stao-bin

maintainer serrghi · 0 votes · scanned 2026-08-03 00:08:14.047287

LOW

Why flagged The package downloads a prebuilt AppImage and a terms-of-service file from the project's official domain; while the host is not on a standard whitelist, it is the legitimate project domain, and the AppImage is a common format for distributing desktop apps on Linux.

Triggered rules

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (qwen/qwen3-235b-a22b-07-25) reviewed the full PKGBUILD and judged it LOW (confidence 95%): The package downloads a prebuilt AppImage and a terms-of-service file from the project's official domain; while the host is not on a standard whitelist, it is the legitimate project domain, and the AppImage is a common format for distributing desktop apps on Linux.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:32 source=("${_appimage_name}::https://downloads.stao.app/releases/v${_basever}/${_appimage_name}"
PKGBUILD:33 "terms-of-service.html::https://www.stao.app/terms")

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: Stao App <support@stao.app>
    
      2pkgname=stao-bin
    
      3# pkgver uses underscore instead of plus (AUR requirement)
    
      4# e.g., 1.2.0+5 becomes 1.2.0_5
    
      5pkgver=1.5.0_10
    
      6pkgrel=1
    
      7pkgdesc="Standing desk reminder app - track your standing and sitting time"
    
      8arch=('x86_64')
    
      9url="https://stao.app"
    
      10license=('custom')
    
      11depends=(
    
      12    'gtk3'
    
      13    'gstreamer'
    
      14    'gst-plugins-base'
    
      15    'gst-plugins-good'
    
      16    'libayatana-appindicator'
    
      17)
    
      18optdepends=(
    
      19    'libnotify: for desktop notifications'
    
      20)
    
      21provides=('stao')
    
      22conflicts=('stao')
    
      23options=('!strip')
    
      24
    
      25# Version components:
    
      26# _basever: version without build number (used in R2 folder path)
    
      27# _fullver: version with build number using + (used in filename)
    
      28_basever="${pkgver%_*}"
    
      29_fullver="${pkgver/_/+}"
    
      30_appimage_name="stao-${_fullver}-linux.AppImage"
    
      31
    
      32source=("${_appimage_name}::https://downloads.stao.app/releases/v${_basever}/${_appimage_name}"
    
      33        "terms-of-service.html::https://www.stao.app/terms")
    
      34sha256sums=('0878360569efb839271aabb4b4fab65dd177793ffed5377d6d2ff5e2ad46fbda'
    
      35            'SKIP')
    
      36
    
      37package() {
    
      38    cd "${srcdir}"
    
      39
    
      40    # Make AppImage executable and extract it
    
      41    chmod +x "${_appimage_name}"
    
      42    "./${_appimage_name}" --appimage-extract
    
      43
    
      44    # Install to /opt/stao
    
      45    install -dm755 "${pkgdir}/opt/stao"
    
      46    cp -r squashfs-root/* "${pkgdir}/opt/stao/"
    
      47
    
      48    # Fix permissions
    
      49    chmod 755 "${pkgdir}/opt/stao/stao"
    
      50    find "${pkgdir}/opt/stao" -type d -exec chmod 755 {} \;
    
      51    find "${pkgdir}/opt/stao" -type f -name "*.so*" -exec chmod 755 {} \;
    
      52
    
      53    # Create launcher script
    
      54    install -dm755 "${pkgdir}/usr/bin"
    
      55    cat > "${pkgdir}/usr/bin/stao" << 'EOF'
    
      56#!/bin/bash
    
      57exec /opt/stao/stao "$@"
    
      58EOF
    
      59    chmod 755 "${pkgdir}/usr/bin/stao"
    
      60
    
      61    # Install desktop file
    
      62    install -Dm644 "${pkgdir}/opt/stao/stao.desktop" \
    
      63        "${pkgdir}/usr/share/applications/stao.desktop"
    
      64
    
      65    # Fix desktop file paths
    
      66    sed -i 's|Exec=.*|Exec=/usr/bin/stao|' \
    
      67        "${pkgdir}/usr/share/applications/stao.desktop"
    
      68    sed -i 's|Icon=.*|Icon=stao|' \
    
      69        "${pkgdir}/usr/share/applications/stao.desktop"
    
      70
    
      71    # Install icons
    
      72    for size in 16 32 48 64 128 256 512; do
    
      73        if [ -f "${pkgdir}/opt/stao/data/flutter_assets/assets/icons/app_icon.png" ]; then
    
      74            install -Dm644 "${pkgdir}/opt/stao/data/flutter_assets/assets/icons/app_icon.png" \
    
      75                "${pkgdir}/usr/share/icons/hicolor/${size}x${size}/apps/stao.png"
    
      76        fi
    
      77    done
    
      78
    
      79    # Also check for icon in standard AppImage location
    
      80    if [ -f "${pkgdir}/opt/stao/stao.png" ]; then
    
      81        for size in 16 32 48 64 128 256 512; do
    
      82            install -Dm644 "${pkgdir}/opt/stao/stao.png" \
    
      83                "${pkgdir}/usr/share/icons/hicolor/${size}x${size}/apps/stao.png"
    
      84        done
    
      85    fi
    
      86
    
      87    # Install license/terms of service
    
      88    install -Dm644 "${srcdir}/terms-of-service.html" \
    
      89        "${pkgdir}/usr/share/licenses/${pkgname}/terms-of-service.html"
    
      90}
    
      91

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	LOW	2
2026-08-02 00:16:08	LOW	2
2026-08-01 00:11:18	LOW	2
2026-07-31 00:14:10	LOW	2
2026-07-30 00:17:23	LOW	2
2026-07-29 00:25:53	LOW	2
2026-07-28 00:07:28	LOW	2
2026-07-27 00:24:32	LOW	2
2026-07-26 00:07:32	LOW	2
2026-07-25 00:13:44	LOW	2
2026-07-24 00:02:28	LOW	2
2026-07-23 00:14:47	LOW	2
2026-07-22 00:29:32	LOW	2
2026-07-21 00:24:15	LOW	2
2026-07-20 00:19:49	LOW	2
2026-07-19 00:17:08	LOW	2
2026-07-18 00:14:48	LOW	2
2026-07-17 00:06:16	LOW	2
2026-07-16 00:05:41	LOW	2
2026-07-15 00:09:25	LOW	2