shamela-native

maintainer mal1k.me · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt AppImage (inside a tar.xz) from archive.org — a third-party mirror/archive host rather than the official shamela.ws distribution channel. The AppImage is then executed during the prepare() phase (`./shamela.AppImage --appimage-extract`) to extract its squashfs contents. This means arbitrary code bundled in the AppImage runs at build time. While archive.org is a reputable hosting service and a sha1sum is provided (though SHA-1 is weak), the source is not the official vendor host, making this a genuine supply-chain concern: if the archive.org copy were replaced or tampered with, the sha1sum check would be the only guard (and SHA-1 is collision-vulnerable). Additionally, shamela.py is sourced locally (SKIP checksum) and installed as an executable wrapper, which is another unverified code vector. The combination of an executed binary from a non-official host with a weak/skipped integrity check justifies a MEDIUM rating.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:21 "shamela-linux-${pkgver}.tar.xz::https://archive.org/download/shamela_download/shamela-linux-${pkgver}.tar.xz"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt AppImage (inside a tar.xz) from archive.org — a third-party mirror/archive host rather than the official shamela.ws distribution channel. The AppImage is then executed during the prepare() phase (`./shamela.AppImage --appimage-extract`) to extract its squashfs contents. This means arbitrary code bundled in the AppImage runs at build time. While archive.org is a reputable hosting service and a sha1sum is provided (though SHA-1 is weak), the source is not the official vendor host, making this a genuine supply-chain concern: if the archive.org copy were replaced or tampered with, the sha1sum check would be the only guard (and SHA-1 is collision-vulnerable). Additionally, shamela.py is sourced locally (SKIP checksum) and installed as an executable wrapper, which is another unverified code vector. The combination of an executed binary from a non-official host with a weak/skipped integrity check justifies a MEDIUM rating.

PKGBUILD

1 offending line(s) highlighted

      1pkgname=shamela-native
    
      2pkgver=1447.11
    
      3pkgrel=3
    
      4pkgdesc="Al-Maktaba Al-Shamela — Arabic and Islamic digital library"
    
      5arch=('x86_64')
    
      6url="https://shamela.ws"
    
      7license=('LicenseRef-shamela')
    
      8depends=(
    
      9    'fuse2'
    
      10    'libselinux'
    
      11    'libxcrypt-compat'
    
      12    'python'
    
      13)
    
      14makedepends=(
    
      15    'squashfs-tools'
    
      16)
    
      17conflicts=('shamela' 'shamela-bin')
    
      18options=('!strip')
    
      19source=(
    
      20    "shamela.py"
    
      21    "shamela-linux-${pkgver}.tar.xz::https://archive.org/download/shamela_download/shamela-linux-${pkgver}.tar.xz"
    
      22)
    
      23sha1sums=(
    
      24    'SKIP'
    
      25    'cbe0e8282bd8470b1a30c8bb55be9fc205b8f394'
    
      26)
    
      27
    
      28prepare() {
    
      29    cd "${srcdir}/shamela"
    
      30
    
      31    # ── Extract squashfs from the AppImage (requires FUSE) ────────────────
    
      32    # AppImage extraction uses the built-in --appimage-extract mechanism
    
      33    chmod +x shamela.AppImage
    
      34    ./shamela.AppImage --appimage-extract
    
      35
    
      36    sed -i '/^Exec=/c\Exec=/usr/bin/shamela' squashfs-root/shamela.desktop
    
      37}
    
      38
    
      39package() {
    
      40    # ── Upstream tarball seed (/opt) ─────────────────────────────────────
    
      41    # Store the upstream tar.xz as-is for first-run seeding by /usr/bin/shamela
    
      42    install -d "${pkgdir}/opt/shamela"
    
      43    install -Dm644 "${srcdir}/shamela-linux-${pkgver}.tar.xz" \
    
      44        "${pkgdir}/opt/shamela/shamela.tar.xz"
    
      45
    
      46    # ── Wrapper / lifecycle manager (/usr/bin) ─────────────────────────────
    
      47    install -Dm755 shamela.py \
    
      48        "${pkgdir}/usr/bin/shamela"
    
      49
    
      50    # ── System .desktop entry (/usr/share/applications) ───────────────────
    
      51    # The app's own shortcut generation is suppressed at first seed via a
    
      52    # settings db patch (shortcut_desktop=false, shortcut_start=false in
    
      53    # database/user/data.db), making this the permanent and only .desktop
    
      54    install -Dm644 "${srcdir}/shamela/squashfs-root/shamela.desktop" \
    
      55        "${pkgdir}/usr/share/applications/shamela.desktop"
    
      56
    
      57    # System icon (96×96 RGBA PNG, extracted from AppImage squashfs)
    
      58    # Referenced as Icon=shamela in the .desktop file
    
      59    install -Dm644 \
    
      60        "${srcdir}/shamela/squashfs-root/usr/share/icons/hicolor/96x96/apps/shamela.png" \
    
      61        "${pkgdir}/usr/share/icons/hicolor/96x96/apps/shamela.png"
    
      62
    
      63    # ── Licenses ───────────────────────────────────────────────────────────
    
      64    install -Dm644 \
    
      65        shamela/app/linux/64/jre/2/legal/java.base/LICENSE \
    
      66        "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      67    install -Dm644 \
    
      68        shamela/app/linux/64/jre/2/legal/java.base/ADDITIONAL_LICENSE_INFO \
    
      69        "${pkgdir}/usr/share/licenses/${pkgname}/ADDITIONAL_LICENSE_INFO"
    
      70}
    
      71

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2