pcloud-drive

MEDIUM

maintainer zbe 95 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads a prebuilt AppImage from a dynamically resolved pcloud.com subdomain via an API call, which is an unverifiable and potentially swappable source despite the host being related to the project; the AppImage is executed during prepare(), posing a supply-chain risk if the download were compromised.

Triggered rules

Medium External download from an untrusted host, not in source=() external_download_not_in_source

curl/wget fetches a URL on a non-allowlisted host that is not part of source=(), so it is not checksum-verified by makepkg.

PKGBUILD:20 _api_response="$(curl -s "https://api.pcloud.com/getpublinkdownload?code=${_api_code}")"

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:24 "${_appimage}::https://${_dlhost}${_dlpath}")

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt AppImage from a dynamically resolved pcloud.com subdomain via an API call, which is an unverifiable and potentially swappable source despite the host being related to the project; the AppImage is executed during prepare(), posing a supply-chain risk if the download were compromised.

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: zbe <aur at zbe dot bz>
    
      2# Maintainer: Winston Astrachan <rew1red at rew1 dot red>
    
      3# Contributor: Plague-doctor <plague at privacyrequired dot com>
    
      4
    
      5pkgname=pcloud-drive
    
      6pkgver=2.2.1
    
      7pkgrel=1
    
      8pkgdesc='pCloud drive. Electron edition.'
    
      9arch=('x86_64')
    
      10url='https://www.pcloud.com/'
    
      11license=("LicenseRef-${pkgname}")
    
      12depends=('fuse2' 'zlib' 'hicolor-icon-theme')
    
      13optdepends=('libappindicator-gtk3: Tray menu support')
    
      14options=(!strip !debug)
    
      15install="${pkgname}.install"
    
      16replaces=('pcloud-git' 'pcloud')
    
      17_shortname='pcloud'
    
      18_appimage="${pkgname}-${pkgver}-${pkgrel}.AppImage"
    
      19_api_code='XZopbc5ZpqOBs9mkVRk4zDHD7TjDJpQBcfzk'
    
      20_api_response="$(curl -s "https://api.pcloud.com/getpublinkdownload?code=${_api_code}")"
    
      21_dlhost="$(echo ${_api_response} | grep -E -o '[a-zA-Z0-9\-]+\.pcloud\.com' | head -n 2 | sort -R | head -n 1)"
    
      22_dlpath="$(echo ${_api_response} | grep -E -o "\"path\":\s{0,1}\".+\"" | cut -d '"' -f 4 | tr -d '\\')"
    
      23source=('LICENSE'
    
      24        "${_appimage}::https://${_dlhost}${_dlpath}")
    
      25sha256sums=('9dce0249569d9dc9f00217009880458cf669a657ebb6604b4e52be4e875f1a42'
    
      26            '3fddf5e975ffb38b968f5814cd8d0f2db1473ba49c1b2072f02911b5755e1f42')
    
      27
    
      28prepare() {
    
      29    chmod +x "${_appimage}"
    
      30    "./${_appimage}" --appimage-extract
    
      31}
    
      32
    
      33package() {
    
      34    cd "${srcdir}"
    
      35
    
      36    # Create Directories
    
      37    install -d "${pkgdir}/usr/bin"
    
      38    install -dm755 "${pkgdir}/usr/share/icons/hicolor"
    
      39
    
      40    # Install AppImage
    
      41    install -Dm755 "${_appimage}" "${pkgdir}/opt/${_shortname}/${_shortname/c/C}.AppImage"
    
      42
    
      43    # Install License
    
      44    install -Dm644 LICENSE "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      45
    
      46    # Install Icons, Desktop Shortcut
    
      47    find squashfs-root -type d -exec chmod 0755 {} \;
    
      48    cp -r squashfs-root/usr/share/icons/hicolor "${pkgdir}/usr/share/icons/"
    
      49
    
      50    # Update desktop file entries
    
      51    sed -i -E "s|Exec=AppRun|Exec=env DESKTOPINTEGRATION=false /usr/bin/${_shortname}|" \
    
      52        "squashfs-root/${_shortname}.desktop"
    
      53    sed -i "s/Name=pcloud/Name=pCloud/" "squashfs-root/${_shortname}.desktop"
    
      54
    
      55    # Install desktop file
    
      56    install -Dm644 "squashfs-root/${_shortname}.desktop" -t "${pkgdir}/usr/share/applications/"
    
      57
    
      58    # Symlink AppImage
    
      59    ln -sf "/opt/${_shortname}/${_shortname/c/C}.AppImage" "${pkgdir}/usr/bin/${_shortname}"
    
      60}
    
      61

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	3
2026-09-16 00:03:17	Medium	3
2026-09-15 00:25:31	Medium	3
2026-09-14 00:27:57	Medium	3
2026-09-13 00:19:54	Medium	3
2026-09-12 00:25:17	Medium	3
2026-09-11 00:19:22	Medium	3
2026-09-10 00:22:44	Medium	3
2026-09-09 00:04:09	Medium	3
2026-09-08 00:18:08	Medium	3
2026-09-07 00:30:15	Medium	3
2026-09-06 00:17:06	Medium	3
2026-09-05 00:16:27	Medium	3
2026-09-04 00:03:13	Medium	3
2026-09-03 00:15:47	Medium	3
2026-09-02 00:02:31	Medium	3
2026-09-01 00:11:19	Medium	3
2026-08-31 00:19:57	Medium	3
2026-08-30 00:04:14	Medium	3
2026-08-29 00:29:17	Medium	3