tangent-bin

MEDIUM

maintainer tomaszc 0 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The package downloads a prebuilt AppImage from an S3 bucket on a non-standard host, which is an unverifiable executable source that could be silently swapped, posing a supply-chain risk.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source=("$_pkgname-$pkgver.AppImage::https://suchnsuch-public.s3.us-east-2.amazonaws.com/${_pkgname^}/Releases/${_pkgname^}-${pkgver}.AppImage"

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt AppImage from an S3 bucket on a non-standard host, which is an unverifiable executable source that could be silently swapped, posing a supply-chain risk.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Tomasz Cebula <tomasz.cebula@gmail.com>
    
      2
    
      3pkgname=tangent-bin
    
      4_pkgname=${pkgname%-bin}
    
      5pkgver=0.12.10
    
      6pkgrel=1
    
      7pkgdesc="Open source markdown note-taking app with linked notes and visual map"
    
      8arch=('x86_64')
    
      9url="https://www.tangentnotes.com"
    
      10license=('Apache-2.0')
    
      11_electron=electron42
    
      12depends=("$_electron")
    
      13provides=('tangent')
    
      14conflicts=('tangent' 'tangent-dev-bin')
    
      15source=("$_pkgname-$pkgver.AppImage::https://suchnsuch-public.s3.us-east-2.amazonaws.com/${_pkgname^}/Releases/${_pkgname^}-${pkgver}.AppImage"
    
      16        "tangent.desktop")
    
      17noextract=("$_pkgname-$pkgver.AppImage")
    
      18sha256sums=('29166e0bf0a97dd5b96653e81cc046b4c99a0ac0fd2e0f4a1b99f804f85b3165'
    
      19            '7bd7e95acdf937c38adaf0456b60e07d501f8235499d13c872f89238fde7bd72')
    
      20
    
      21prepare() {
    
      22    cd "$srcdir"
    
      23
    
      24    # Set execution permissions for AppImage
    
      25    chmod +x "$_pkgname-$pkgver.AppImage"
    
      26
    
      27    # Extract AppImage contents
    
      28    ./"$_pkgname-$pkgver.AppImage" --appimage-extract
    
      29
    
      30    # Check if resources directory exists
    
      31    if [[ ! -d "squashfs-root/resources" ]]; then
    
      32        echo "Error: resources directory not found!"
    
      33        exit 1
    
      34    fi
    
      35}
    
      36
    
      37package() {
    
      38    cd "$srcdir/squashfs-root"
    
      39
    
      40    # Create target directories with proper permissions
    
      41    install -dm755 "$pkgdir/usr/lib/$_pkgname"
    
      42    install -dm755 "$pkgdir/usr/bin"
    
      43    install -dm755 "$pkgdir/usr/share/applications"
    
      44    install -dm755 "$pkgdir/usr/share/pixmaps"
    
      45
    
      46    # Copy resources directory with proper permissions
    
      47    cp -r resources "$pkgdir/usr/lib/$_pkgname/"
    
      48
    
      49    # Set proper permissions for all files and directories
    
      50    find "$pkgdir/usr/lib/$_pkgname" -type d -exec chmod 755 {} \;
    
      51    find "$pkgdir/usr/lib/$_pkgname" -type f -exec chmod 644 {} \;
    
      52
    
      53    # Copy application icon
    
      54    if [[ -f "tangent_electron.png" ]]; then
    
      55        install -Dm644 "tangent_electron.png" "$pkgdir/usr/share/pixmaps/$_pkgname.png"
    
      56    fi
    
      57
    
      58    # Copy icons in different sizes
    
      59    for size in 16 32 48 64 128 256 512; do
    
      60        if [[ -f "usr/share/icons/hicolor/${size}x${size}/apps/tangent_electron.png" ]]; then
    
      61            install -Dm644 "usr/share/icons/hicolor/${size}x${size}/apps/tangent_electron.png" \
    
      62                "$pkgdir/usr/share/icons/hicolor/${size}x${size}/apps/$_pkgname.png"
    
      63        fi
    
      64    done
    
      65
    
      66    # Create wrapper script
    
      67    install -Dm755 /dev/stdin "$pkgdir/usr/bin/$_pkgname" << EOF
    
      68#!/bin/bash
    
      69exec "$_electron" /usr/lib/$_pkgname/resources/app.asar "\$@"
    
      70EOF
    
      71
    
      72    # Install desktop file
    
      73    install -Dm644 "$srcdir/$_pkgname.desktop" "$pkgdir/usr/share/applications/$_pkgname.desktop"
    
      74}
    
      75

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Medium	2
2026-10-31 00:07:41	Medium	2
2026-10-30 00:29:30	Medium	2
2026-10-29 00:13:55	Medium	2
2026-10-28 00:06:54	Medium	2
2026-10-27 00:23:28	Medium	2
2026-10-26 00:12:40	Medium	2
2026-10-25 00:20:48	Medium	2
2026-10-24 00:14:55	Medium	2
2026-10-23 00:02:19	Medium	2
2026-10-22 00:13:10	Medium	2
2026-10-21 00:12:50	Medium	2
2026-10-20 00:10:31	Medium	2
2026-10-19 00:03:55	Medium	2
2026-10-18 00:06:55	Medium	2
2026-10-17 00:21:55	Medium	2
2026-10-16 00:12:47	Medium	2
2026-10-15 00:28:05	Medium	2
2026-10-14 00:06:47	Medium	2
2026-10-13 00:23:45	Medium	2