115-browser-bin

maintainer taotieren · 2 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged This PKGBUILD installs a prebuilt proprietary browser binary downloaded from down.115.com, which is the official CDN/download host for the 115.com product (a Chinese cloud storage and browser service). The host is not a random personal server — it is the vendor's own distribution endpoint, analogous to how other proprietary software (e.g., Google Chrome, Zoom) distributes binaries from their own CDNs. The sha256sum is pinned, which mitigates MITM risk. However, the concern is real and non-trivial: (1) it is a fully prebuilt, closed-source browser binary being installed system-wide under /opt and /usr/bin, (2) the vendor is a Chinese company subject to local jurisdiction, (3) there is no way to audit what the binary does, and (4) the download host, while official for this product, is not a widely recognized or auditable distribution platform. This is a classic medium-severity supply-chain concern for a proprietary binary from a non-Western vendor — not clearly malicious, but the executed binary from an opaque source warrants the medium rating. No piracy or broken flags apply.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:29 "https://115.com/privacy.html"
PKGBUILD:34 "${pkgname}-${pkgver}.deb::https://down.115.com/client/115pc/lin/115br_v${pkgver}.deb"

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): This PKGBUILD installs a prebuilt proprietary browser binary downloaded from down.115.com, which is the official CDN/download host for the 115.com product (a Chinese cloud storage and browser service). The host is not a random personal server — it is the vendor's own distribution endpoint, analogous to how other proprietary software (e.g., Google Chrome, Zoom) distributes binaries from their own CDNs. The sha256sum is pinned, which mitigates MITM risk. However, the concern is real and non-trivial: (1) it is a fully prebuilt, closed-source browser binary being installed system-wide under /opt and /usr/bin, (2) the vendor is a Chinese company subject to local jurisdiction, (3) there is no way to audit what the binary does, and (4) the download host, while official for this product, is not a widely recognized or auditable distribution platform. This is a classic medium-severity supply-chain concern for a proprietary binary from a non-Western vendor — not clearly malicious, but the executed binary from an opaque source warrants the medium rating. No piracy or broken flags apply.

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: taotieren <admin@taotieren.com>
    
      2
    
      3pkgbase=115-browser-bin
    
      4pkgname=115-browser-bin
    
      5_pkgname=115br
    
      6pkgver=36.0.0
    
      7pkgrel=1
    
      8arch=('x86_64')
    
      9options=(!strip !debug)
    
      10depends=(
    
      11    dbus
    
      12    expat
    
      13    gcc-libs
    
      14    glib2
    
      15    glibc
    
      16    libidn2
    
      17    sh
    
      18    zlib
    
      19)
    
      20makedepends=(libarchive)
    
      21provides=(${pkgname%-bin})
    
      22conflicts=(${pkgname%-bin})
    
      23replaces=()
    
      24pkgdesc="115 Browser / 115 浏览器"
    
      25license=('LicenseRef-scancode-commercial-license')
    
      26url="https://115.com/product_browser"
    
      27install=${pkgname}.install
    
      28source=(
    
      29    "https://115.com/privacy.html"
    
      30    "https://115.com/copyright.html"
    
      31    "${pkgname}.install"
    
      32)
    
      33source_x86_64=(
    
      34    "${pkgname}-${pkgver}.deb::https://down.115.com/client/115pc/lin/115br_v${pkgver}.deb"
    
      35)
    
      36sha256sums=('e65199037614ec40eae799f013d007a9252d1b870ec9406fffd7f0aaee3951f1'
    
      37            'cfe25e4d5d8236b3b68089fbc4b56aaa7db1d0a560905f1faf004bc5e4534245'
    
      38            'ce0e3cdf98637003986feb9abb198cf04135333116f44e1642ba438d344a6a2e')
    
      39sha256sums_x86_64=('139fb4e36d7f48f1e179317e5ad2bd8b12879e71d3c4ff99da26865661b4fc48')
    
      40noextract=("${pkgname}-${pkgver}.deb")
    
      41
    
      42prepare() {
    
      43    if [ -d ${srcdir}/${pkgname}-${pkgver} ]; then
    
      44        rm -rf ${srcdir}/${pkgname}-${pkgver}
    
      45    fi
    
      46    mkdir -pv ${srcdir}/${pkgname}-${pkgver}
    
      47
    
      48    bsdtar -xf "${srcdir}/${pkgname}-${pkgver}.deb" --numeric-owner -C "${srcdir}/${pkgname}-${pkgver}"
    
      49}
    
      50
    
      51package() {
    
      52    install -dvm755 "${pkgdir}/usr/bin" \
    
      53        "${pkgdir}/opt/115"
    
      54
    
      55    bsdtar -xf "${srcdir}/${pkgname}-${pkgver}/data.tar.xz" --numeric-owner -C "${pkgdir}"
    
      56
    
      57    chown -R root:root "${pkgdir}"
    
      58
    
      59    mv "${pkgdir}/usr/local/115Browser" "${pkgdir}/opt/115" && rm -rf "${pkgdir}/usr/local"
    
      60
    
      61    sed -i 's|/usr/local|/opt/115|g' "${pkgdir}/usr/share/applications/115Browser.desktop"
    
      62    sed -i 's|/usr/local|/opt/115|g' "${pkgdir}/opt/115/115Browser/115.sh"
    
      63    ln -sf "/opt/115/115Browser/115.sh" "${pkgdir}/usr/bin/${pkgname%-bin}"
    
      64
    
      65    chmod 755 ${pkgdir}/usr/share/applications/115Browser.desktop
    
      66    install -vDm644 "${srcdir}/privacy.html" -t "${pkgdir}/usr/share/licenses/${pkgname}/"
    
      67    install -vDm644 "${srcdir}/copyright.html" -t "${pkgdir}/usr/share/licenses/${pkgname}/"
    
      68}
    
      69

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2