serenade.ai

maintainer cedricfarinazzo · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt AppImage binary from serenadecdn.com (the official Serenade CDN, not a personal/random host) and executes it during prepare() to extract its contents. The sha1sums check provides weak integrity verification (SHA-1 is cryptographically broken for collision resistance, though still useful against accidental corruption). The core concern is that this is a closed-source, prebuilt binary from a vendor CDN: if serenadecdn.com were compromised or the binary swapped, the package would install malicious code. This is a standard medium-severity supply-chain concern for prebuilt AppImage packages in the AUR — not clearly malicious, but not verifiable source code either. The domain appears to be the legitimate official CDN for Serenade (serenade.ai product), so this is not an 'unofficial or personal host' scenario, but the executed-binary-from-external-host risk remains real.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source=("${_appimage}::https://serenadecdn.com/app/Serenade-${pkgver}.AppImage")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt AppImage binary from serenadecdn.com (the official Serenade CDN, not a personal/random host) and executes it during prepare() to extract its contents. The sha1sums check provides weak integrity verification (SHA-1 is cryptographically broken for collision resistance, though still useful against accidental corruption). The core concern is that this is a closed-source, prebuilt binary from a vendor CDN: if serenadecdn.com were compromised or the binary swapped, the package would install malicious code. This is a standard medium-severity supply-chain concern for prebuilt AppImage packages in the AUR — not clearly malicious, but not verifiable source code either. The domain appears to be the legitimate official CDN for Serenade (serenade.ai product), so this is not an 'unofficial or personal host' scenario, but the executed-binary-from-external-host risk remains real.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Cédric 'Sed' FARINAZZO <cedric.farinazzo@gmail.com>
    
      2
    
      3pkgname=serenade.ai
    
      4pkgver=2.0.2
    
      5pkgrel=1
    
      6pkgdesc="Serenade is the most powerful way to program using natural speech."
    
      7url="https://serenade.ai"
    
      8arch=('any')
    
      9license=()
    
      10install='serenadeai.install'
    
      11provides=('serenade.ai')
    
      12
    
      13_appimage="Serenade-${pkgver}.AppImage"
    
      14source=("${_appimage}::https://serenadecdn.com/app/Serenade-${pkgver}.AppImage")
    
      15sha1sums=('19361df2b91ca444400b4e7da368c52b4c5d32ec')
    
      16noextract=("${_appimage}")
    
      17
    
      18prepare() {
    
      19  cd "${srcdir}"
    
      20
    
      21  chmod +x "${_appimage}"
    
      22  ./"${_appimage}" --appimage-extract
    
      23}
    
      24
    
      25package() {
    
      26  mkdir -p "${pkgdir}/usr/share/"
    
      27
    
      28  cp -r "${srcdir}/squashfs-root" "${pkgdir}/usr/share/Serenade.ai"
    
      29  chmod -R 755 "${pkgdir}/usr/share/Serenade.ai"
    
      30}
    
      31
    
      32

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2