tangent-bin

MEDIUM

maintainer tomaszc 0 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The package downloads a prebuilt AppImage from an S3 bucket on a non-standard host, which is an unverifiable executable source that could be silently swapped, posing a supply-chain risk.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source=("$_pkgname-$pkgver.AppImage::https://suchnsuch-public.s3.us-east-2.amazonaws.com/${_pkgname^}/Releases/${_pkgname^}-${pkgver}.AppImage"

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt AppImage from an S3 bucket on a non-standard host, which is an unverifiable executable source that could be silently swapped, posing a supply-chain risk.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Tomasz Cebula <tomasz.cebula@gmail.com>
    
      2
    
      3pkgname=tangent-bin
    
      4_pkgname=${pkgname%-bin}
    
      5pkgver=0.12.10
    
      6pkgrel=1
    
      7pkgdesc="Open source markdown note-taking app with linked notes and visual map"
    
      8arch=('x86_64')
    
      9url="https://www.tangentnotes.com"
    
      10license=('Apache-2.0')
    
      11_electron=electron42
    
      12depends=("$_electron")
    
      13provides=('tangent')
    
      14conflicts=('tangent' 'tangent-dev-bin')
    
      15source=("$_pkgname-$pkgver.AppImage::https://suchnsuch-public.s3.us-east-2.amazonaws.com/${_pkgname^}/Releases/${_pkgname^}-${pkgver}.AppImage"
    
      16        "tangent.desktop")
    
      17noextract=("$_pkgname-$pkgver.AppImage")
    
      18sha256sums=('29166e0bf0a97dd5b96653e81cc046b4c99a0ac0fd2e0f4a1b99f804f85b3165'
    
      19            '7bd7e95acdf937c38adaf0456b60e07d501f8235499d13c872f89238fde7bd72')
    
      20
    
      21prepare() {
    
      22    cd "$srcdir"
    
      23
    
      24    # Set execution permissions for AppImage
    
      25    chmod +x "$_pkgname-$pkgver.AppImage"
    
      26
    
      27    # Extract AppImage contents
    
      28    ./"$_pkgname-$pkgver.AppImage" --appimage-extract
    
      29
    
      30    # Check if resources directory exists
    
      31    if [[ ! -d "squashfs-root/resources" ]]; then
    
      32        echo "Error: resources directory not found!"
    
      33        exit 1
    
      34    fi
    
      35}
    
      36
    
      37package() {
    
      38    cd "$srcdir/squashfs-root"
    
      39
    
      40    # Create target directories with proper permissions
    
      41    install -dm755 "$pkgdir/usr/lib/$_pkgname"
    
      42    install -dm755 "$pkgdir/usr/bin"
    
      43    install -dm755 "$pkgdir/usr/share/applications"
    
      44    install -dm755 "$pkgdir/usr/share/pixmaps"
    
      45
    
      46    # Copy resources directory with proper permissions
    
      47    cp -r resources "$pkgdir/usr/lib/$_pkgname/"
    
      48
    
      49    # Set proper permissions for all files and directories
    
      50    find "$pkgdir/usr/lib/$_pkgname" -type d -exec chmod 755 {} \;
    
      51    find "$pkgdir/usr/lib/$_pkgname" -type f -exec chmod 644 {} \;
    
      52
    
      53    # Copy application icon
    
      54    if [[ -f "tangent_electron.png" ]]; then
    
      55        install -Dm644 "tangent_electron.png" "$pkgdir/usr/share/pixmaps/$_pkgname.png"
    
      56    fi
    
      57
    
      58    # Copy icons in different sizes
    
      59    for size in 16 32 48 64 128 256 512; do
    
      60        if [[ -f "usr/share/icons/hicolor/${size}x${size}/apps/tangent_electron.png" ]]; then
    
      61            install -Dm644 "usr/share/icons/hicolor/${size}x${size}/apps/tangent_electron.png" \
    
      62                "$pkgdir/usr/share/icons/hicolor/${size}x${size}/apps/$_pkgname.png"
    
      63        fi
    
      64    done
    
      65
    
      66    # Create wrapper script
    
      67    install -Dm755 /dev/stdin "$pkgdir/usr/bin/$_pkgname" << EOF
    
      68#!/bin/bash
    
      69exec "$_electron" /usr/lib/$_pkgname/resources/app.asar "\$@"
    
      70EOF
    
      71
    
      72    # Install desktop file
    
      73    install -Dm644 "$srcdir/$_pkgname.desktop" "$pkgdir/usr/share/applications/$_pkgname.desktop"
    
      74}
    
      75

Changes since previous scan

--- PKGBUILD @ 2026-08-31 00:19
+++ PKGBUILD @ 2026-09-17 00:27
@@ -2,7 +2,7 @@
 
 pkgname=tangent-bin
 _pkgname=${pkgname%-bin}
-pkgver=0.12.9
+pkgver=0.12.10
 pkgrel=1
 pkgdesc="Open source markdown note-taking app with linked notes and visual map"
 arch=('x86_64')
@@ -15,7 +15,7 @@
 source=("$_pkgname-$pkgver.AppImage::https://suchnsuch-public.s3.us-east-2.amazonaws.com/${_pkgname^}/Releases/${_pkgname^}-${pkgver}.AppImage"
         "tangent.desktop")
 noextract=("$_pkgname-$pkgver.AppImage")
-sha256sums=('8ae807bb66136d14b69dcf10e9c7810a4a61ecf15a99354b0d04a824e65390a5'
+sha256sums=('29166e0bf0a97dd5b96653e81cc046b4c99a0ac0fd2e0f4a1b99f804f85b3165'
             '7bd7e95acdf937c38adaf0456b60e07d501f8235499d13c872f89238fde7bd72')
 
 prepare() {

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 00:15:47	Medium	2
2026-09-02 00:02:31	Medium	2
2026-09-01 00:11:19	Medium	2
2026-08-31 19:46:16	Medium	2
2026-08-31 00:19:57	Medium	2
2026-08-30 00:04:14	Medium	2