simtoolkitpro-appimage

maintainer orphaned · 3 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt AppImage binary from cdn.simtoolkitpro.co.uk, which is the official CDN for the SimToolkitPro application (matching the project's own domain simtoolkitpro.co.uk). This is a legitimate vendor-hosted binary, not a random personal or unofficial host. However, it is still a prebuilt executable binary installed directly to /usr/bin, and AppImages bundle their own runtime environment, meaning the entire execution stack is opaque and unauditable. The sha512sums are present and pin the specific binary, which mitigates silent substitution risk. The CDN subdomain is consistent with the official project domain. This pattern (official vendor CDN + AppImage + checksums) is common in AUR and represents a moderate but real supply-chain concern: users must trust the vendor's CDN integrity and the maintainer to update checksums on new releases. This is a genuine medium: not clearly malicious, but an executed binary from a host that cannot be independently verified against a transparency log or reproducible build.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:17 https://cdn.simtoolkitpro.co.uk/automated-builds/${_filename}

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt AppImage binary from cdn.simtoolkitpro.co.uk, which is the official CDN for the SimToolkitPro application (matching the project's own domain simtoolkitpro.co.uk). This is a legitimate vendor-hosted binary, not a random personal or unofficial host. However, it is still a prebuilt executable binary installed directly to /usr/bin, and AppImages bundle their own runtime environment, meaning the entire execution stack is opaque and unauditable. The sha512sums are present and pin the specific binary, which mitigates silent substitution risk. The CDN subdomain is consistent with the official project domain. This pattern (official vendor CDN + AppImage + checksums) is common in AUR and represents a moderate but real supply-chain concern: users must trust the vendor's CDN integrity and the maintainer to update checksums on new releases. This is a genuine medium: not clearly malicious, but an executed binary from a host that cannot be independently verified against a transparency log or reproducible build.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Dustin Childers <dchilders@gmail.com>
    
      2# Contributor: Skye Viau <skye.viau@outlook.com>
    
      3
    
      4pkgname=simtoolkitpro-appimage
    
      5pkgver=0.6.81
    
      6pkgrel=1
    
      7pkgdesc="The all-in-one flight simulation EFB"
    
      8license=('custom')
    
      9provides=('simtoolkitpro')
    
      10conflicts=('simtoolkitpro')
    
      11arch=('x86_64')
    
      12url="https://simtoolkitpro.co.uk/"
    
      13options=(!strip)
    
      14_desktop_name=SimToolkitPro.desktop
    
      15_filename=SimToolkitPro-${pkgver}-${arch}.Setup.AppImage
    
      16source=(
    
      17  https://cdn.simtoolkitpro.co.uk/automated-builds/${_filename}
    
      18  SimToolkitPro.desktop
    
      19  simtoolkitpro.png
    
      20)
    
      21sha512sums=('fe9425b632718bc625a1cb54b39d9c399cd2c7c72d556379e8a78e6c448dada3fcaee8399c73e49d5b48cbf39745ecbb04e08cce7812cbf019cd0d7f88811699'
    
      22            '82b6be8bdb19ec1973cae124068240ade1ca4b282465e410d47bf2dfceaf0f7854c8de5cf709e6ba27dfcbf43c5ad11e50617c44cfea161d6870ac86f56d6704'
    
      23            'fcbbecca8c3719aa59ac22de057fd6775282b4600d6d2a505fd24e1346e1ab92cdd456dfb28b028e880039623ac2e1aa81756b64a87b208a98e6dcbbbf38260d')
    
      24
    
      25prepare() {
    
      26  cd "$srcdir"
    
      27  chmod +x $_filename
    
      28}
    
      29
    
      30package() {
    
      31  install -Dm755 $_filename "$pkgdir"/usr/bin/SimToolkitPro.AppImage
    
      32  install -Dm0644 "simtoolkitpro.png" "$pkgdir"/usr/share/pixmaps/simtoolkitpro.png
    
      33  install -Dm755 ${srcdir}/${_desktop_name} "$pkgdir"/usr/share/applications/${_desktop_name}
    
      34}
    
      35

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2