rootapp-bin

MEDIUM

maintainer ackerman 2 votes scanned 2026-11-01 03:59:29.907809

View on AUR

Why flagged

The package downloads a prebuilt AppImage from a non-standard host (installer.rootapp.com), which is not on the static analyzer's whitelist; while the AppImage is from the official vendor, the unverifiable nature of the executable payload from a non-whitelisted domain constitutes a supply-chain risk if the host were compromised.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:72 source=("Root-${pkgver}-x86_64.AppImage::https://installer.rootapp.com/installer/Linux/X64/Root.AppImage")

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt AppImage from a non-standard host (installer.rootapp.com), which is not on the static analyzer's whitelist; while the AppImage is from the official vendor, the unverifiable nature of the executable payload from a non-whitelisted domain constitutes a supply-chain risk if the host were compromised.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Ackerman
    
      2pkgname=rootapp-bin
    
      3pkgver=0.9.158
    
      4pkgrel=4
    
      5pkgdesc="Root App is a new Discord alternative, designed for gaming communities and large online groups"
    
      6arch=('x86_64')
    
      7url="https://www.rootapp.com"
    
      8license=('LicenseRef-proprietary')
    
      9# depends: DT_NEEDED of the 18 shipped ELFs plus by-name dlopen probes, resolved in core+extra; ca-certificates-mozilla from the /etc/ssl/cert.pem and /etc/ssl/certs opens in strace (2026-10-31).
    
      10depends=('alsa-lib'
    
      11         'at-spi2-core'
    
      12         'ca-certificates-mozilla'
    
      13         'cairo'
    
      14         'dbus'
    
      15         'expat'
    
      16         'fontconfig'
    
      17         'glib2'
    
      18         'gtk3'
    
      19         'hicolor-icon-theme'
    
      20         'krb5'
    
      21         'libcups'
    
      22         'libgcc'
    
      23         'libglvnd'
    
      24         'libice'
    
      25         'libpipewire'
    
      26         'libpulse'
    
      27         'libsm'
    
      28         'libstdc++'
    
      29         'libva'
    
      30         'libx11'
    
      31         'libxcb'
    
      32         'libxcomposite'
    
      33         'libxcursor'
    
      34         'libxdamage'
    
      35         'libxext'
    
      36         'libxfixes'
    
      37         'libxi'
    
      38         'libxinerama'
    
      39         'libxkbcommon'
    
      40         'libxkbcommon-x11'
    
      41         'libxrandr'
    
      42         'libxss'
    
      43         'libxt'
    
      44         'libxtst'
    
      45         'mesa'
    
      46         'nspr'
    
      47         'nss'
    
      48         'openssl'
    
      49         'pango'
    
      50         'pciutils'
    
      51         'systemd-libs'
    
      52         'vulkan-icd-loader'
    
      53         'wayland'
    
      54         'xdg-utils')
    
      55provides=('rootapp')
    
      56conflicts=('rootapp')
    
      57# optdepends: portal, LibVLC, PipeWire and org.freedesktop.Notifications calls seen at runtime (2026-10-31).
    
      58optdepends=('xdg-desktop-portal: file-picker and screen-share dialogs'
    
      59            'xdg-desktop-portal-gnome: file-picker, settings and screen-share backend on GNOME'
    
      60            'xdg-desktop-portal-gtk: file-picker and settings backend on GTK desktops'
    
      61            'xdg-desktop-portal-kde: file-picker and screen-share backend on KDE Plasma'
    
      62            'xdg-desktop-portal-wlr: screen-share backend on wlroots compositors'
    
      63            'xdg-desktop-portal-hyprland: window and region screen share plus portal global shortcuts on Hyprland'
    
      64            'pipewire: PipeWire daemon that feeds the portal ScreenCast capture'
    
      65            'pipewire-pulse: PulseAudio-compatible server for voice and audio devices'
    
      66            'dunst: org.freedesktop.Notifications daemon for sessions without one'
    
      67            'vlc-plugin-ffmpeg: video and stream playback through LibVLC'
    
      68            'vlc-plugin-pulse: audio output for LibVLC playback on PipeWire and PulseAudio')
    
      69options=('!strip' '!debug')
    
      70
    
      71# single source: the aur.yml updater rewrites sha256sums to one hash (2026-10-31).
    
      72source=("Root-${pkgver}-x86_64.AppImage::https://installer.rootapp.com/installer/Linux/X64/Root.AppImage")
    
      73sha256sums=('37679572ce8c0a6f4838c74ae0eafd2edc943d5e90fa36807fdb3a1dab48cc74')
    
      74prepare() {
    
      75    chmod +x "${srcdir}/Root-${pkgver}-x86_64.AppImage"
    
      76    "${srcdir}/Root-${pkgver}-x86_64.AppImage" --appimage-extract
    
      77    chmod go-w squashfs-root
    
      78
    
      79    shipped=$(sed -n 's/^X-AppImage-Version=//p' "${srcdir}"/squashfs-root/*.desktop | head -n 1)
    
      80    if [ "$shipped" != "$pkgver" ]; then
    
      81        printf 'payload is version %s, pkgver is %s\n' "${shipped:-unknown}" "$pkgver" >&2
    
      82        return 1
    
      83    fi
    
      84}
    
      85
    
      86package() {
    
      87    install -dm755 "${pkgdir}/opt/${pkgname}"
    
      88    cp -r "${srcdir}/squashfs-root/"* "${pkgdir}/opt/${pkgname}/"
    
      89    chmod 755 "${pkgdir}/opt/${pkgname}/AppRun"
    
      90
    
      91    rm -f "${pkgdir}/opt/${pkgname}/usr/bin/Root.dbg"
    
      92
    
      93    if [ ! -x "${pkgdir}/opt/${pkgname}/usr/bin/Root" ]; then
    
      94        printf 'payload has no executable usr/bin/Root, the wrapper would exec nothing\n' >&2
    
      95        return 1
    
      96    fi
    
      97
    
      98    install -dm755 "${pkgdir}/usr/bin"
    
      99    # Payload mkdirs "Root Communications", "Sentry" and ".sentry-native" beside its exe, so it needs a user-writable runtime dir (strace, 2026-10-29).
    
