truple-latest-bin

maintainer DanielNak · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads a prebuilt AppImage binary from linux.truple.io (the project's own Linux distribution subdomain) and executes it during both pkgver() and build() phases. The concerns are: (1) sha256sums='SKIP' means there is no integrity verification — the binary could be silently replaced or served differently to different users; (2) the source URL points to a 'latest' path (prod/Truple.AppImage) with no version pinning in the URL itself, meaning the downloaded binary may not correspond to pkgver=1.10.4; (3) the AppImage is executed at build time to extract itself. While linux.truple.io appears to be the official vendor distribution host for this proprietary accountability/screenshot software, the combination of an executed binary with SKIP checksums and a floating 'latest' URL constitutes a genuine supply-chain risk — any compromise of that host or DNS hijack would result in arbitrary code execution on the builder's machine with no integrity check to catch it. This is a real medium-severity concern, not a false positive.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:20 "$_filename"::"https://linux.truple.io/prod/Truple.AppImage"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads a prebuilt AppImage binary from linux.truple.io (the project's own Linux distribution subdomain) and executes it during both pkgver() and build() phases. The concerns are: (1) sha256sums='SKIP' means there is no integrity verification — the binary could be silently replaced or served differently to different users; (2) the source URL points to a 'latest' path (prod/Truple.AppImage) with no version pinning in the URL itself, meaning the downloaded binary may not correspond to pkgver=1.10.4; (3) the AppImage is executed at build time to extract itself. While linux.truple.io appears to be the official vendor distribution host for this proprietary accountability/screenshot software, the combination of an executed binary with SKIP checksums and a floating 'latest' URL constitutes a genuine supply-chain risk — any compromise of that host or DNS hijack would result in arbitrary code execution on the builder's machine with no integrity check to catch it. This is a real medium-severity concern, not a false positive.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: DanielNak <daniel@tee.cat>
    
      2
    
      3_filename=Truple.AppImage
    
      4_pkgname='truple'
    
      5pkgname="$_pkgname-latest-bin"
    
      6pkgver=1.10.4
    
      7pkgrel=1
    
      8pkgdesc="Truple Screenshot Accountability holds you accountable for how you use your Linux machine by randomly capturing and sharing screenshots with a trusted friend or loved one of your choosing."
    
      9arch=('x86_64')
    
      10url="https://truple.io/"
    
      11license=('custom')
    
      12depends=(
    
      13  'hicolor-icon-theme'
    
      14)
    
      15makedepends=()
    
      16provides=("$_pkgname")
    
      17conflicts=("$_pkgname")
    
      18options=('!strip')
    
      19source=(
    
      20  "$_filename"::"https://linux.truple.io/prod/Truple.AppImage"
    
      21)
    
      22sha256sums=(
    
      23  'SKIP'
    
      24)
    
      25
    
      26pkgver() {
    
      27  cd "$srcdir"
    
      28
    
      29  # extract appimage
    
      30  chmod +x "$_filename"
    
      31  "$srcdir/$_filename" --appimage-extract truple.desktop > /dev/null
    
      32
    
      33  cat squashfs-root/truple.desktop | grep Version | cut -d= -f2
    
      34}
    
      35
    
      36build() {
    
      37  cd "$srcdir"
    
      38
    
      39  # extract appimage
    
      40  chmod +x "$_filename"
    
      41  "$srcdir/$_filename" --appimage-extract
    
      42
    
      43  # fix folder permissions
    
      44  find "$srcdir/squashfs-root" -type d -exec chmod 755 {} \;
    
      45
    
      46  # fix apprun script
    
      47  sed -Ei \
    
      48    's@^(if \[ -z \"\$APPDIR\" ] ; then)$@APPDIR="/opt/truple"\n\1@' \
    
      49    "$srcdir/squashfs-root/AppRun"
    
      50
    
      51  # fix desktop file
    
      52  sed -Ei \
    
      53    's@^Exec=AppRun (.*)$@Exec=truple \1@' \
    
      54    "$srcdir/squashfs-root/truple.desktop"
    
      55}
    
      56
    
      57package() {
    
      58  # apprun script
    
      59  install -vDm0755 "$srcdir/squashfs-root/AppRun" "$pkgdir/usr/bin/truple"
    
      60
    
      61  # desktop file
    
      62  install -vDm0644 "$srcdir/squashfs-root/truple.desktop" "$pkgdir/usr/share/applications/truple.desktop"
    
      63
    
      64  # icons
    
      65  install -vDm0644 "$srcdir/squashfs-root/usr/share/icons/hicolor/0x0/apps/truple.png" -t "$pkgdir/usr/share/icons/hicolor/512x512/apps"
    
      66
    
      67  # license files
    
      68  install -vDm0644 "$srcdir/squashfs-root/LICENSE.electron.txt" -t "$pkgdir/usr/share/licenses/$_pkgname"
    
      69  install -vDm0644 "$srcdir/squashfs-root/LICENSES.chromium.html" -t "$pkgdir/usr/share/licenses/$_pkgname"
    
      70
    
      71  # everything else
    
      72  mkdir -p "$pkgdir/opt"
    
      73  mv "$srcdir/squashfs-root" "$pkgdir/opt/truple"
    
      74}
    
      75

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2