vicinae-appimage-bin

MEDIUM

maintainer ArjixWasTaken 3 votes scanned 2026-09-17 00:27:14.276658

View on AUR

Why flagged

The PKGBUILD downloads the latest AppImage from the official GitHub releases API (vicinaehq/vicinae), verifies its SHA-256 digest extracted from the GitHub release metadata, then runs it with --appimage-extract to unpack it rather than execute it as an application. The execution at line 40 is `./vicinae.Appimage --appimage-extract`, which is the standard AppImage self-extraction mechanism (equivalent to unsquashfs) and does not run the application payload. The digest check uses the hash published in the GitHub release JSON itself, which means the integrity check is only as trustworthy as the GitHub API response (no pinned hash in the PKGBUILD), but this is a common pattern for AppImage AUR packages. The main concern is that the AppImage binary is fetched from a dynamic URL resolved at build time and executed (even if only for extraction), and the integrity check relies on the same untrusted source that provides the download URL. This is a medium supply-chain concern (executed binary from a dynamic/unpinned source) rather than a clear malicious attack.

Triggered rules

Medium AI review downgraded a static finding llm_review

The static rules flagged this HIGH, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it MEDIUM (confidence 72%): The PKGBUILD downloads the latest AppImage from the official GitHub releases API (vicinaehq/vicinae), verifies its SHA-256 digest extracted from the GitHub release metadata, then runs it with --appimage-extract to unpack it rather than execute it as an application. The execution at line 40 is `./vicinae.Appimage --appimage-extract`, which is the standard AppImage self-extraction mechanism (equivalent to unsquashfs) and does not run the application payload. The digest check uses the hash published in the GitHub release JSON itself, which means the integrity check is only as trustworthy as the GitHub API response (no pinned hash in the PKGBUILD), but this is a common pattern for AppImage AUR packages. The main concern is that the AppImage binary is fetched from a dynamic URL resolved at build time and executed (even if only for extraction), and the integrity check relies on the same untrusted source that provides the download URL. This is a medium supply-chain concern (executed binary from a dynamic/unpinned source) rather than a clear malicious attack.

1 higher static finding superseded - not the current verdict (shown for transparency)

High Downloaded file is executed download_then_exec

A file fetched with curl/wget (not part of source=(), so never checksum-verified) is later made executable or run — a fetch-and-execute pattern split across statements.

PKGBUILD:40 chmod +x vicinae.Appimage

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Arjix <me@arjix.dev>
    
      2# Maintainer: cilgin <cilgincc@outlook.com>
    
      3
    
      4pkgname=vicinae-appimage-bin
    
      5pkgver=0.28.0
    
      6pkgrel=1
    
      7pkgdesc="Raycast like FOSS app on Linux"
    
      8arch=('x86_64')
    
      9url="https://github.com/vicinaehq/vicinae"
    
      10options=('!debug' '!strip')
    
      11license=('GPL3')
    
      12makedepends=(jq wget)
    
      13provides=("vicinae")
    
      14conflicts=("vicinae")
    
      15
    
      16source=(
    
      17  "github-release.json::https://api.github.com/repos/vicinaehq/vicinae/releases/latest"
    
      18  "vicinae.sh"
    
      19)
    
      20sha256sums=('89690c2db2ad56ab60a18c3e9945b57d19e6c26622c5bef21bd7f239fe524312'
    
      21            '1856a49b51f1b13e8dd466d9c65690292e43d1f876c46210c8ef85c45841d33e')
    
      22
    
      23pkgver() {
    
      24	jq -r '.tag_name | ltrimstr("v")' github-release.json
    
      25}
    
      26
    
      27prepare() {
    
      28    local asset download_url digest
    
      29    asset=$(jq -r '.assets[] | select(.name | endswith(".AppImage"))' github-release.json)
    
      30
    
      31    download_url=$(echo "$asset" | jq -r '.browser_download_url')
    
      32    digest=$(echo "$asset" | jq -r '.digest | split(":")[1]')
    
      33
    
      34    wget -q "$download_url" -O vicinae.Appimage
    
      35    echo "${digest} vicinae.Appimage" | sha256sum -c || {
    
      36		echo "[ERR]: The downloaded file is corrupt."
    
      37    	exit 1
    
      38    }
    
      39
    
      40    chmod +x vicinae.Appimage
    
      41    ./vicinae.Appimage --appimage-extract
    
      42
    
      43}
    
      44
    
      45package() {
    
      46  install -dm755 "${pkgdir}/opt"
    
      47  cp -a "${srcdir}/squashfs-root" "${pkgdir}/opt/vicinae"
    
      48
    
      49  install -Dm755 "${srcdir}/vicinae.sh" "${pkgdir}/usr/bin/vicinae"
    
      50  install -Dm644 "${srcdir}/squashfs-root/vicinae.desktop" "${pkgdir}/usr/share/applications/vicinae.desktop"
    
      51  install -Dm644 "${srcdir}/squashfs-root/vicinae.png" "${pkgdir}/usr/share/icons/hicolor/512x512/apps/vicinae.png"
    
      52  install -Dm644 "${srcdir}/squashfs-root/usr/lib/systemd/user/vicinae.service" "${pkgdir}/usr/lib/systemd/user/vicinae.service"
    
      53
    
      54  cp -a "${srcdir}/squashfs-root/usr/share/" "${pkgdir}/usr/share/"
    
      55}
    
      56

Changes since previous scan

--- PKGBUILD @ 2026-09-03 00:15
+++ PKGBUILD @ 2026-09-17 00:27
@@ -2,7 +2,7 @@
 # Maintainer: cilgin <cilgincc@outlook.com>
 
 pkgname=vicinae-appimage-bin
-pkgver=0.27.5
+pkgver=0.28.0
 pkgrel=1
 pkgdesc="Raycast like FOSS app on Linux"
 arch=('x86_64')

Scan history

Scanned at (UTC)	Severity	Rules
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2
2026-09-12 00:25:17	Medium	2
2026-09-11 00:19:22	Medium	2
2026-09-10 00:22:44	Medium	2
2026-09-09 00:04:09	Medium	2
2026-09-08 00:18:08	Medium	2
2026-09-07 00:30:15	Medium	2
2026-09-06 00:17:06	Medium	2
2026-09-05 00:16:27	Medium	2
2026-09-04 00:03:13	Medium	2
2026-09-03 15:55:23	Medium	2
2026-09-03 15:53:41	High	1
2026-09-03 00:15:47	Medium	2
2026-09-02 21:53:08	Medium	2
2026-09-02 21:51:32	High	1
2026-09-02 00:02:31	Medium	2