vicinae-appimage-bin

MEDIUM

maintainer ArjixWasTaken 3 votes scanned 2026-11-01 00:21:48.120785

View on AUR

Why flagged

The PKGBUILD downloads the latest AppImage from GitHub's official API (api.github.com/repos/vicinaehq/vicinae/releases/latest) and verifies its SHA-256 digest against the value embedded in the GitHub release JSON before executing it. The execution (./vicinae.Appimage --appimage-extract) is the standard AppImage self-extraction mechanism, not arbitrary code execution in the malicious sense. However, there are legitimate concerns: (1) The source array pins a sha256sum for the static vicinae.sh wrapper and the github-release.json snapshot, but the actual AppImage binary is fetched dynamically at build time with its checksum pulled from the same untrusted release JSON — meaning a compromised GitHub release could swap both the binary and its digest simultaneously, bypassing integrity verification. (2) The AppImage is a pre-compiled binary from a third-party GitHub repo with no reproducible build. These are supply-chain concerns typical of *-bin AppImage packages in the AUR, not active malware. The pattern is common and well-understood in AUR packaging. Rating medium due to the dynamic binary fetch with self-referential checksum (not independently pinned), not high because there is no obfuscation, no exfiltration, and the source is the official upstream GitHub release endpoint.

Triggered rules

Medium AI review downgraded a static finding llm_review

The static rules flagged this HIGH, but an AI model (anthropic/claude-sonnet-4.6) reviewed the full PKGBUILD and judged it MEDIUM (confidence 72%): The PKGBUILD downloads the latest AppImage from GitHub's official API (api.github.com/repos/vicinaehq/vicinae/releases/latest) and verifies its SHA-256 digest against the value embedded in the GitHub release JSON before executing it. The execution (./vicinae.Appimage --appimage-extract) is the standard AppImage self-extraction mechanism, not arbitrary code execution in the malicious sense. However, there are legitimate concerns: (1) The source array pins a sha256sum for the static vicinae.sh wrapper and the github-release.json snapshot, but the actual AppImage binary is fetched dynamically at build time with its checksum pulled from the same untrusted release JSON — meaning a compromised GitHub release could swap both the binary and its digest simultaneously, bypassing integrity verification. (2) The AppImage is a pre-compiled binary from a third-party GitHub repo with no reproducible build. These are supply-chain concerns typical of *-bin AppImage packages in the AUR, not active malware. The pattern is common and well-understood in AUR packaging. Rating medium due to the dynamic binary fetch with self-referential checksum (not independently pinned), not high because there is no obfuscation, no exfiltration, and the source is the official upstream GitHub release endpoint.

1 higher static finding superseded - not the current verdict (shown for transparency)

High Downloaded file is executed download_then_exec

A file fetched with curl/wget (not part of source=(), so never checksum-verified) is later made executable or run — a fetch-and-execute pattern split across statements.

PKGBUILD:40 chmod +x vicinae.Appimage

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Arjix <me@arjix.dev>
    
      2# Maintainer: cilgin <cilgincc@outlook.com>
    
      3
    
      4pkgname=vicinae-appimage-bin
    
      5pkgver=0.29.2
    
      6pkgrel=1
    
      7pkgdesc="Raycast like FOSS app on Linux"
    
      8arch=('x86_64')
    
      9url="https://github.com/vicinaehq/vicinae"
    
      10options=('!debug' '!strip')
    
      11license=('GPL3')
    
      12makedepends=(jq wget)
    
      13provides=("vicinae")
    
      14conflicts=("vicinae")
    
      15
    
      16source=(
    
      17  "github-release.json::https://api.github.com/repos/vicinaehq/vicinae/releases/latest"
    
      18  "vicinae.sh"
    
      19)
    
      20sha256sums=('89690c2db2ad56ab60a18c3e9945b57d19e6c26622c5bef21bd7f239fe524312'
    
      21            '1856a49b51f1b13e8dd466d9c65690292e43d1f876c46210c8ef85c45841d33e')
    
      22
    
      23pkgver() {
    
      24	jq -r '.tag_name | ltrimstr("v")' github-release.json
    
      25}
    
      26
    
      27prepare() {
    
      28    local asset download_url digest
    
      29    asset=$(jq -r '.assets[] | select(.name | endswith(".AppImage"))' github-release.json)
    
      30
    
      31    download_url=$(echo "$asset" | jq -r '.browser_download_url')
    
      32    digest=$(echo "$asset" | jq -r '.digest | split(":")[1]')
    
      33
    
      34    wget -q "$download_url" -O vicinae.Appimage
    
      35    echo "${digest} vicinae.Appimage" | sha256sum -c || {
    
      36		echo "[ERR]: The downloaded file is corrupt."
    
      37    	exit 1
    
      38    }
    
      39
    
      40    chmod +x vicinae.Appimage
    
      41    ./vicinae.Appimage --appimage-extract
    
      42
    
      43}
    
      44
    
      45package() {
    
      46  install -dm755 "${pkgdir}/opt"
    
      47  cp -a "${srcdir}/squashfs-root" "${pkgdir}/opt/vicinae"
    
      48
    
      49  install -Dm755 "${srcdir}/vicinae.sh" "${pkgdir}/usr/bin/vicinae"
    
      50  install -Dm644 "${srcdir}/squashfs-root/vicinae.desktop" "${pkgdir}/usr/share/applications/vicinae.desktop"
    
      51  install -Dm644 "${srcdir}/squashfs-root/vicinae.png" "${pkgdir}/usr/share/icons/hicolor/512x512/apps/vicinae.png"
    
      52  install -Dm644 "${srcdir}/squashfs-root/usr/lib/systemd/user/vicinae.service" "${pkgdir}/usr/lib/systemd/user/vicinae.service"
    
      53
    
      54  cp -a "${srcdir}/squashfs-root/usr/share/" "${pkgdir}/usr/share/"
    
      55}
    
      56

Changes since previous scan

--- PKGBUILD @ 2026-10-20 00:10
+++ PKGBUILD @ 2026-11-01 00:21
@@ -2,7 +2,7 @@
 # Maintainer: cilgin <cilgincc@outlook.com>
 
 pkgname=vicinae-appimage-bin
-pkgver=0.28.1
+pkgver=0.29.2
 pkgrel=1
 pkgdesc="Raycast like FOSS app on Linux"
 arch=('x86_64')

Scan history

Scanned at (UTC)	Severity	Rules
2026-11-01 00:21:48	Medium	2
2026-10-31 00:07:41	Medium	2
2026-10-30 00:29:30	Medium	2
2026-10-29 00:13:55	Medium	2
2026-10-28 00:06:54	Medium	2
2026-10-27 00:23:28	Medium	2
2026-10-26 00:12:40	Medium	2
2026-10-25 00:20:48	Medium	2
2026-10-24 00:14:55	Medium	2
2026-10-23 00:02:19	Medium	2
2026-10-22 00:13:10	Medium	2
2026-10-21 00:12:50	Medium	2
2026-10-20 01:29:07	Medium	2
2026-10-20 01:27:05	High	1
2026-10-20 00:10:31	Medium	2
2026-10-19 00:03:55	Medium	2
2026-10-18 00:06:55	Medium	2
2026-10-17 00:21:55	Medium	2
2026-10-16 00:12:47	Medium	2
2026-10-15 00:28:05	Medium	2