vicinae-appimage-bin

maintainer ArjixWasTaken · 3 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads an AppImage from GitHub's official release API (api.github.com/repos/vicinaehq/vicinae/releases/latest) and verifies its SHA-256 digest against the value embedded in the GitHub release metadata itself. The AppImage is then executed with --appimage-extract (not run as an application) to unpack its squashfs contents for installation. The main concern is that the integrity check is circular: the digest comes from the same GitHub API response that provides the download URL, so a compromised GitHub release could substitute both simultaneously. The source[] array has a fixed sha256sum only for the JSON metadata snapshot and the wrapper shell script, but the actual AppImage binary is fetched dynamically at build time with no hardcoded checksum in the PKGBUILD. This means the installed binary can change between builds without any PKGBUILD update. This is a real supply-chain concern (dynamic binary fetch with no static checksum), but it is a common pattern for AppImage-bin AUR packages and is not clearly malicious. The execution of the AppImage with --appimage-extract is standard AppImage extraction, not arbitrary code execution in the traditional sense. Overall: medium risk due to the dynamic binary fetch with only a self-referential integrity check.

Triggered rules

MEDIUM AI review downgraded a static finding llm_review

The static rules flagged this HIGH, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it MEDIUM (confidence 72%): The PKGBUILD downloads an AppImage from GitHub's official release API (api.github.com/repos/vicinaehq/vicinae/releases/latest) and verifies its SHA-256 digest against the value embedded in the GitHub release metadata itself. The AppImage is then executed with --appimage-extract (not run as an application) to unpack its squashfs contents for installation. The main concern is that the integrity check is circular: the digest comes from the same GitHub API response that provides the download URL, so a compromised GitHub release could substitute both simultaneously. The source[] array has a fixed sha256sum only for the JSON metadata snapshot and the wrapper shell script, but the actual AppImage binary is fetched dynamically at build time with no hardcoded checksum in the PKGBUILD. This means the installed binary can change between builds without any PKGBUILD update. This is a real supply-chain concern (dynamic binary fetch with no static checksum), but it is a common pattern for AppImage-bin AUR packages and is not clearly malicious. The execution of the AppImage with --appimage-extract is standard AppImage extraction, not arbitrary code execution in the traditional sense. Overall: medium risk due to the dynamic binary fetch with only a self-referential integrity check.

1 higher static finding superseded - not the current verdict (shown for transparency)

HIGH Downloaded file is executed download_then_exec

A file fetched with curl/wget (not part of source=(), so never checksum-verified) is later made executable or run — a fetch-and-execute pattern split across statements.

PKGBUILD:40 chmod +x vicinae.Appimage

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Arjix <me@arjix.dev>
    
      2# Maintainer: cilgin <cilgincc@outlook.com>
    
      3
    
      4pkgname=vicinae-appimage-bin
    
      5pkgver=0.24.0
    
      6pkgrel=1
    
      7pkgdesc="Raycast like FOSS app on Linux"
    
      8arch=('x86_64')
    
      9url="https://github.com/vicinaehq/vicinae"
    
      10options=('!debug' '!strip')
    
      11license=('GPL3')
    
      12makedepends=(jq wget)
    
      13provides=("vicinae")
    
      14conflicts=("vicinae")
    
      15
    
      16source=(
    
      17  "github-release.json::https://api.github.com/repos/vicinaehq/vicinae/releases/latest"
    
      18  "vicinae.sh"
    
      19)
    
      20sha256sums=('89690c2db2ad56ab60a18c3e9945b57d19e6c26622c5bef21bd7f239fe524312'
    
      21            '1856a49b51f1b13e8dd466d9c65690292e43d1f876c46210c8ef85c45841d33e')
    
      22
    
      23pkgver() {
    
      24	jq -r '.tag_name | ltrimstr("v")' github-release.json
    
      25}
    
      26
    
      27prepare() {
    
      28    local asset download_url digest
    
      29    asset=$(jq -r '.assets[] | select(.name | endswith(".AppImage"))' github-release.json)
    
      30
    
      31    download_url=$(echo "$asset" | jq -r '.browser_download_url')
    
      32    digest=$(echo "$asset" | jq -r '.digest | split(":")[1]')
    
      33
    
      34    wget -q "$download_url" -O vicinae.Appimage
    
      35    echo "${digest} vicinae.Appimage" | sha256sum -c || {
    
      36		echo "[ERR]: The downloaded file is corrupt."
    
      37    	exit 1
    
      38    }
    
      39
    
      40    chmod +x vicinae.Appimage
    
      41    ./vicinae.Appimage --appimage-extract
    
      42
    
      43}
    
      44
    
      45package() {
    
      46  install -dm755 "${pkgdir}/opt"
    
      47  cp -a "${srcdir}/squashfs-root" "${pkgdir}/opt/vicinae"
    
      48
    
      49  install -Dm755 "${srcdir}/vicinae.sh" "${pkgdir}/usr/bin/vicinae"
    
      50  install -Dm644 "${srcdir}/squashfs-root/vicinae.desktop" "${pkgdir}/usr/share/applications/vicinae.desktop"
    
      51  install -Dm644 "${srcdir}/squashfs-root/vicinae.png" "${pkgdir}/usr/share/icons/hicolor/512x512/apps/vicinae.png"
    
      52  install -Dm644 "${srcdir}/squashfs-root/usr/lib/systemd/user/vicinae.service" "${pkgdir}/usr/lib/systemd/user/vicinae.service"
    
      53
    
      54  cp -a "${srcdir}/squashfs-root/usr/share/" "${pkgdir}/usr/share/"
    
      55}
    
      56

Changes since previous scan

--- PKGBUILD @ 2026-07-27 00:24
+++ PKGBUILD @ 2026-08-03 00:08
@@ -2,7 +2,7 @@
 # Maintainer: cilgin <cilgincc@outlook.com>
 
 pkgname=vicinae-appimage-bin
-pkgver=0.23.2
+pkgver=0.24.0
 pkgrel=1
 pkgdesc="Raycast like FOSS app on Linux"
 arch=('x86_64')

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 19:37:58	MEDIUM	2
2026-07-27 19:35:21	HIGH	1
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 15:59:53	MEDIUM	2
2026-07-18 15:58:03	HIGH	1