stao-bin
MEDIUM
maintainer serrghi
0 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The package downloads a prebuilt AppImage from a non-whitelisted host (downloads.stao.app), which is an unverifiable executable that could be silently swapped by an unrelated party, constituting a supply-chain risk.
Triggered rules
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:32
source=("${_appimage_name}::https://downloads.stao.app/releases/v${_basever}/${_appimage_name}" -
PKGBUILD:33
"terms-of-service.html::https://www.stao.app/terms")
Medium
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt AppImage from a non-whitelisted host (downloads.stao.app), which is an unverifiable executable that could be silently swapped by an unrelated party, constituting a supply-chain risk.
PKGBUILD
2 offending line(s) highlighted
1
# Maintainer: Stao App <support@stao.app>
2
pkgname=stao-bin
3
# pkgver uses underscore instead of plus (AUR requirement)
4
# e.g., 1.2.0+5 becomes 1.2.0_5
5
pkgver=1.6.0_17
6
pkgrel=1
7
pkgdesc="Standing desk reminder app - track your standing and sitting time"
8
arch=('x86_64')
9
url="https://stao.app"
10
license=('custom')
11
depends=(
12
'gtk3'
13
'gstreamer'
14
'gst-plugins-base'
15
'gst-plugins-good'
16
'libayatana-appindicator'
17
)
18
optdepends=(
19
'libnotify: for desktop notifications'
20
)
21
provides=('stao')
22
conflicts=('stao')
23
options=('!strip')
24
25
# Version components:
26
# _basever: version without build number (used in R2 folder path)
27
# _fullver: version with build number using + (used in filename)
28
_basever="${pkgver%_*}"
29
_fullver="${pkgver/_/+}"
30
_appimage_name="stao-${_fullver}-linux.AppImage"
31
32
source=("${_appimage_name}::https://downloads.stao.app/releases/v${_basever}/${_appimage_name}"
33
"terms-of-service.html::https://www.stao.app/terms")
34
sha256sums=('40b4239e98ba328cf393406f8af1a8596258e72a41d983f8f509930dd7293c98'
35
'SKIP')
36
37
package() {
38
cd "${srcdir}"
39
40
# Make AppImage executable and extract it
41
chmod +x "${_appimage_name}"
42
"./${_appimage_name}" --appimage-extract
43
44
# Install to /opt/stao
45
install -dm755 "${pkgdir}/opt/stao"
46
cp -r squashfs-root/* "${pkgdir}/opt/stao/"
47
48
# Fix permissions
49
chmod 755 "${pkgdir}/opt/stao/stao"
50
find "${pkgdir}/opt/stao" -type d -exec chmod 755 {} \;
51
find "${pkgdir}/opt/stao" -type f -name "*.so*" -exec chmod 755 {} \;
52
53
# Create launcher script
54
install -dm755 "${pkgdir}/usr/bin"
55
cat > "${pkgdir}/usr/bin/stao" << 'EOF'
56
#!/bin/bash
57
exec /opt/stao/stao "$@"
58
EOF
59
chmod 755 "${pkgdir}/usr/bin/stao"
60
61
# Install desktop file
62
install -Dm644 "${pkgdir}/opt/stao/stao.desktop" \
63
"${pkgdir}/usr/share/applications/stao.desktop"
64
65
# Fix desktop file paths
66
sed -i 's|Exec=.*|Exec=/usr/bin/stao|' \
67
"${pkgdir}/usr/share/applications/stao.desktop"
68
sed -i 's|Icon=.*|Icon=stao|' \
69
"${pkgdir}/usr/share/applications/stao.desktop"
70
71
# Install icons
72
for size in 16 32 48 64 128 256 512; do
73
if [ -f "${pkgdir}/opt/stao/data/flutter_assets/assets/icons/app_icon.png" ]; then
74
install -Dm644 "${pkgdir}/opt/stao/data/flutter_assets/assets/icons/app_icon.png" \
75
"${pkgdir}/usr/share/icons/hicolor/${size}x${size}/apps/stao.png"
76
fi
77
done
78
79
# Also check for icon in standard AppImage location
80
if [ -f "${pkgdir}/opt/stao/stao.png" ]; then
81
for size in 16 32 48 64 128 256 512; do
82
install -Dm644 "${pkgdir}/opt/stao/stao.png" \
83
"${pkgdir}/usr/share/icons/hicolor/${size}x${size}/apps/stao.png"
84
done
85
fi
86
87
# Install license/terms of service
88
install -Dm644 "${srcdir}/terms-of-service.html" \
89
"${pkgdir}/usr/share/licenses/${pkgname}/terms-of-service.html"
90
}
91
Changes since previous scan
--- PKGBUILD @ 2026-10-15 00:28+++ PKGBUILD @ 2026-11-01 00:21@@ -2,7 +2,7 @@ pkgname=stao-bin # pkgver uses underscore instead of plus (AUR requirement) # e.g., 1.2.0+5 becomes 1.2.0_5-pkgver=1.5.4_15+pkgver=1.6.0_17 pkgrel=1 pkgdesc="Standing desk reminder app - track your standing and sitting time" arch=('x86_64')@@ -31,7 +31,7 @@ source=("${_appimage_name}::https://downloads.stao.app/releases/v${_basever}/${_appimage_name}" "terms-of-service.html::https://www.stao.app/terms")-sha256sums=('3f5978bdccde93668e57d2a7aa5ca8c84c206bcf3fbb79f8c8e0ed32ae2dfa6a'+sha256sums=('40b4239e98ba328cf393406f8af1a8596258e72a41d983f8f509930dd7293c98' 'SKIP') package() {Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Medium | 2 |
| 2026-10-31 00:07:41 | Medium | 2 |
| 2026-10-30 00:29:30 | Medium | 2 |
| 2026-10-29 00:13:55 | Medium | 2 |
| 2026-10-28 00:06:54 | Medium | 2 |
| 2026-10-27 00:23:28 | Medium | 2 |
| 2026-10-26 00:12:40 | Medium | 2 |
| 2026-10-25 00:20:48 | Medium | 2 |
| 2026-10-24 00:14:55 | Medium | 2 |
| 2026-10-23 00:02:19 | Medium | 2 |
| 2026-10-22 00:13:10 | Medium | 2 |
| 2026-10-21 00:12:50 | Medium | 2 |
| 2026-10-20 00:10:31 | Medium | 2 |
| 2026-10-19 00:03:55 | Medium | 2 |
| 2026-10-18 00:06:55 | Medium | 2 |
| 2026-10-17 00:21:55 | Medium | 2 |
| 2026-10-16 00:12:47 | Medium | 2 |
| 2026-10-15 19:13:05 | Medium | 2 |
| 2026-10-15 00:28:05 | Low | 2 |
| 2026-10-14 00:06:47 | Low | 2 |