todoist-appimage
MEDIUM
maintainer rafaelco
31 votes
scanned 2026-11-01 00:21:48.120785
Why flagged
The package downloads a prebuilt AppImage from a non-standard host (electron-dl.todoist.net), which is not a common code hosting platform, creating a supply-chain risk if the host were compromised or spoofed, though it is plausibly an official source for the application.
Triggered rules
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:18
source_x86_64=("${_appimage}::https://electron-dl.todoist.net/linux/Todoist-linux-${pkgver}-x86_64-latest.AppImage")
Medium
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt AppImage from a non-standard host (electron-dl.todoist.net), which is not a common code hosting platform, creating a supply-chain risk if the host were compromised or spoofed, though it is plausibly an official source for the application.
PKGBUILD
1 offending line(s) highlighted
1
# Based on the template from https://daveparrish.net/posts/2019-11-16-Better-AppImage-PKGBUILD-template.html
2
# Maintainer : Sergey Kostrukov <sergey at kostrukov dot com>
3
# Contributor : Tianrui Wei <archlinux_aur at mail dot tianrui-wei dot com>
4
# Contributor : Marcio Silva <marcionps at gmail dot com>
5
6
_pkgname=todoist
7
8
pkgname="${_pkgname}"-appimage
9
pkgver=9.35.0
10
pkgrel=1
11
pkgdesc="The to-do list to organize work & life."
12
arch=('x86_64')
13
url="https://todoist.com/"
14
license=('custom:Commercial')
15
depends=('zlib' 'fuse2' 'appimagelauncher')
16
options=('!strip' '!debug')
17
_appimage="${pkgname}-${pkgver}.AppImage"
18
source_x86_64=("${_appimage}::https://electron-dl.todoist.net/linux/Todoist-linux-${pkgver}-x86_64-latest.AppImage")
19
noextract=("${_appimage}")
20
sha256sums_x86_64=('acfa6b165dd7c52c675157c149f71e2b5a8180ef5d0e0bd045601f2b010ae4c7')
21
22
prepare() {
23
chmod +x "${_appimage}"
24
./"${_appimage}" --appimage-extract
25
}
26
27
build() {
28
local _desktop="squashfs-root/${_pkgname}.desktop"
29
30
# Adjust .desktop so it will work outside of AppImage container.
31
# Upstream's Exec already ends in "--no-sandbox %U", so the replacement must
32
# not add a field code of its own: the spec allows at most one per Exec line
33
# and GLib (uwsm, gio launch) rejects the entry outright when there are two.
34
sed -i -E "s|^Exec=AppRun|Exec=env DESKTOPINTEGRATION=false /usr/bin/${_pkgname}|" "${_desktop}"
35
36
# Same environment for the desktop action, and an absolute path instead of $PATH
37
sed -i -E "s|^Exec=${_pkgname} |Exec=env DESKTOPINTEGRATION=false /usr/bin/${_pkgname} |" "${_desktop}"
38
39
# Upstream ships a [Desktop Action new-window] group without declaring it
40
grep -q '^Actions=' "${_desktop}" || \
41
sed -i -E "/^\[Desktop Entry\]/a Actions=new-window;" "${_desktop}"
42
43
# Upstream lists image/jpeg twice
44
sed -i -E "s|image/jpeg;image/jpeg;|image/jpeg;|" "${_desktop}"
45
46
# Guard: fail the build if the main Exec ever ends up with >1 field code again
47
local _codes
48
_codes=$(grep -m1 '^Exec=env' "${_desktop}" | grep -o -- '%[fFuU]' | wc -l)
49
if (( _codes > 1 )); then
50
echo "error: Exec line has ${_codes} field codes, expected at most 1" >&2
51
return 1
52
fi
53
54
# Fix permissions; .AppImage permissions are 700 for all directories
55
chmod -R a-x+rX squashfs-root/usr
56
}
57
58
package() {
59
# AppImage
60
install -Dm755 "${srcdir}/${_appimage}" "${pkgdir}/opt/${pkgname}/${pkgname}.AppImage"
61
62
# Desktop file
63
install -Dm644 "${srcdir}/squashfs-root/${_pkgname}.desktop" \
64
"${pkgdir}/usr/share/applications/${_pkgname}.desktop"
65
66
# Icon
67
install -dm755 "${pkgdir}/usr/share/"
68
cp -a "${srcdir}/squashfs-root/usr/share/icons" "${pkgdir}/usr/share/"
69
mkdir -p "${pkgdir}/usr/share/pixmaps/"
70
install -Dm644 "${srcdir}/squashfs-root/usr/share/icons/hicolor/512x512/apps/todoist.png" "${pkgdir}/usr/share/pixmaps"
71
72
# Symlink executable
73
install -dm755 "${pkgdir}/usr/bin"
74
ln -s "/opt/${pkgname}/${pkgname}.AppImage" "${pkgdir}/usr/bin/${_pkgname}"
75
}
76
Changes since previous scan
--- PKGBUILD @ 2026-10-29 00:13+++ PKGBUILD @ 2026-11-01 00:21@@ -6,7 +6,7 @@ _pkgname=todoist pkgname="${_pkgname}"-appimage-pkgver=9.31.0+pkgver=9.35.0 pkgrel=1 pkgdesc="The to-do list to organize work & life." arch=('x86_64')@@ -17,7 +17,7 @@ _appimage="${pkgname}-${pkgver}.AppImage" source_x86_64=("${_appimage}::https://electron-dl.todoist.net/linux/Todoist-linux-${pkgver}-x86_64-latest.AppImage") noextract=("${_appimage}")-sha256sums_x86_64=('b034347736cc40a918cc05806fa87fbd5c774e406d349c51fafd6c726c07669e')+sha256sums_x86_64=('acfa6b165dd7c52c675157c149f71e2b5a8180ef5d0e0bd045601f2b010ae4c7') prepare() { chmod +x "${_appimage}"Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-11-01 00:21:48 | Medium | 2 |
| 2026-10-31 17:58:44 | Medium | 2 |
| 2026-10-31 00:07:41 | Medium | 2 |
| 2026-10-30 00:29:30 | Medium | 2 |
| 2026-10-29 07:52:02 | Medium | 2 |
| 2026-10-29 00:13:55 | Medium | 2 |
| 2026-10-28 00:06:54 | Medium | 2 |
| 2026-10-27 00:23:28 | Medium | 2 |
| 2026-10-26 05:43:49 | Medium | 2 |
| 2026-10-26 00:12:40 | Low | 2 |
| 2026-10-25 00:20:48 | Low | 2 |
| 2026-10-24 00:14:55 | Low | 2 |
| 2026-10-23 00:02:19 | Low | 2 |
| 2026-10-22 00:13:10 | Low | 2 |
| 2026-10-21 00:12:50 | Low | 2 |
| 2026-10-20 00:10:31 | Low | 2 |
| 2026-10-19 00:03:55 | Low | 2 |
| 2026-10-18 00:06:55 | Low | 2 |
| 2026-10-17 00:21:55 | Low | 2 |
| 2026-10-16 00:12:47 | Low | 2 |