wazo-desktop-appimage

maintainer ealhad · 1 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD downloads and executes a prebuilt AppImage binary from mirror.wazo.io, which is the official Wazo project mirror (wazo.io is the upstream vendor's domain). The sha256sum is pinned, which mitigates substitution risk at the point of download. However, the AppImage is executed during the prepare() phase (to extract desktop/icon files) before being installed, meaning a compromised binary would achieve code execution at build time. The host (mirror.wazo.io) appears to be the official vendor mirror rather than a personal or third-party host, making this a standard AppImage packaging pattern rather than a clear supply-chain attack. The risk is real but typical for AppImage packages: trust is placed in the vendor's mirror and the sha256 checksum. This is a genuine medium concern (executed binary from a non-GitHub/non-PyPI host) but not an active attack.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source=("${_appimage}::https://mirror.wazo.io/songbird/${pkgver}/${_appimage}")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD downloads and executes a prebuilt AppImage binary from mirror.wazo.io, which is the official Wazo project mirror (wazo.io is the upstream vendor's domain). The sha256sum is pinned, which mitigates substitution risk at the point of download. However, the AppImage is executed during the prepare() phase (to extract desktop/icon files) before being installed, meaning a compromised binary would achieve code execution at build time. The host (mirror.wazo.io) appears to be the official vendor mirror rather than a personal or third-party host, making this a standard AppImage packaging pattern rather than a clear supply-chain attack. The risk is real but typical for AppImage packages: trust is placed in the vendor's mirror and the sha256 checksum. This is a genuine medium concern (executed binary from a non-GitHub/non-PyPI host) but not an active attack.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Fabien Michel <fabien.michel@hespul.org>
    
      2_pkgname=wazo-desktop
    
      3pkgname=${_pkgname}-appimage
    
      4pkgver=1.19.0
    
      5pkgrel=1
    
      6pkgdesc="Wazo desktop client for wazo VOIP server"
    
      7arch=('x86_64')
    
      8url="https://wazo.io/download/"
    
      9license=('unknown')
    
      10provides=(${_pkgname})
    
      11
    
      12_appimage=Wazo-Desktop-${pkgver}.AppImage
    
      13_installdir=/opt/${pkgname}
    
      14_installappimage=Wazo-Desktop.AppImage
    
      15source=("${_appimage}::https://mirror.wazo.io/songbird/${pkgver}/${_appimage}")
    
      16noextract=("${_appimage}")
    
      17# Require !strip to avoid corrupt AppImage file
    
      18# Require !debug to workaround bug making strip still occure.
    
      19options=("!strip" "!debug")
    
      20sha256sums=('738d319821da589fb04b5742bd12f08c544de00cba884b1a66133e017e0f79fe')
    
      21
    
      22prepare() {
    
      23    # Make AppImage executable
    
      24    chmod +x "${_appimage}"
    
      25
    
      26    # Extract icons and desktop files from AppImage
    
      27    ./${_appimage} --appimage-extract "wazo-desktop.desktop" > /dev/null 2>&1
    
      28    ./${_appimage} --appimage-extract "usr/share/icons" > /dev/null 2>&1
    
      29    
    
      30    # Fix desktop file
    
      31    sed -i "s+Exec=AppRun+Exec=${_installdir}/${_installappimage}+" "squashfs-root/wazo-desktop.desktop"
    
      32}
    
      33
    
      34package() {
    
      35    # Install AppImage
    
      36    install -Dm755 "${srcdir}/${_appimage}" "${pkgdir}/${_installdir}/${_installappimage}"
    
      37    mkdir -p "${pkgdir}/usr/bin"
    
      38    ln -s "/${_installdir}/${_installappimage}" "${pkgdir}/usr/bin/${_pkgname}"
    
      39
    
      40    # Install desktop file
    
      41    install -Dm644 "squashfs-root/wazo-desktop.desktop" "${pkgdir}/usr/share/applications/${_pkgname}.desktop"
    
      42    
    
      43    # Install icons
    
      44    install -dm755 "$pkgdir/usr/share/icons"
    
      45    cp -dpr --no-preserve=ownership "squashfs-root/usr/share/icons" "$pkgdir/usr/share"
    
      46    chmod -R 755 "$pkgdir/usr/share/icons"
    
      47    find "$pkgdir/usr/share/icons" -type f -exec chmod 644 {} \;
    
      48}
    
      49

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2