tangent-dev-bin
The PKGBUILD downloads a prebuilt AppImage from an S3 bucket (suchnsuch-public.s3.us-east-2.amazonaws.com) that is controlled by the upstream developer ('Such n Such' is the developer of Tangent Notes). This is a non-standard distribution host rather than GitHub releases or a well-known CDN, but it appears to be the official upstream release channel used by the Tangent Notes project. The AppImage is executed during build (chmod +x then --appimage-extract), and its contents (specifically the app.asar) are installed and run via electron. A sha256sum is provided, which mitigates silent substitution risk but does not eliminate the concern about the trustworthiness of the host itself. The pattern is consistent with a small indie developer self-hosting releases on S3, which is legitimate but does represent a real supply-chain concern: if the S3 bucket is compromised or misconfigured, a malicious AppImage could be served. This is a genuine medium-risk pattern — an executed binary from a personal/unofficial host with a checksum but no additional verification (e.g., GPG signature).
Triggered rules
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:16
source=("$_pkgname-$pkgver.AppImage::https://suchnsuch-public.s3.us-east-2.amazonaws.com/${_pkgname^}/Releases/${_pkgname^}-${_pkgver}.AppImage"
llm_review
An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt AppImage from an S3 bucket (suchnsuch-public.s3.us-east-2.amazonaws.com) that is controlled by the upstream developer ('Such n Such' is the developer of Tangent Notes). This is a non-standard distribution host rather than GitHub releases or a well-known CDN, but it appears to be the official upstream release channel used by the Tangent Notes project. The AppImage is executed during build (chmod +x then --appimage-extract), and its contents (specifically the app.asar) are installed and run via electron. A sha256sum is provided, which mitigates silent substitution risk but does not eliminate the concern about the trustworthiness of the host itself. The pattern is consistent with a small indie developer self-hosting releases on S3, which is legitimate but does represent a real supply-chain concern: if the S3 bucket is compromised or misconfigured, a malicious AppImage could be served. This is a genuine medium-risk pattern — an executed binary from a personal/unofficial host with a checksum but no additional verification (e.g., GPG signature).
PKGBUILD
1 offending line(s) highlighted# Maintainer: Tomasz Cebula <tomasz.cebula@gmail.com>
pkgname=tangent-dev-bin
_pkgname=${pkgname%-dev-bin}
_pkgver=0.12.2-beta.3
pkgver=${_pkgver/-/}
pkgrel=1
pkgdesc="Open source markdown note-taking app with linked notes and visual map"
arch=('x86_64')
url="https://www.tangentnotes.com"
license=('Apache-2.0')
_electron=electron42
depends=("$_electron")
provides=('tangent')
conflicts=('tangent' 'tangent-bin')
source=("$_pkgname-$pkgver.AppImage::https://suchnsuch-public.s3.us-east-2.amazonaws.com/${_pkgname^}/Releases/${_pkgname^}-${_pkgver}.AppImage"
"tangent.desktop")
noextract=("$_pkgname-$pkgver.AppImage")
sha256sums=('7140bf0e08cb370508428dcc9e57eff88c30948e6b790bdb0daf17f72b7a2b83'
'7bd7e95acdf937c38adaf0456b60e07d501f8235499d13c872f89238fde7bd72')
prepare() {
cd "$srcdir"
# Set execution permissions for AppImage
chmod +x "$_pkgname-$pkgver.AppImage"
# Extract AppImage contents
./"$_pkgname-$pkgver.AppImage" --appimage-extract
# Check if resources directory exists
if [[ ! -d "squashfs-root/resources" ]]; then
echo "Error: resources directory not found!"
exit 1
fi
}
package() {
cd "$srcdir/squashfs-root"
# Create target directories with proper permissions
install -dm755 "$pkgdir/usr/lib/$_pkgname"
install -dm755 "$pkgdir/usr/bin"
install -dm755 "$pkgdir/usr/share/applications"
install -dm755 "$pkgdir/usr/share/pixmaps"
# Copy resources directory with proper permissions
cp -r resources "$pkgdir/usr/lib/$_pkgname/"
# Set proper permissions for all files and directories
find "$pkgdir/usr/lib/$_pkgname" -type d -exec chmod 755 {} \;
find "$pkgdir/usr/lib/$_pkgname" -type f -exec chmod 644 {} \;
# Copy application icon
if [[ -f "tangent_electron.png" ]]; then
install -Dm644 "tangent_electron.png" "$pkgdir/usr/share/pixmaps/$_pkgname.png"
fi
# Copy icons in different sizes
for size in 16 32 48 64 128 256 512; do
if [[ -f "usr/share/icons/hicolor/${size}x${size}/apps/tangent_electron.png" ]]; then
install -Dm644 "usr/share/icons/hicolor/${size}x${size}/apps/tangent_electron.png" \
"$pkgdir/usr/share/icons/hicolor/${size}x${size}/apps/$_pkgname.png"
fi
done
# Create wrapper script
install -Dm755 /dev/stdin "$pkgdir/usr/bin/$_pkgname" << EOF
#!/bin/bash
exec "$_electron" /usr/lib/$_pkgname/resources/app.asar "\$@"
EOF
# Install desktop file
install -Dm644 "$srcdir/$_pkgname.desktop" "$pkgdir/usr/share/applications/$_pkgname.desktop"
}
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Medium | 2 |
| 2026-09-16 00:03:17 | Medium | 2 |
| 2026-09-15 00:25:31 | Medium | 2 |
| 2026-09-14 00:27:57 | Medium | 2 |
| 2026-09-13 00:19:54 | Medium | 2 |
| 2026-09-12 00:25:17 | Medium | 2 |
| 2026-09-11 00:19:22 | Medium | 2 |
| 2026-09-10 00:22:44 | Medium | 2 |
| 2026-09-09 00:04:09 | Medium | 2 |
| 2026-09-08 00:18:08 | Medium | 2 |
| 2026-09-07 00:30:15 | Medium | 2 |
| 2026-09-06 00:17:06 | Medium | 2 |
| 2026-09-05 00:16:27 | Medium | 2 |
| 2026-09-04 00:03:13 | Medium | 2 |
| 2026-09-03 00:15:47 | Medium | 2 |
| 2026-09-02 00:02:31 | Medium | 2 |
| 2026-09-01 00:11:19 | Medium | 2 |
| 2026-08-31 00:19:57 | Medium | 2 |
| 2026-08-30 00:04:14 | Medium | 2 |
| 2026-08-29 00:29:17 | Medium | 2 |