siyuan-b3log-appimage
maintainer cyahua
· 1 votes
· scanned 2026-08-03 00:08:14.047287
MEDIUM
View on AUR ↗
Why flagged
The package downloads a prebuilt AppImage from a non-whitelisted, non-standard host (release.liuyun.io) with an unverifiable checksum (SKIP), creating a supply-chain risk if the host is compromised or malicious.
Triggered rules
MEDIUM
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:18
source=("https://release.liuyun.io/siyuan/siyuan-${pkgver}-linux.AppImage")
MEDIUM
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt AppImage from a non-whitelisted, non-standard host (release.liuyun.io) with an unverifiable checksum (SKIP), creating a supply-chain risk if the host is compromised or malicious.
PKGBUILD
1 offending line(s) highlighted
1
# maintainer: SiYuan community (https://github.com/siyuan-note/siyuan/issues/new/choose)
2
# auto running on siyuan official repo
3
# PKGBUILD is modified from https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=siyuan-appimage
4
# which is made by vvxxp8 <concatenate[g] the characters[x] in square[b] brackets[1] in[5] order[3] at gmail dot com>
5
# had agreement with the author to use the PKGBUILD
6
# for change request, PLEASE MAKE A PR ON GITHUB REPO, keep commenting here would be ignored
7
8
pkgname=siyuan-b3log-appimage
9
pkgver=3.7.3
10
pkgrel=1
11
pkgdesc="auto upload to AUR when SiYuan stable release"
12
arch=("x86_64")
13
url="https://b3log.org/siyuan"
14
license=("AGPL-3.0-only")
15
options=("!strip" "!debug")
16
depends=("fuse2")
17
optdepends=('pandoc: docx export')
18
source=("https://release.liuyun.io/siyuan/siyuan-${pkgver}-linux.AppImage")
19
sha256sums=('SKIP')
20
21
_pkgname=siyuan-${pkgver}-linux.AppImage
22
noextract=("${_pkgname}")
23
24
prepare() {
25
chmod +x "${_pkgname}"
26
./"${_pkgname}" --appimage-extract > /dev/null
27
}
28
29
build() {
30
_desktop_file=$(find squashfs-root -maxdepth 1 -name "*.desktop" -print -quit)
31
# Adjust .desktop so it will work outside of AppImage container
32
sed -i \
33
-e "s|Exec=AppRun|Exec=/opt/${pkgname}/${pkgname}.AppImage|" \
34
-e "s+^Icon=.*+Icon=siyuan-bin+" \
35
"${_desktop_file}"
36
37
# Fix permissions; .AppImage permissions are 700 for all directories
38
chmod -R a-x+rX squashfs-root/usr
39
}
40
41
package() {
42
_desktop_file=$(find squashfs-root -maxdepth 1 -name "*.desktop" -print -quit)
43
# AppImage
44
install -Dm755 "${srcdir}/${_pkgname}" "${pkgdir}/opt/${pkgname}/${pkgname}.AppImage"
45
install -Dm644 "${srcdir}/squashfs-root/LICENSE" "${pkgdir}/opt/${pkgname}/LICENSE"
46
47
# Desktop file
48
install -Dm644 "${srcdir}/${_desktop_file}" \
49
"${pkgdir}/usr/share/applications/siyuan.desktop"
50
51
# Icon images
52
install -Dm644 "squashfs-root/resources/stage/icon.png" \
53
"${pkgdir}/usr/share/icons/hicolor/512x512/apps/siyuan-bin.png"
54
55
# Symlink executable
56
install -dm755 "${pkgdir}/usr/bin"
57
ln -s "/opt/${pkgname}/${pkgname}.AppImage" "${pkgdir}/usr/bin/siyuan"
58
59
# Symlink license
60
install -dm755 "${pkgdir}/usr/share/licenses/${pkgname}/"
61
ln -s "/opt/${pkgname}/LICENSE" "${pkgdir}/usr/share/licenses/${pkgname}"
62
}
63
Changes since previous scan
--- PKGBUILD @ 2026-07-21 00:24+++ PKGBUILD @ 2026-08-03 00:08@@ -6,7 +6,7 @@ # for change request, PLEASE MAKE A PR ON GITHUB REPO, keep commenting here would be ignored pkgname=siyuan-b3log-appimage-pkgver=3.7.2+pkgver=3.7.3 pkgrel=1 pkgdesc="auto upload to AUR when SiYuan stable release" arch=("x86_64")Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-08-03 00:08:14 | MEDIUM | 2 |
| 2026-08-02 00:16:08 | MEDIUM | 2 |
| 2026-08-01 00:11:18 | MEDIUM | 2 |
| 2026-07-31 00:14:10 | MEDIUM | 2 |
| 2026-07-30 00:17:23 | MEDIUM | 2 |
| 2026-07-29 00:25:53 | MEDIUM | 3 |
| 2026-07-28 00:07:28 | MEDIUM | 3 |
| 2026-07-27 00:24:32 | MEDIUM | 3 |
| 2026-07-26 00:07:32 | MEDIUM | 3 |
| 2026-07-25 00:13:44 | MEDIUM | 3 |
| 2026-07-24 00:02:28 | MEDIUM | 3 |
| 2026-07-23 00:14:47 | MEDIUM | 3 |
| 2026-07-22 00:29:32 | MEDIUM | 3 |
| 2026-07-21 07:16:26 | MEDIUM | 3 |
| 2026-07-21 00:24:15 | MEDIUM | 3 |
| 2026-07-20 00:19:49 | MEDIUM | 3 |
| 2026-07-19 00:17:08 | MEDIUM | 3 |
| 2026-07-18 00:14:48 | MEDIUM | 3 |
| 2026-07-17 00:06:16 | MEDIUM | 3 |
| 2026-07-16 00:05:41 | MEDIUM | 3 |