redisinsight-bin

maintainer Zoddo · 10 votes · scanned 2026-08-03 00:08:14.047287
MEDIUM
View on AUR ↗
Why flagged The package downloads a prebuilt AppImage binary from a non-whitelisted host (download.redisinsight.redis.com), which is plausibly official but unverified; worst case, a compromised host could silently replace the executable with a malicious version, posing a supply-chain risk.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

  • PKGBUILD:19 source=("${_filename}::https://download.redisinsight.redis.com/releases/${pkgver}/Redis-Insight-linux-x86_64.AppImage")
MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-07-25) reviewed this and agrees it is MEDIUM (confidence 90%): The package downloads a prebuilt AppImage binary from a non-whitelisted host (download.redisinsight.redis.com), which is plausibly official but unverified; worst case, a compromised host could silently replace the executable with a malicious version, posing a supply-chain risk.

PKGBUILD

1 offending line(s) highlighted
1# Maintainer: Zoddo <archlinux+aur@zoddo.fr>
2_pkgname=redisinsight
3pkgname=${_pkgname}-bin
4pkgver=3.6.0
5pkgrel=1
6pkgdesc="Redis Insight is an intuitive and efficient GUI for Redis, allowing you to interact with your databases and manage your data."
7arch=('x86_64')
8url='https://redis.io/insight/'
9license=('custom:SSPL')
10depends=(
11 'libgtk-3.so'
12 'nss'
13 'xdg-utils'
14)
15makedepends=('fuse2')
16provides=("${_pkgname}")
17conflicts=("${_pkgname}")
18_filename="Redis-Insight-linux-x86_64-${pkgver}.AppImage"
19source=("${_filename}::https://download.redisinsight.redis.com/releases/${pkgver}/Redis-Insight-linux-x86_64.AppImage")
20sha512sums=('5fc04e3c879b72d3ad17e8ddeb8363d8a8e5d6c010688fb7002f1542b269a84d1c366a09516382ba24b30d413f7b1986e778252556f40d0e1bda6e2cf566abd9')
21
22prepare() {
23 chmod +x "${_filename}"
24 ./${_filename} --appimage-extract > /dev/null
25 sed -i "s|^Exec=.*|Exec=\"/opt/${_pkgname}/redisinsight\" %U|" squashfs-root/redisinsight.desktop
26}
27
28package () {
29 install -d "${pkgdir}/opt/${_pkgname}"
30 cp -r --no-preserve=mode squashfs-root/* "${pkgdir}/opt/${_pkgname}/"
31 chmod +x \
32 "${pkgdir}/opt/${_pkgname}/redisinsight" \
33 "${pkgdir}/opt/${_pkgname}/chrome_crashpad_handler"
34
35 # SUID chrome-sandbox for Electron 5+
36 chmod 4755 "${pkgdir}/opt/${_pkgname}/chrome-sandbox"
37
38 # Icons
39 for size in 16 24 32 48 64 96 128 256 512 1024; do
40 install -Dm644 "${pkgdir}/opt/${_pkgname}/resources/resources/icons/${size}x${size}.png" \
41 "${pkgdir}/usr/share/icons/hicolor/${size}x${size}/apps/${_pkgname}.png"
42 done
43
44 # Applications entry
45 install -Dm644 "${pkgdir}/opt/${_pkgname}/redisinsight.desktop" "${pkgdir}/usr/share/applications/${_pkgname}.desktop"
46
47 # Copy license to /usr/share/licenses as per Arch packaging guidelines
48 install -Dm644 "${pkgdir}/opt/${_pkgname}/resources/LICENSE.redisinsight.txt" "${pkgdir}/usr/share/licenses/${_pkgname}/LICENSE"
49
50 # Remove duplicate files, AppImage specifc files
51 rm -r \
52 "${pkgdir}/opt/${_pkgname}/AppRun" \
53 "${pkgdir}/opt/${_pkgname}/redisinsight.desktop" \
54 "${pkgdir}/opt/${_pkgname}/redisinsight.png" \
55 "${pkgdir}/opt/${_pkgname}/usr/"
56}
57

Scan history

Scanned at (UTC)SeverityRules
2026-08-03 00:08:14 MEDIUM 2
2026-08-02 00:16:08 MEDIUM 2
2026-08-01 00:11:18 MEDIUM 2
2026-07-31 00:14:10 MEDIUM 2
2026-07-30 00:17:23 MEDIUM 2
2026-07-29 00:25:53 MEDIUM 2
2026-07-28 00:07:28 MEDIUM 2
2026-07-27 00:24:32 MEDIUM 2
2026-07-26 00:07:32 MEDIUM 2
2026-07-25 00:13:44 MEDIUM 2
2026-07-24 00:02:28 MEDIUM 2
2026-07-23 00:14:47 MEDIUM 2
2026-07-22 00:29:32 MEDIUM 2
2026-07-21 00:24:15 MEDIUM 2
2026-07-20 00:19:49 MEDIUM 2
2026-07-19 00:17:08 MEDIUM 2
2026-07-18 00:14:48 MEDIUM 2
2026-07-17 00:06:16 MEDIUM 2
2026-07-16 00:05:41 MEDIUM 2
2026-07-15 00:09:25 MEDIUM 2

Report a package

Reports go to the AURWatch maintainer (one person) and are read by hand. No login required.

0 / 4000
Your suggestion