volt-desktop

maintainer bluethefox · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt AppImage binary from updates.voltagechat.app, which is the project's own update server (not a personal/random host), and verifies it with a sha256sum. The binary is then extracted and installed. The concern is real but moderate: this is a closed-source Electron app distributed as a prebuilt binary from the vendor's own update infrastructure rather than built from source. The sha256sum provides integrity but not authenticity (no GPG signature). If the update server were compromised, users would receive a malicious binary. This is a standard pattern for proprietary/closed-source AUR packages (similar to many -bin packages), but the domain is not a well-known major vendor. The medium rating is appropriate: it's an executed binary from a non-mainstream host with no GPG verification, representing a real supply-chain risk, but there is no evidence of malice and the host appears to be the legitimate project's own server.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:16 source=("${pkgname}-${pkgver}.AppImage::https://updates.voltagechat.app/desktop/linux/Volt-${pkgver}.AppImage"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt AppImage binary from updates.voltagechat.app, which is the project's own update server (not a personal/random host), and verifies it with a sha256sum. The binary is then extracted and installed. The concern is real but moderate: this is a closed-source Electron app distributed as a prebuilt binary from the vendor's own update infrastructure rather than built from source. The sha256sum provides integrity but not authenticity (no GPG signature). If the update server were compromised, users would receive a malicious binary. This is a standard pattern for proprietary/closed-source AUR packages (similar to many -bin packages), but the domain is not a well-known major vendor. The medium rating is appropriate: it's an executed binary from a non-mainstream host with no GPG verification, representing a real supply-chain risk, but there is no evidence of malice and the host appears to be the legitimate project's own server.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: VoltChat Team <contact@voltagechat.app>
    
      2pkgname=volt-desktop
    
      3pkgver=1.1.8
    
      4pkgrel=1
    
      5pkgdesc="VoltChat Desktop Application - Electron-based chat client"
    
      6arch=('x86_64')
    
      7url="https://voltagechat.app"
    
      8license=('custom')
    
      9depends=('electron' 'gtk3' 'libnotify' 'nss' 'libxss' 'libxtst' 'xdg-utils' 'at-spi2-core' 'util-linux-libs')
    
      10optdepends=('libappindicator-gtk3: system tray support')
    
      11provides=('volt-desktop')
    
      12conflicts=('volt-desktop-bin')
    
      13options=('!strip')
    
      14
    
      15# Source: AppImage from the official update server
    
      16source=("${pkgname}-${pkgver}.AppImage::https://updates.voltagechat.app/desktop/linux/Volt-${pkgver}.AppImage"
    
      17        "volt-desktop.desktop"
    
      18        "volt-desktop.png")
    
      19noextract=("${pkgname}-${pkgver}.AppImage")
    
      20
    
      21sha256sums=('b01ea5855007113fc2a9982f5bcdfd9e04679f0804b4f8e76c8fc77ae8773d0e'
    
      22            'f1640087071165a04b5913c30391021584504f42bab61c36b7959fb3cdcc8da7'
    
      23            'f4e59ffb51c7ab41b9f3b1eacd9296801ad684eef88fa862bb44790c5714f56e')
    
      24
    
      25prepare() {
    
      26    chmod +x "${srcdir}/${pkgname}-${pkgver}.AppImage"
    
      27    cd "${srcdir}"
    
      28    "./${pkgname}-${pkgver}.AppImage" --appimage-extract
    
      29}
    
      30
    
      31package() {
    
      32    # Install the extracted AppImage contents
    
      33    install -dm755 "${pkgdir}/opt/${pkgname}"
    
      34    cp -r "${srcdir}/squashfs-root/." "${pkgdir}/opt/${pkgname}/"
    
      35
    
      36    # Make the main binary executable
    
      37    chmod 755 "${pkgdir}/opt/${pkgname}/volt-desktop" 2>/dev/null || \
    
      38    chmod 755 "${pkgdir}/opt/${pkgname}/Volt" 2>/dev/null || true
    
      39
    
      40    # Create a wrapper launcher script
    
      41    install -dm755 "${pkgdir}/usr/bin"
    
      42    cat > "${pkgdir}/usr/bin/volt-desktop" << 'EOF'
    
      43#!/bin/bash
    
      44exec /opt/volt-desktop/volt-desktop "$@" 2>/dev/null || \
    
      45exec /opt/volt-desktop/Volt "$@"
    
      46EOF
    
      47    chmod 755 "${pkgdir}/usr/bin/volt-desktop"
    
      48
    
      49    # Install desktop entry
    
      50    install -Dm644 "${srcdir}/volt-desktop.desktop" \
    
      51        "${pkgdir}/usr/share/applications/volt-desktop.desktop"
    
      52
    
      53    # Install icon
    
      54    install -Dm644 "${srcdir}/volt-desktop.png" \
    
      55        "${pkgdir}/usr/share/pixmaps/volt-desktop.png"
    
      56
    
      57    # Also try to install icon from extracted AppImage
    
      58    if [ -f "${srcdir}/squashfs-root/volt-desktop.png" ]; then
    
      59        install -Dm644 "${srcdir}/squashfs-root/volt-desktop.png" \
    
      60            "${pkgdir}/usr/share/pixmaps/volt-desktop.png"
    
      61    elif [ -f "${srcdir}/squashfs-root/.DirIcon" ]; then
    
      62        install -Dm644 "${srcdir}/squashfs-root/.DirIcon" \
    
      63            "${pkgdir}/usr/share/pixmaps/volt-desktop.png"
    
      64    fi
    
      65
    
      66    # Register voltchat:// protocol handler
    
      67    install -dm755 "${pkgdir}/usr/share/applications"
    
      68}
    
      69

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2