velaterm-bin

maintainer structwafel · 0 votes · scanned 2026-08-18 00:03:42.021799

LOW

Why flagged Downloads a prebuilt AppImage from dl.velaterm.com (the project's own domain) with a hardcoded SHA-256 checksum and minisign signature verification before execution; the binary is extracted and only the inner velaterm binary is installed against system libraries, which is a reasonable repackaging approach with meaningful integrity checks, though the host is not a major forge and the package is new/low-vote.

Triggered rules

LOW Few votes, recently uploaded zero_votes_recent

Uploaded within the last 14 days with 2 or fewer community votes — little peer review so far.

LOW AI review downgraded a static finding llm_review

The static rules flagged this MEDIUM, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it LOW (confidence 72%): Downloads a prebuilt AppImage from dl.velaterm.com (the project's own domain) with a hardcoded SHA-256 checksum and minisign signature verification before execution; the binary is extracted and only the inner velaterm binary is installed against system libraries, which is a reasonable repackaging approach with meaningful integrity checks, though the host is not a major forge and the package is new/low-vote.

1 higher static finding superseded - not the current verdict (shown for transparency)

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:49 "VelaTerm-${pkgver}.AppImage::https://dl.velaterm.com/${pkgver}/VelaTerm_${pkgver}_amd64.AppImage"

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: structwafel <luca.giannini@visma.com>
    
      2
    
      3# Repackages the upstream AppImage rather than shipping it whole.
    
      4#
    
      5# The AppImage bundles 177 Debian libraries (239 MB), including its own webkit2gtk/gtk3, and its
    
      6# AppRun exports GDK_BACKEND=x11 plus GTK_PATH, XDG_DATA_DIRS and GIO_EXTRA_MODULES. VelaTerm is a
    
      7# terminal multiplexer, so that environment reaches every shell and agent it spawns; upstream
    
      8# 425d4b7 scrubs the leak into children, but the app itself is still pinned to XWayland.
    
      9#
    
      10# We install only usr/bin/velaterm and drop the bundle entirely. The binary's RUNPATH is
    
      11# $ORIGIN/../lib, so from /usr/bin that resolves to /usr/lib -- Arch's own libraries. All 143
    
      12# linked libs resolve against the system, giving native Wayland (verified under sway: 3 wayland
    
      13# fds, 0 X11 fds, reported as app_id rather than an XWayland class) and system webkit2gtk-4.1,
    
      14# which also provides WebKitGPUProcess, absent from the bundle. The WebKitGTK-on-Wayland crash
    
      15# that made upstream force x11 (tauri-apps/tauri#8541) does not reproduce against webkit2gtk 2.52.
    
      16#
    
      17# No wrapper script is used on purpose: setting GDK_BACKEND ourselves would recreate exactly the
    
      18# environment inheritance the upstream fix was written to prevent. GTK detects Wayland on its own.
    
      19
    
      20pkgname=velaterm-bin
    
      21pkgver=0.1.101
    
      22pkgrel=1
    
      23pkgdesc='Terminal and AI-agent session manager with a project/group/session tree and remote browser access'
    
      24arch=('x86_64')
    
      25url='https://velaterm.com'
    
      26license=('MIT')
    
      27depends=(
    
      28  'webkit2gtk-4.1'
    
      29  'gtk3'
    
      30  'libsoup3'
    
      31  'sqlite'
    
      32  'gst-plugins-base-libs'
    
      33  'hicolor-icon-theme'
    
      34)
    
      35optdepends=(
    
      36  'libayatana-appindicator: system tray icon'
    
      37  'git: repository status and worktree-isolated child sessions'
    
      38  'openssh: running sessions on a remote host'
    
      39  'tailscale: reaching remote access over a tailnet'
    
      40)
    
      41makedepends=('minisign')
    
      42provides=('velaterm')
    
      43conflicts=('velaterm')
    
      44options=('!strip')
    
      45install="${pkgname}.install"
    
      46
    
      47_commit=c099cc248df5fc351eae90cd617e7f23685245f6
    
      48source=(
    
      49  "VelaTerm-${pkgver}.AppImage::https://dl.velaterm.com/${pkgver}/VelaTerm_${pkgver}_amd64.AppImage"
    
      50  "LICENSE-${pkgver}::https://raw.githubusercontent.com/vlinx-io/VelaTerm/${_commit}/LICENSE"
    
      51  'velaterm.minisign.pub'
    
      52  'velaterm.AppImage.minisig'
    
      53)
    
      54noextract=("VelaTerm-${pkgver}.AppImage")
    
      55sha256sums=(
    
      56  '6d2ca953bdbb137772328a567c45d90f3faa00c3c35795267b2b1dc83909bff6'
    
      57  'f6812bc2666e6447164bb133b38cdc35693761f55158f053167f7c1c7b853693'
    
      58  'SKIP'
    
      59  'SKIP'
    
      60)
    
      61
    
      62prepare() {
    
      63  cd "$srcdir"
    
      64
    
      65  # Upstream ships no CI and no reproducible build, so the signature is the only provenance we get.
    
      66  # Verify it before touching the artifact: the key is the one committed to tauri.conf.json, and it
    
      67  # is the same key that signs the vela-server binary pushed to remote hosts over SSH.
    
      68  msg2 'Verifying upstream minisign signature...'
    
      69  minisign -V -p velaterm.minisign.pub \
    
      70           -x velaterm.AppImage.minisig \
    
      71           -m "VelaTerm-${pkgver}.AppImage"
    
      72
    
      73  chmod +x "VelaTerm-${pkgver}.AppImage"
    
      74  rm -rf squashfs-root
    
      75  "./VelaTerm-${pkgver}.AppImage" --appimage-extract >/dev/null
    
      76}
    
      77
    
      78package() {
    
      79  cd "$srcdir/squashfs-root"
    
      80
    
      81  install -Dm755 usr/bin/velaterm "$pkgdir/usr/bin/velaterm"
    
      82  install -Dm644 usr/share/applications/VelaTerm.desktop \
    
      83                 "$pkgdir/usr/share/applications/velaterm.desktop"
    
      84
    
      85  for _size in 32x32 128x128 256x256@2; do
    
      86    install -Dm644 "usr/share/icons/hicolor/${_size}/apps/velaterm.png" \
    
      87                   "$pkgdir/usr/share/icons/hicolor/${_size}/apps/velaterm.png"
    
      88  done
    
      89
    
      90  install -Dm644 "$srcdir/LICENSE-${pkgver}" "$pkgdir/usr/share/licenses/${pkgname}/LICENSE"
    
      91
    
      92  # The upstream entry has an empty Categories= line, which desktop-file-validate rejects.
    
      93  sed -i 's/^Categories=$/Categories=Development;System;TerminalEmulator;/' \
    
      94    "$pkgdir/usr/share/applications/velaterm.desktop"
    
      95}
    
      96

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	LOW	3
2026-08-17 09:37:11	LOW	3
2026-08-17 09:35:23	MEDIUM	2