appimage-scan #awktober example, see https://mastodon.mit.edu/@eichin/113280660648013385

appimage-scan

#!/bin/bash -eu

appimage=$1
shift

# credit to https://www.baeldung.com/linux/values-into-variable-from-pipe for the "read < <()" technique
read start num size < <(
readelf -h "$appimage" | sed -e 's/^ *//' | awk -F: '
{h[$1]=$2}
END {print h["Start of section headers"],
           h["Number of section headers"],
           h["Size of section headers"]
}' | sed -e 's/([ a-z]*)//g'
)
offset=$(expr "$start" + "$num" \* "$size")
# this would work:
# sudo mount -o loop,offset=$offset $appimage /mnt

tmpdir=$(mktemp -t -d appimage-scan-squashfs-XXXXX)
scandir="$tmpdir"/scan
echo "Unsquashing appimage into $scandir ..."
# suppress the "created" counts and blank lines and progress bar but show *some* action
unsquashfs -no-progress -o "$offset" -d "$scandir" "$appimage" |grep -v -e '^created '|grep -e .
echo "Scanning with clamscan..."
# minimize non-problem output
if ! clamscan --infected --alert-encrypted=yes --cross-fs=no --recursive "$scandir"; then
    echo clamscan failed on "$appimage" - keeping evidence in "$scandir"
    exit 3
fi
rm -rf "$tmpdir"
echo "$appimage" clean

• I wrote this in early 2023
• this has only ever been used on the logseq appimage file
• because logseq/logseq#9642 I switched to the flatpak version in mid-2023 anyway.