrachan <rew1red at rew1 dot red>
    
      3# Contributor: Plague-doctor <plague at privacyrequired dot com>
    
      4
    
      5pkgname=pcloud-drive
    
      6pkgver=2.2.1
    
      7pkgrel=1
    
      8pkgdesc='pCloud drive. Electron edition.'
    
      9arch=('x86_64')
    
      10url='https://www.pcloud.com/'
    
      11license=("LicenseRef-${pkgname}")
    
      12depends=('fuse2' 'zlib' 'hicolor-icon-theme')
    
      13optdepends=('libappindicator-gtk3: Tray menu support')
    
      14options=(!strip !debug)
    
      15install="${pkgname}.install"
    
      16replaces=('pcloud-git' 'pcloud')
    
      17_shortname='pcloud'
    
      18_appimage="${pkgname}-${pkgver}-${pkgrel}.AppImage"
    
      19_api_code='XZopbc5ZpqOBs9mkVRk4zDHD7TjDJpQBcfzk'
    
      20_api_response="$(curl -s "https://api.pcloud.com/getpublinkdownload?code=${_api_code}")"
    
      21_dlhost="$(echo ${_api_response} | grep -E -o '[a-zA-Z0-9\-]+\.pcloud\.com' | head -n 2 | sort -R | head -n 1)"
    
      22_dlpath="$(echo ${_api_response} | grep -E -o "\"path\":\s{0,1}\".+\"" | cut -d '"' -f 4 | tr -d '\\')"
    
      23source=('LICENSE'
    
      24        "${_appimage}::https://${_dlhost}${_dlpath}")
    
      25sha256sums=('9dce0249569d9dc9f00217009880458cf669a657ebb6604b4e52be4e875f1a42'
    
      26            '3fddf5e975ffb38b968f5814cd8d0f2db1473ba49c1b2072f02911b5755e1f42')
    
      27
    
      28prepare() {
    
      29    chmod +x "${_appimage}"
    
      30    "./${_appimage}" --appimage-extract
    
      31}
    
      32
    
      33package() {
    
      34    cd "${srcdir}"
    
      35
    
      36    # Create Directories
    
      37    install -d "${pkgdir}/usr/bin"
    
      38    install -dm755 "${pkgdir}/usr/share/icons/hicolor"
    
      39
    
      40    # Install AppImage
    
      41    install -Dm755 "${_appimage}" "${pkgdir}/opt/${_shortname}/${_shortname/c/C}.AppImage"
    
      42
    
      43    # Install License
    
      44    install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      45
    
      46    # Install Icons, Desktop Shortcut
    
      47    find squashfs-root -type d -exec chmod 0755 {} \;
    
      48    cp -r squashfs-root/usr/share/icons/hicolor "${pkgdir}/usr/share/icons/"
    
      49
    
      50    # Update desktop file entries
    
      51    sed -i -E "s|Exec=AppRun|Exec=env DESKTOPINTEGRATION=false /usr/bin/${_shortname}|" \
    
      52        "squashfs-root/${_shortname}.desktop"
    
      53    sed -i "s/Name=pcloud/Name=pCloud/" "squashfs-root/${_shortname}.desktop"
    
      54
    
      55    # Install desktop file
    
      56    install -Dm644 "squashfs-root/${_shortname}.desktop" -t "${pkgdir}/usr/share/applications/"
    
      57
    
      58    # Symlink AppImage
    
      59    ln -sf "/opt/${_shortname}/${_shortname/c/C}.AppImage" "${pkgdir}/usr/bin/${_shortname}"
    
      60}
    
      61

Changes since previous scan

--- PKGBUILD @ 2026-07-24 00:02
+++ PKGBUILD @ 2026-08-03 00:08
@@ -3,7 +3,7 @@
 # Contributor: Plague-doctor <plague at privacyrequired dot com>
 
 pkgname=pcloud-drive
-pkgver=2.1.1
+pkgver=2.2.1
 pkgrel=1
 pkgdesc='pCloud drive. Electron edition.'
 arch=('x86_64')
@@ -16,14 +16,14 @@
 replaces=('pcloud-git' 'pcloud')
 _shortname='pcloud'
 _appimage="${pkgname}-${pkgver}-${pkgrel}.AppImage"
-_api_code='XZtwII5Zjf5noLYtDwJ1qkyAXaqujuvVKBbX'
+_api_code='XZopbc5ZpqOBs9mkVRk4zDHD7TjDJpQBcfzk'
 _api_response="$(curl -s "https://api.pcloud.com/getpublinkdownload?code=${_api_code}")"
 _dlhost="$(echo ${_api_response} | grep -E -o '[a-zA-Z0-9\-]+\.pcloud\.com' | head -n 2 | sort -R | head -n 1)"
 _dlpath="$(echo ${_api_response} | grep -E -o "\"path\":\s{0,1}\".+\"" | cut -d '"' -f 4 | tr -d '\\')"
 source=('LICENSE'
         "${_appimage}::https://${_dlhost}${_dlpath}")
 sha256sums=('9dce0249569d9dc9f00217009880458cf669a657ebb6604b4e52be4e875f1a42'
-            '5b36540d4e33be0c4418fa41dfad9c7910112413cc2187be0537c3b1a4245364')
+            '3fddf5e975ffb38b968f5814cd8d0f2db1473ba49c1b2072f02911b5755e1f42')
 
 prepare() {
     chmod +x "${_appimage}"

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	3
2026-08-02 00:16:08	MEDIUM	3
2026-08-01 00:11:18	MEDIUM	3
2026-07-31 00:14:10	MEDIUM	3
2026-07-30 00:17:23	MEDIUM	3
2026-07-29 00:25:53	MEDIUM	3
2026-07-28 00:07:28	MEDIUM	3
2026-07-27 00:24:32	MEDIUM	3
2026-07-26 00:07:32	MEDIUM	3
2026-07-25 00:13:44	MEDIUM	3
2026-07-24 15:27:57	MEDIUM	3
2026-07-24 00:02:28	MEDIUM	3
2026-07-23 00:14:47	MEDIUM	3
2026-07-22 00:29:32	MEDIUM	3
2026-07-21 00:24:15	MEDIUM	3
2026-07-20 00:19:49	MEDIUM	3
2026-07-19 00:17:08	MEDIUM	3
2026-07-18 00:14:48	MEDIUM	3
2026-07-17 00:06:16	MEDIUM	3
2026-07-16 00:05:41	MEDIUM	3