teamwork-timer

maintainer c-reeder · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt AppImage binary from an S3 bucket (s3.amazonaws.com/tw-open/timer/) and installs it as an executable. While S3 is a legitimate hosting platform, this is not the official Teamwork download page or a verified vendor CDN endpoint — it's a personal/company S3 bucket with no chain of trust beyond the sha256sum provided in the PKGBUILD. The sha256sum is present and provides some integrity guarantee, but S3 buckets can be silently replaced if the bucket owner changes the object, and there is no GPG signature verification. The AppImage is extracted and executed during prepare() and then installed as a system binary. This is a genuine supply-chain concern: a prebuilt, unverifiable binary from an unofficial host that gets executed on the build system and installed system-wide. The 'unknown' license is also a concern but not a security issue. This is a legitimate medium-severity rating.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 "https://s3.amazonaws.com/tw-open/timer/${_appimage}"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt AppImage binary from an S3 bucket (s3.amazonaws.com/tw-open/timer/) and installs it as an executable. While S3 is a legitimate hosting platform, this is not the official Teamwork download page or a verified vendor CDN endpoint — it's a personal/company S3 bucket with no chain of trust beyond the sha256sum provided in the PKGBUILD. The sha256sum is present and provides some integrity guarantee, but S3 buckets can be silently replaced if the bucket owner changes the object, and there is no GPG signature verification. The AppImage is extracted and executed during prepare() and then installed as a system binary. This is a genuine supply-chain concern: a prebuilt, unverifiable binary from an unofficial host that gets executed on the build system and installed system-wide. The 'unknown' license is also a concern but not a security issue. This is a legitimate medium-severity rating.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Connor Reeder <connor dot reeder at ymail dot com>
    
      2
    
      3pkgname='teamwork-timer'
    
      4pkgver=2.1.1
    
      5pkgrel=1
    
      6pkgdesc='Timer app - the perfect complement to Teamwork.'
    
      7arch=('x86_64')
    
      8url='https://www.teamwork.com/'
    
      9license=('unknown')
    
      10depends=('fuse2' 'zlib' 'hicolor-icon-theme')
    
      11options=(!strip)
    
      12_shortname='teamworktimer'
    
      13_appimage="Teamwork+Timer-${pkgver}.AppImage"
    
      14source=(
    
      15		"https://s3.amazonaws.com/tw-open/timer/${_appimage}"
    
      16)
    
      17sha256sums=(
    
      18		'ae9a04a2394117ad9daa212b83efe17b5189b8c4e15346467296ffcb8aba0f59'
    
      19)
    
      20
    
      21prepare() {
    
      22    chmod +x ${_appimage}
    
      23    ./${_appimage} --appimage-extract
    
      24}
    
      25
    
      26package() {
    
      27    cd "$srcdir"
    
      28
    
      29    # Create Directories
    
      30    install -d "${pkgdir}/usr/bin"
    
      31    install -dm755 "${pkgdir}/usr/share/icons/hicolor"
    
      32
    
      33    # Install AppImage
    
      34    install -Dm755 "${_appimage}" -t "${pkgdir}/opt/${_shortname}"
    
      35
    
      36    # Install Icons, Desktop Shortcut
    
      37    find squashfs-root -type d -exec chmod 0755 {} \;
    
      38    cp -r squashfs-root/usr/share/icons/hicolor "${pkgdir}/usr/share/icons/"
    
      39    sed -i -E "s|Exec=AppRun %U|Exec=/usr/bin/${_shortname}|" "squashfs-root/${_shortname}.desktop"
    
      40    install -Dm644 "squashfs-root/${_shortname}.desktop" -t "${pkgdir}/usr/share/applications/"
    
      41
    
      42    # Symlink AppImage
    
      43    ln -s "/opt/${_shortname}/${_appimage}" "${pkgdir}/usr/bin/${_shortname}"
    
      44}
    
      45
    
      46

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2