tangent-dev-bin

maintainer tomaszc · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt AppImage from an S3 bucket (suchnsuch-public.s3.us-east-2.amazonaws.com) that is controlled by the upstream developer ('Such n Such' is the developer of Tangent Notes). This is a non-standard distribution host rather than GitHub releases or a well-known CDN, but it appears to be the official upstream release channel used by the Tangent Notes project. The AppImage is executed during build (chmod +x then --appimage-extract), and its contents (specifically the app.asar) are installed and run via electron. A sha256sum is provided, which mitigates silent substitution risk but does not eliminate the concern about the trustworthiness of the host itself. The pattern is consistent with a small indie developer self-hosting releases on S3, which is legitimate but does represent a real supply-chain concern: if the S3 bucket is compromised or misconfigured, a malicious AppImage could be served. This is a genuine medium-risk pattern — an executed binary from a personal/unofficial host with a checksum but no additional verification (e.g., GPG signature).

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source=("$_pkgname-$pkgver.AppImage::https://suchnsuch-public.s3.us-east-2.amazonaws.com/${_pkgname^}/Releases/${_pkgname^}-${_pkgver}.AppImage"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt AppImage from an S3 bucket (suchnsuch-public.s3.us-east-2.amazonaws.com) that is controlled by the upstream developer ('Such n Such' is the developer of Tangent Notes). This is a non-standard distribution host rather than GitHub releases or a well-known CDN, but it appears to be the official upstream release channel used by the Tangent Notes project. The AppImage is executed during build (chmod +x then --appimage-extract), and its contents (specifically the app.asar) are installed and run via electron. A sha256sum is provided, which mitigates silent substitution risk but does not eliminate the concern about the trustworthiness of the host itself. The pattern is consistent with a small indie developer self-hosting releases on S3, which is legitimate but does represent a real supply-chain concern: if the S3 bucket is compromised or misconfigured, a malicious AppImage could be served. This is a genuine medium-risk pattern — an executed binary from a personal/unofficial host with a checksum but no additional verification (e.g., GPG signature).

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Tomasz Cebula <tomasz.cebula@gmail.com>
    
      2
    
      3pkgname=tangent-dev-bin
    
      4_pkgname=${pkgname%-dev-bin}
    
      5_pkgver=0.12.2-beta.3
    
      6pkgver=${_pkgver/-/}
    
      7pkgrel=1
    
      8pkgdesc="Open source markdown note-taking app with linked notes and visual map"
    
      9arch=('x86_64')
    
      10url="https://www.tangentnotes.com"
    
      11license=('Apache-2.0')
    
      12_electron=electron42
    
      13depends=("$_electron")
    
      14provides=('tangent')
    
      15conflicts=('tangent' 'tangent-bin')
    
      16source=("$_pkgname-$pkgver.AppImage::https://suchnsuch-public.s3.us-east-2.amazonaws.com/${_pkgname^}/Releases/${_pkgname^}-${_pkgver}.AppImage"
    
      17        "tangent.desktop")
    
      18noextract=("$_pkgname-$pkgver.AppImage")
    
      19sha256sums=('7140bf0e08cb370508428dcc9e57eff88c30948e6b790bdb0daf17f72b7a2b83'
    
      20            '7bd7e95acdf937c38adaf0456b60e07d501f8235499d13c872f89238fde7bd72')
    
      21
    
      22prepare() {
    
      23    cd "$srcdir"
    
      24
    
      25    # Set execution permissions for AppImage
    
      26    chmod +x "$_pkgname-$pkgver.AppImage"
    
      27
    
      28    # Extract AppImage contents
    
      29    ./"$_pkgname-$pkgver.AppImage" --appimage-extract
    
      30
    
      31    # Check if resources directory exists
    
      32    if [[ ! -d "squashfs-root/resources" ]]; then
    
      33        echo "Error: resources directory not found!"
    
      34        exit 1
    
      35    fi
    
      36}
    
      37
    
      38package() {
    
      39    cd "$srcdir/squashfs-root"
    
      40
    
      41    # Create target directories with proper permissions
    
      42    install -dm755 "$pkgdir/usr/lib/$_pkgname"
    
      43    install -dm755 "$pkgdir/usr/bin"
    
      44    install -dm755 "$pkgdir/usr/share/applications"
    
      45    install -dm755 "$pkgdir/usr/share/pixmaps"
    
      46
    
      47    # Copy resources directory with proper permissions
    
      48    cp -r resources "$pkgdir/usr/lib/$_pkgname/"
    
      49
    
      50    # Set proper permissions for all files and directories
    
      51    find "$pkgdir/usr/lib/$_pkgname" -type d -exec chmod 755 {} \;
    
      52    find "$pkgdir/usr/lib/$_pkgname" -type f -exec chmod 644 {} \;
    
      53
    
      54    # Copy application icon
    
      55    if [[ -f "tangent_electron.png" ]]; then
    
      56        install -Dm644 "tangent_electron.png" "$pkgdir/usr/share/pixmaps/$_pkgname.png"
    
      57    fi
    
      58
    
      59    # Copy icons in different sizes
    
      60    for size in 16 32 48 64 128 256 512; do
    
      61        if [[ -f "usr/share/icons/hicolor/${size}x${size}/apps/tangent_electron.png" ]]; then
    
      62            install -Dm644 "usr/share/icons/hicolor/${size}x${size}/apps/tangent_electron.png" \
    
      63                "$pkgdir/usr/share/icons/hicolor/${size}x${size}/apps/$_pkgname.png"
    
      64        fi
    
      65    done
    
      66
    
      67    # Create wrapper script
    
      68    install -Dm755 /dev/stdin "$pkgdir/usr/bin/$_pkgname" << EOF
    
      69#!/bin/bash
    
      70exec "$_electron" /usr/lib/$_pkgname/resources/app.asar "\$@"
    
      71EOF
    
      72
    
      73    # Install desktop file
    
      74    install -Dm644 "$srcdir/$_pkgname.desktop" "$pkgdir/usr/share/applications/$_pkgname.desktop"
    
      75}
    
      76

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2