tangent-bin

maintainer tomaszc · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged Downloads a prebuilt AppImage from an AWS S3 bucket not directly associated with the project's official domain, creating a supply-chain risk if the source were compromised.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source=("$_pkgname-$pkgver.AppImage::https://suchnsuch-public.s3.us-east-2.amazonaws.com/${_pkgname^}/Releases/${_pkgname^}-${pkgver}.AppImage"

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): Downloads a prebuilt AppImage from an AWS S3 bucket not directly associated with the project's official domain, creating a supply-chain risk if the source were compromised.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Tomasz Cebula <tomasz.cebula@gmail.com>
    
      2
    
      3pkgname=tangent-bin
    
      4_pkgname=${pkgname%-bin}
    
      5pkgver=0.12.3
    
      6pkgrel=1
    
      7pkgdesc="Open source markdown note-taking app with linked notes and visual map"
    
      8arch=('x86_64')
    
      9url="https://www.tangentnotes.com"
    
      10license=('Apache-2.0')
    
      11_electron=electron42
    
      12depends=("$_electron")
    
      13provides=('tangent')
    
      14conflicts=('tangent' 'tangent-dev-bin')
    
      15source=("$_pkgname-$pkgver.AppImage::https://suchnsuch-public.s3.us-east-2.amazonaws.com/${_pkgname^}/Releases/${_pkgname^}-${pkgver}.AppImage"
    
      16        "tangent.desktop")
    
      17noextract=("$_pkgname-$pkgver.AppImage")
    
      18sha256sums=('6b792d535e6aaef2f4fa22496c762e24861fec3a04d7427a9d4f874bd78068dd'
    
      19            '7bd7e95acdf937c38adaf0456b60e07d501f8235499d13c872f89238fde7bd72')
    
      20
    
      21prepare() {
    
      22    cd "$srcdir"
    
      23
    
      24    # Set execution permissions for AppImage
    
      25    chmod +x "$_pkgname-$pkgver.AppImage"
    
      26
    
      27    # Extract AppImage contents
    
      28    ./"$_pkgname-$pkgver.AppImage" --appimage-extract
    
      29
    
      30    # Check if resources directory exists
    
      31    if [[ ! -d "squashfs-root/resources" ]]; then
    
      32        echo "Error: resources directory not found!"
    
      33        exit 1
    
      34    fi
    
      35}
    
      36
    
      37package() {
    
      38    cd "$srcdir/squashfs-root"
    
      39
    
      40    # Create target directories with proper permissions
    
      41    install -dm755 "$pkgdir/usr/lib/$_pkgname"
    
      42    install -dm755 "$pkgdir/usr/bin"
    
      43    install -dm755 "$pkgdir/usr/share/applications"
    
      44    install -dm755 "$pkgdir/usr/share/pixmaps"
    
      45
    
      46    # Copy resources directory with proper permissions
    
      47    cp -r resources "$pkgdir/usr/lib/$_pkgname/"
    
      48
    
      49    # Set proper permissions for all files and directories
    
      50    find "$pkgdir/usr/lib/$_pkgname" -type d -exec chmod 755 {} \;
    
      51    find "$pkgdir/usr/lib/$_pkgname" -type f -exec chmod 644 {} \;
    
      52
    
      53    # Copy application icon
    
      54    if [[ -f "tangent_electron.png" ]]; then
    
      55        install -Dm644 "tangent_electron.png" "$pkgdir/usr/share/pixmaps/$_pkgname.png"
    
      56    fi
    
      57
    
      58    # Copy icons in different sizes
    
      59    for size in 16 32 48 64 128 256 512; do
    
      60        if [[ -f "usr/share/icons/hicolor/${size}x${size}/apps/tangent_electron.png" ]]; then
    
      61            install -Dm644 "usr/share/icons/hicolor/${size}x${size}/apps/tangent_electron.png" \
    
      62                "$pkgdir/usr/share/icons/hicolor/${size}x${size}/apps/$_pkgname.png"
    
      63        fi
    
      64    done
    
      65
    
      66    # Create wrapper script
    
      67    install -Dm755 /dev/stdin "$pkgdir/usr/bin/$_pkgname" << EOF
    
      68#!/bin/bash
    
      69exec "$_electron" /usr/lib/$_pkgname/resources/app.asar "\$@"
    
      70EOF
    
      71
    
      72    # Install desktop file
    
      73    install -Dm644 "$srcdir/$_pkgname.desktop" "$pkgdir/usr/share/applications/$_pkgname.desktop"
    
      74}
    
      75

Changes since previous scan

--- PKGBUILD @ 2026-07-28 00:07
+++ PKGBUILD @ 2026-08-03 00:08
@@ -2,7 +2,7 @@
 
 pkgname=tangent-bin
 _pkgname=${pkgname%-bin}
-pkgver=0.12.2
+pkgver=0.12.3
 pkgrel=1
 pkgdesc="Open source markdown note-taking app with linked notes and visual map"
 arch=('x86_64')
@@ -15,7 +15,7 @@
 source=("$_pkgname-$pkgver.AppImage::https://suchnsuch-public.s3.us-east-2.amazonaws.com/${_pkgname^}/Releases/${_pkgname^}-${pkgver}.AppImage"
         "tangent.desktop")
 noextract=("$_pkgname-$pkgver.AppImage")
-sha256sums=('b3013e549cbac5e7829816efad341b8a98b55ceb60da2fdbcdf52b079fcc8afe'
+sha256sums=('6b792d535e6aaef2f4fa22496c762e24861fec3a04d7427a9d4f874bd78068dd'
             '7bd7e95acdf937c38adaf0456b60e07d501f8235499d13c872f89238fde7bd72')
 
 prepare() {

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 17:39:33	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2