I've taken the habit of running any repo I encounter through my clanker. This is what he found:
# Security Review – Omalauncher
**Repository:** https://github.com/SimonSchubert/omalauncher
**Review type:** Preliminary static source-code analysis
After reviewing the source code, I identified a few potential security issues worth addressing.
### 1. Insecure Arch Linux Rootfs Download – Critical
**File:** `linux/Bootstrap.kt`
The Arch Linux root filesystem is downloaded over unencrypted HTTP:
`http://os.archlinuxarm.org/os/ArchLinuxARM-aarch64-latest.tar.gz`
No cryptographic signature or checksum verification appears to be performed before extraction.
An attacker capable of intercepting network traffic could potentially replace the archive with malicious content, compromising the Linux environment.
**Recommendation:** Use HTTPS where available and verify the rootfs against a trusted cryptographic signature or pinned checksum.
### 2. Potential TAR Path Traversal – High
**File:** `linux/Bootstrap.kt`
During extraction, archive entry paths are joined directly to the destination directory without canonical-path containment checks.
Malicious entries containing `../`, absolute paths, or crafted symbolic links could potentially write files outside the intended rootfs directory, within the app's accessible filesystem.
**Recommendation:** Validate every extraction path and link target, rejecting entries that escape the designated root directory.
### 3. Additional Security Considerations
- OWL widgets can execute shell commands, making untrusted widgets a potential attack surface.
- Cleartext network traffic is permitted at the application level.
- External scripts and binaries should undergo appropriate integrity verification before execution.
### Conclusion
I found no evidence of intentionally malicious behavior during this review. However, the rootfs download and archive extraction mechanisms present significant potential security risks.
**I recommend addressing these issues before relying on the Linux environment for sensitive workloads.**
This is a preliminary source-code review, not a full security audit. No exploit testing or APK binary verification was performed.
LWB
npub1vj…9hh7v
2026-10-11 06:06:58 UTC
in reply to nevent1q…qdpd
Author Public Key
npub1vjxq75czca0nswp2f5kgtfyzhynuccdjs29q098rd3kv09k7s6nq39hh7vSeen on
wss://nostr.momPublished at
2026-10-11 06:06:58 UTCEvent JSON
{
"id": "a353d4063ec4c21316a34af0dd972ee4cedb00e642119d9bbaee8bc5af9d069f",
"pubkey": "648c0f5302c75f38382a4d2c85a482b927cc61b2828a0794e36c6cc796de86a6",
"created_at": 1791698818,
"kind": 1,
"tags": [
[
"e",
"0000064b86e0e4a75c5b362e8448e804637f74af72c626fad587f7bae81d71c9",
"",
"root",
"3f770d65d3a764a9c5cb503ae123e62ec7598ad035d836e2a810f3877a745b24"
],
[
"p",
"3f770d65d3a764a9c5cb503ae123e62ec7598ad035d836e2a810f3877a745b24"
],
[
"client",
"Nostrich"
]
],
"content": "I've taken the habit of running any repo I encounter through my clanker. This is what he found:\n\n# Security Review – Omalauncher\n\n**Repository:** https://github.com/SimonSchubert/omalauncher \n**Review type:** Preliminary static source-code analysis\n\nAfter reviewing the source code, I identified a few potential security issues worth addressing.\n\n### 1. Insecure Arch Linux Rootfs Download – Critical\n\n**File:** `linux/Bootstrap.kt`\n\nThe Arch Linux root filesystem is downloaded over unencrypted HTTP:\n\n`http://os.archlinuxarm.org/os/ArchLinuxARM-aarch64-latest.tar.gz`\n\nNo cryptographic signature or checksum verification appears to be performed before extraction.\n\nAn attacker capable of intercepting network traffic could potentially replace the archive with malicious content, compromising the Linux environment.\n\n**Recommendation:** Use HTTPS where available and verify the rootfs against a trusted cryptographic signature or pinned checksum.\n\n### 2. Potential TAR Path Traversal – High\n\n**File:** `linux/Bootstrap.kt`\n\nDuring extraction, archive entry paths are joined directly to the destination directory without canonical-path containment checks.\n\nMalicious entries containing `../`, absolute paths, or crafted symbolic links could potentially write files outside the intended rootfs directory, within the app's accessible filesystem.\n\n**Recommendation:** Validate every extraction path and link target, rejecting entries that escape the designated root directory.\n\n### 3. Additional Security Considerations\n\n- OWL widgets can execute shell commands, making untrusted widgets a potential attack surface.\n- Cleartext network traffic is permitted at the application level.\n- External scripts and binaries should undergo appropriate integrity verification before execution.\n\n### Conclusion\n\nI found no evidence of intentionally malicious behavior during this review. However, the rootfs download and archive extraction mechanisms present significant potential security risks.\n\n**I recommend addressing these issues before relying on the Linux environment for sensitive workloads.**\n\nThis is a preliminary source-code review, not a full security audit. No exploit testing or APK binary verification was performed.",
"sig": "df6045d1b152d5a61a6b34db3a01fcdb64494f73e4687a3723f9e926f8a9b23d51008edab58ab4e66fdd051617924b21a8e70834f3179311fcd2ca0e7e11b66d"
}