      100    cat > "${pkgdir}/usr/bin/rootapp" <<'WRAPPER_EOF'
    
      101#!/bin/sh
    
      102set -eu
    
      103run="${XDG_DATA_HOME:-$HOME/.local/share}/rootapp-bin"
    
      104stamp=__STAMP__
    
      105mkdir -p "$run"
    
      106chmod 700 "$run" 2>/dev/null || true
    
      107if [ "$(cat "$run/.stamp" 2>/dev/null || true)" != "$stamp" ]; then
    
      108    cp --reflink=auto "/opt/rootapp-bin/usr/bin/Root" "$run/Root.part"
    
      109    chmod 755 "$run/Root.part"
    
      110    mv -f "$run/Root.part" "$run/Root"
    
      111    for entry in /opt/rootapp-bin/usr/bin/*; do
    
      112        name=${entry##*/}
    
      113        [ "$name" = Root ] || ln -sfn "$entry" "$run/$name"
    
      114    done
    
      115    printf '%s\n' "$stamp" > "$run/.stamp"
    
      116fi
    
      117exec "$run/Root" "$@"
    
      118WRAPPER_EOF
    
      119    sed -i "s/__STAMP__/${pkgver}-${pkgrel}/" "${pkgdir}/usr/bin/rootapp"
    
      120    if grep -q '__STAMP__' "${pkgdir}/usr/bin/rootapp"; then
    
      121        printf 'unstamped wrapper would recopy the payload on every launch\n' >&2
    
      122        return 1
    
      123    fi
    
      124    chmod 755 "${pkgdir}/usr/bin/rootapp"
    
      125
    
      126    install -dm755 "${pkgdir}/usr/share/licenses/${pkgname}"
    
      127    cat > "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE" <<'EOF'
    
      128Copyright 2026 RootApp
    
      129
    
      130The Root desktop application is proprietary software. Redistribution of the
    
      131application itself is not permitted; this package repacks the upstream binary
    
      132for installation convenience.
    
      133
    
      134Upstream: https://www.rootapp.com
    
      135EOF
    
      136
    
      137    install -Dm644 "${srcdir}/squashfs-root/Root.png" "${pkgdir}/usr/share/pixmaps/rootapp.png"
    
      138    install -Dm644 "${srcdir}/squashfs-root/Root.png" "${pkgdir}/usr/share/icons/hicolor/512x512/apps/rootapp.png"
    
      139
    
      140    install -dm755 "${pkgdir}/usr/share/applications"
    
      141    cat > "${pkgdir}/usr/share/applications/rootapp-app.desktop" <<'EOF'
    
      142[Desktop Entry]
    
      143Type=Application
    
      144Name=Root
    
      145Comment=Root App is a new Discord alternative, designed for gaming communities and large online groups
    
      146Exec=rootapp %U
    
      147Icon=rootapp
    
      148Terminal=false
    
      149StartupWMClass=Root
    
      150Categories=Network;InstantMessaging;
    
      151MimeType=x-scheme-handler/rootapp;
    
      152EOF
    
      153}
    
      154

Changes since previous scan

--- PKGBUILD @ 2026-11-01 00:21
+++ PKGBUILD @ 2026-11-01 03:59
@@ -1,14 +1,15 @@
 # Maintainer: Ackerman
 pkgname=rootapp-bin
 pkgver=0.9.158
-pkgrel=3
+pkgrel=4
 pkgdesc="Root App is a new Discord alternative, designed for gaming communities and large online groups"
 arch=('x86_64')
 url="https://www.rootapp.com"
 license=('LicenseRef-proprietary')
-# depends: DT_NEEDED of the 18 shipped ELFs plus by-name dlopen probes, resolved in core+extra (2026-10-31).
+# depends: DT_NEEDED of the 18 shipped ELFs plus by-name dlopen probes, resolved in core+extra; ca-certificates-mozilla from the /etc/ssl/cert.pem and /etc/ssl/certs opens in strace (2026-10-31).
 depends=('alsa-lib'
          'at-spi2-core'
+         'ca-certificates-mozilla'
          'cairo'
          'dbus'
          'expat'

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 03:59:29	Medium	2
2026-11-01 00:21:48	Medium	2
2026-10-31 21:59:05	Medium	2
2026-10-31 13:58:24	Medium	2
2026-10-31 05:57:59	Medium	2
2026-10-31 00:07:41	Medium	2
2026-10-30 23:57:35	Medium	2
2026-10-30 13:56:02	Medium	2
2026-10-30 07:55:24	Medium	2
2026-10-30 01:55:02	Medium	2
2026-10-30 00:29:30	Medium	2
2026-10-29 23:54:04	Medium	2
2026-10-29 13:52:19	Medium	2
2026-10-29 05:51:59	Medium	1
2026-10-29 00:13:55	Medium	2
2026-10-28 23:51:05	Medium	2
2026-10-28 15:50:30	Medium	2
2026-10-28 11:50:06	Medium	2
2026-10-28 05:49:54	Medium	2
2026-10-28 03:49:04	Medium	2