rotatrix

MEDIUM

maintainer Felixoid 0 votes scanned 2026-09-06 17:12:21.241024

View on AUR

Why flagged

The package downloads and executes an unverifiable AppImage from a custom protocol handler (rotatrix://), which points to a non-standard, potentially swappable source, creating a supply-chain risk if the host is compromised or malicious.

Triggered rules

Low Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

Medium AI review of an ambiguous pattern llm_review

The static rules found a suspicious pattern they could not resolve, so an AI model (qwen/qwen3-235b-a22b-2507) reviewed it and judged it MEDIUM (confidence 95%): The package downloads and executes an unverifiable AppImage from a custom protocol handler (rotatrix://), which points to a non-standard, potentially swappable source, creating a supply-chain risk if the host is compromised or malicious.

PKGBUILD

      1# Maintainer: Mikhail f. Shiryaev <mr dot felixoid at gmail dot com>
    
      2# Community-driven packaging
    
      3
    
      4pkgname="rotatrix"
    
      5pkgver=1.5.1
    
      6pkgrel=1
    
      7pkgdesc="Rotatrix configuration application (AppImage)"
    
      8arch=('x86_64')
    
      9url="https://rotatrix.com/"
    
      10license=('LicenseRef-Rotatrix')
    
      11options=('!strip' '!debug')
    
      12_appimage=Rotatrix-${pkgver}-linux-x86_64.AppImage
    
      13source=(
    
      14  "${_appimage}::rotatrix://${_appimage}"
    
      15  LICENSE # url: https://rotatrix.com/eula/
    
      16)
    
      17sha256sums=(
    
      18  7e0e5cbae055262ba723c59404549107d186a8cf1217cfd449cff3e46f68059a
    
      19  c38bb9b9c10c1a0cf7aa327432c3fd12cece2714ab9fe06799c7440cac383dfb
    
      20)
    
      21DLAGENTS+=("rotatrix::${startdir}/rotatrix-download %u %o")
    
      22
    
      23prepare() {
    
      24  chmod +x "${_appimage}"
    
      25  cd "$srcdir"
    
      26  msg2 "Extracting AppImage"
    
      27  ./"$_appimage" --appimage-extract
    
      28
    
      29  sed -i "s|Exec=AppRun|Exec=/usr/bin/rotatrix|g" \
    
      30    "squashfs-root/RotatrixApp.desktop"
    
      31}
    
      32
    
      33package() {
    
      34  cd "$srcdir"
    
      35
    
      36  install -d "$pkgdir/opt/${pkgname}/"
    
      37  cp -a squashfs-root/usr "$pkgdir/opt/${pkgname}/"
    
      38
    
      39  install -d "$pkgdir/usr/bin"
    
      40  cat > "$pkgdir/usr/bin/rotatrix" << EOF
    
      41#!/usr/bin/env bash
    
      42export APPIMAGE="$_appimage"
    
      43exec "/opt/${pkgname}/usr/bin/rotatrix" "\$@"
    
      44EOF
    
      45  chmod 0755 "$pkgdir/usr/bin/rotatrix"
    
      46
    
      47  install -Dm644 "squashfs-root/RotatrixApp.desktop" -t \
    
      48    "$pkgdir/usr/share/applications/"
    
      49
    
      50  install -d "$pkgdir/usr/share/icons/"
    
      51  cp -r squashfs-root/usr/share/icons/hicolor/ "$pkgdir/usr/share/icons/"
    
      52
    
      53  install -d "$pkgdir/usr/share/licenses/${pkgname}"
    
      54
    
      55  cp "$srcdir/LICENSE" "$pkgdir/usr/share/licenses/${pkgname}"
    
      56}
    
      57

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-06 17:12:21	Medium	2