twos

MEDIUM

maintainer heyeddi 0 votes base twos-appimage scanned 2026-11-01 10:00:05.946014

View on AUR

Why flagged

The package downloads a prebuilt AppImage from the project's official domain, but AppImages are unverifiable binaries; if the host were compromised, the payload could be silently swapped, posing a supply-chain risk.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:13 "https://www.twosapp.com/api/desktop/updates/Twos-${pkgver}.AppImage"

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt AppImage from the project's official domain, but AppImages are unverifiable binaries; if the host were compromised, the payload could be silently swapped, posing a supply-chain risk.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Edmundo Sanchez <zomundo at gmail dot com>
    
      2pkgname=twos
    
      3pkgbase=twos-appimage
    
      4pkgver=1.21.3
    
      5pkgrel=2
    
      6epoch=1
    
      7pkgdesc='A simple and beautiful way to capture your thoughts, organize your life, and get things done.'
    
      8arch=('x86_64')
    
      9url='https://twosapp.com/'
    
      10license=('unset')
    
      11depends=('gtk3' 'libxss' 'libindicator-gtk2' 'nss' 'dbus-glib' 'libdbusmenu-gtk2')
    
      12source=(
    
      13    "https://www.twosapp.com/api/desktop/updates/Twos-${pkgver}.AppImage"
    
      14)
    
      15sha256sums=('a973d53d5807ce45700bb0b20cdcb0dfae0de6cb9baf2ebd8dbd675e867eecc2')
    
      16
    
      17prepare() {
    
      18    chmod u+x ./Twos-${pkgver}.AppImage
    
      19    ./Twos-${pkgver}.AppImage --appimage-extract
    
      20}
    
      21
    
      22package() {
    
      23    install -dm755 "${pkgdir}/usr/lib"
    
      24    install -dm755 "${pkgdir}/usr/share"
    
      25    install -dm755 "${pkgdir}/usr/bin"
    
      26    install -dm755 "${pkgdir}/usr/share/applications"
    
      27
    
      28    cp -a "${srcdir}/squashfs-root" "${pkgdir}/usr/lib/${pkgname}"
    
      29    find "${pkgdir}/usr/lib/${pkgname}" -type d -exec chmod 755 "{}" \;
    
      30
    
      31    cp -a "${srcdir}/squashfs-root/usr/share/icons" "${pkgdir}/usr/share"
    
      32    chmod -R 755 "${pkgdir}/usr/share/icons"
    
      33
    
      34    # Upstream binary/desktop renamed to newtwos; keep Arch package name "twos".
    
      35    sed -i -e 's|^Exec=.*|Exec=twos|' -e 's|^Icon=.*|Icon=newtwos|' \
    
      36        "${pkgdir}/usr/lib/${pkgname}/newtwos.desktop"
    
      37    ln -sf "/usr/lib/${pkgname}/newtwos.desktop" "${pkgdir}/usr/share/applications/${pkgname}.desktop"
    
      38    ln -sf "/usr/lib/${pkgname}/newtwos" "${pkgdir}/usr/bin/${pkgname}"
    
      39}
    
      40

Changes since previous scan

--- PKGBUILD @ 2026-11-01 00:21
+++ PKGBUILD @ 2026-11-01 10:00
@@ -1,8 +1,9 @@
 # Maintainer: Edmundo Sanchez <zomundo at gmail dot com>
 pkgname=twos
 pkgbase=twos-appimage
-pkgver=1.20.6
-pkgrel=1
+pkgver=1.21.3
+pkgrel=2
+epoch=1
 pkgdesc='A simple and beautiful way to capture your thoughts, organize your life, and get things done.'
 arch=('x86_64')
 url='https://twosapp.com/'
@@ -11,7 +12,7 @@
 source=(
     "https://www.twosapp.com/api/desktop/updates/Twos-${pkgver}.AppImage"
 )
-sha256sums=('f1b4d02ad93dde3577d735f4324e9d178c34a84caff80120436fa56748aa5bdd')
+sha256sums=('a973d53d5807ce45700bb0b20cdcb0dfae0de6cb9baf2ebd8dbd675e867eecc2')
 
 prepare() {
     chmod u+x ./Twos-${pkgver}.AppImage

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 10:00:05	Medium	2
2026-11-01 00:21:48	Medium	2
2026-10-31 00:07:41	Medium	2
2026-10-30 00:29:30	Medium	2
2026-10-29 00:13:55	Medium	2
2026-10-28 00:06:54	Medium	2
2026-10-27 00:23:28	Medium	2
2026-10-26 05:43:49	Medium	2
2026-10-26 00:12:40	Medium	2
2026-10-25 00:20:48	Medium	2
2026-10-24 00:14:55	Medium	2
2026-10-23 00:02:19	Medium	2
2026-10-22 00:13:10	Medium	2
2026-10-21 00:12:50	Medium	2
2026-10-20 00:10:31	Medium	2
2026-10-19 00:03:55	Medium	2
2026-10-18 00:06:55	Medium	2
2026-10-17 00:21:55	Medium	2
2026-10-16 00:12:47	Medium	2
2026-10-15 00:28:05	Medium	2