pearai-bin

maintainer impulse · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt binary tarball from a DigitalOcean Spaces bucket (pearai-app.nyc3.digitaloceanspaces.com) using a 'latest' path component, installs it as a full Electron/Chromium-based application with a setuid chrome-sandbox, and executes it directly. While PearAI is a real open-source project (github.com/trypear/pearai-app) and DigitalOcean Spaces is a legitimate CDN used by many projects for release artifacts, the URL path '/PearAI-latest/linux/' is a mutable pointer rather than a versioned release artifact — meaning the binary could be silently replaced without changing the URL. The sha256sum provides integrity for the outer tarball at the time of PKGBUILD authorship, but the inner nested tarball (PearAI/source/PearAI.tar.gz) is extracted without any additional checksum verification. The binary is a full Electron app installed to /opt and run as the user, with a setuid chrome-sandbox. This is a genuine supply-chain concern: the host is not GitHub Releases or a well-known official CDN tied to a specific versioned artifact, and the 'latest' path means the checksum could become stale if the file is updated. This warrants medium severity.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:19 source=("https://pearai-app.nyc3.digitaloceanspaces.com/PearAI-latest/linux/PearAI-avx2.tar.gz")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads a prebuilt binary tarball from a DigitalOcean Spaces bucket (pearai-app.nyc3.digitaloceanspaces.com) using a 'latest' path component, installs it as a full Electron/Chromium-based application with a setuid chrome-sandbox, and executes it directly. While PearAI is a real open-source project (github.com/trypear/pearai-app) and DigitalOcean Spaces is a legitimate CDN used by many projects for release artifacts, the URL path '/PearAI-latest/linux/' is a mutable pointer rather than a versioned release artifact — meaning the binary could be silently replaced without changing the URL. The sha256sum provides integrity for the outer tarball at the time of PKGBUILD authorship, but the inner nested tarball (PearAI/source/PearAI.tar.gz) is extracted without any additional checksum verification. The binary is a full Electron app installed to /opt and run as the user, with a setuid chrome-sandbox. This is a genuine supply-chain concern: the host is not GitHub Releases or a well-known official CDN tied to a specific versioned artifact, and the 'latest' path means the checksum could become stale if the file is updated. This warrants medium severity.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: James Clarke <james@jamesdavidclarke.com>
    
      2# Maintainer: gf <guyxfreeman at gmail dot com>
    
      3
    
      4pkgname=pearai-bin
    
      5pkgver=1.8.9
    
      6pkgrel=1
    
      7pkgdesc="Open-source AI-powered code editor"
    
      8arch=('x86_64')
    
      9url="https://trypear.ai"
    
      10license=('MIT')
    
      11depends=(
    
      12    'dbus' 'glib2' 'krb5' 'hicolor-icon-theme' 'libxfixes'
    
      13    'gtk3' 'nss' 'libxdamage' 'atk' 'libxext'
    
      14    'cairo' 'mesa' 'libxcb' 'at-spi2-atk' 'cups'
    
      15    'libx11' 'nspr' 'libxcomposite' 'glibc' 'alsa-lib'
    
      16    'libxrandr' 'libdrm' 'libxkbfile' 'pango'
    
      17    'at-spi2-core' 'libxkbcommon'
    
      18)
    
      19source=("https://pearai-app.nyc3.digitaloceanspaces.com/PearAI-latest/linux/PearAI-avx2.tar.gz")
    
      20sha256sums=('33de7acaae3627e63686802896ae8cdd0a501bdc82dc22531954a8dc9446a964')
    
      21install=$pkgname.install
    
      22
    
      23package() {
    
      24    install -dm755 "$pkgdir/opt/PearAI"
    
      25    tar -xzf "$srcdir/PearAI/source/PearAI.tar.gz" -C "$pkgdir/opt/PearAI/"
    
      26
    
      27    install -Dm644 "$srcdir/PearAI/utils/PearAI.desktop" "$pkgdir/usr/share/applications/PearAI.desktop"
    
      28    install -Dm644 "$srcdir/PearAI/utils/PearAI-url-handler.desktop" "$pkgdir/usr/share/applications/PearAI-url-handler.desktop"
    
      29    install -Dm644 "$srcdir/PearAI/utils/pearAI.png" "$pkgdir/usr/share/icons/hicolor/256x256/apps/pearAI.png"
    
      30
    
      31    # Create symlink in /usr/bin
    
      32    install -dm755 "$pkgdir/usr/bin"
    
      33    ln -sf "/opt/PearAI/bin/PearAI" "$pkgdir/usr/bin/PearAI"
    
      34
    
      35    # Set permissions for chrome-sandbox
    
      36    if [ -f "$pkgdir/opt/PearAI/chrome-sandbox" ]; then
    
      37        chmod 4755 "$pkgdir/opt/PearAI/chrome-sandbox"
    
      38    fi
    
      39
    
      40    # Copy additional resources
    
      41    if [ -d "$pkgdir/opt/PearAI/resources" ]; then
    
      42        cp -r "$pkgdir/opt/PearAI/resources/"* "$pkgdir/opt/PearAI/"
    
      43    fi
    
      44}
    
      45

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2