slapdash

maintainer hayao · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt AppImage binary directly from https://slapdash.com/download/linux (the official vendor domain) and executes it during build to extract its contents, which are then installed system-wide. The core concern is the use of 'SKIP' for the AppImage checksum: the download URL is a redirect/alias that always serves the 'latest' binary rather than a pinned versioned artifact, meaning the actual binary fetched is not reproducibly tied to pkgver=1.8.1 and cannot be integrity-verified. This means any silent update or compromise of the vendor's download endpoint would result in arbitrary code execution on the user's system with no checksum protection. While the host is the official vendor domain (not a personal/unofficial host), the combination of an executed binary + SKIP checksum + non-versioned URL constitutes a genuine supply-chain risk. Additionally, the symlink in package() uses an absolute pkgdir path as the link target rather than a relative or proper install path, making the package functionally broken at runtime, but the security concern stands independently.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 "slapdash.AppImage::https://slapdash.com/download/linux"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 82%): The PKGBUILD downloads a prebuilt AppImage binary directly from https://slapdash.com/download/linux (the official vendor domain) and executes it during build to extract its contents, which are then installed system-wide. The core concern is the use of 'SKIP' for the AppImage checksum: the download URL is a redirect/alias that always serves the 'latest' binary rather than a pinned versioned artifact, meaning the actual binary fetched is not reproducibly tied to pkgver=1.8.1 and cannot be integrity-verified. This means any silent update or compromise of the vendor's download endpoint would result in arbitrary code execution on the user's system with no checksum protection. While the host is the official vendor domain (not a personal/unofficial host), the combination of an executed binary + SKIP checksum + non-versioned URL constitutes a genuine supply-chain risk. Additionally, the symlink in package() uses an absolute pkgdir path as the link target rather than a relative or proper install path, making the package functionally broken at runtime, but the security concern stands independently.

PKGBUILD

1 offending line(s) highlighted

      1# Maintaoner: Yamada Hayao <development@fascode.net>
    
      2
    
      3pkgname=slapdash
    
      4pkgver="1.8.1"
    
      5pkgrel=2
    
      6pkgdesc="a tool that can manage various web services for free in one place"
    
      7arch=('x86_64')
    
      8url="https://slapdash.com/"
    
      9license=('custom')
    
      10depends=()
    
      11makedepends=()
    
      12source=(
    
      13    "slapdash.AppImage::https://slapdash.com/download/linux"
    
      14    "slapdash.svg"
    
      15    "slapdash.desktop"
    
      16)
    
      17md5sums=(
    
      18    # sladash.AppImage
    
      19    'SKIP'
    
      20
    
      21    # slapdash.svg
    
      22    "cf5766dd1f919a9d0f27de208b90bef3"
    
      23
    
      24    # slapdash.desktop
    
      25    "3fd5cc784a22af15d83a3ad1af1b1c8f"
    
      26)
    
      27
    
      28build(){
    
      29    chmod 755 "${srcdir}/slapdash.AppImage"
    
      30    "${srcdir}/slapdash.AppImage" --appimage-extract
    
      31}
    
      32
    
      33package() {
    
      34    mkdir -p "${pkgdir}/opt/slapdash/" "${pkgdir}/usr/bin"
    
      35    cp -r "${srcdir}/squashfs-root/"* "${pkgdir}/opt/slapdash/"
    
      36    ln -s "${pkgdir}/opt/slapdash/AppRun" "/usr/bin/slapdash"
    
      37    install -m 755 -D "${srcdir}/slapdash.svg" "${pkgdir}/usr/share/pixmaps/slapdash.svg"
    
      38    install -m 755 -D "${srcdir}/slapdash.desktop" "${pkgdir}/usr/share/applications/slapdash.desktop"
    
      39}
    
      40

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2