3utools-desktop-bin

maintainer nathawat_a · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The package downloads a prebuilt binary .deb from dl.3u.com, which is the official distribution host for the 3uTools application (matching the official website at www.3u.com). The domain is consistent with the vendor's own infrastructure, not a personal or third-party host. A b2sum checksum is provided, which pins the specific artifact. However, this is still a closed-source, prebuilt binary blob from a Chinese vendor with no source transparency, installed and executed on the user's system with access to Apple device management (usbmuxd). The PKGBUILD also replaces the bundled run.sh with a maintainer-written script, which is reasonable for compatibility but means the executed launcher is not from the upstream source. The library symlink substitution is a legitimate technique to avoid bundled library conflicts. The core concern remains: an opaque, prebuilt binary from a single vendor-controlled download host with no reproducibility — this is a genuine medium supply-chain risk (executed binary from a non-auditable source), not a false positive, but also not evidence of active malice.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:15 source=("${pkgname}-${pkgver}.deb::https://dl.3u.com/update/v900/dl/linux/x64/com.3u.3utools_${pkgver}_amd64.deb")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The package downloads a prebuilt binary .deb from dl.3u.com, which is the official distribution host for the 3uTools application (matching the official website at www.3u.com). The domain is consistent with the vendor's own infrastructure, not a personal or third-party host. A b2sum checksum is provided, which pins the specific artifact. However, this is still a closed-source, prebuilt binary blob from a Chinese vendor with no source transparency, installed and executed on the user's system with access to Apple device management (usbmuxd). The PKGBUILD also replaces the bundled run.sh with a maintainer-written script, which is reasonable for compatibility but means the executed launcher is not from the upstream source. The library symlink substitution is a legitimate technique to avoid bundled library conflicts. The core concern remains: an opaque, prebuilt binary from a single vendor-controlled download host with no reproducibility — this is a genuine medium supply-chain risk (executed binary from a non-auditable source), not a false positive, but also not evidence of active malice.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: nathawat <nathawat[at]noreply[dot] codeberg[dot]org>
    
      2
    
      3pkgname=3utools-desktop-bin
    
      4pkgver=9.01.003
    
      5pkgrel=1
    
      6pkgdesc="Apple Device Management Tool"
    
      7arch=('x86_64')
    
      8depends=('glibc' 'gcc-libs' 'zlib' 'nss' 'alsa-lib' 'freetype2' 'usbmuxd' 'libx11' 'libxext' 'libxfixes' 'libxdamage' 'libxcomposite' 'libxcursor' 'libxrender' 'libxrandr' 'libxi' 'libxtst' 'libxau' 'libxdmcp' 'libxcb' 'xcb-util' 'xcb-util-image' 'xcb-util-keysyms' 'xcb-util-renderutil' 'xcb-util-wm' 'glib2' 'fontconfig' 'systemd-libs' 'libxkbcommon' 'libxkbcommon-x11')
    
      9optdepends=('xorg-xwayland: for running on Wayland sessions')
    
      10url="https://www.3u.com/"
    
      11license=('custom')
    
      12options=('!debug' '!strip')
    
      13provides=("3utools")
    
      14replaces=("3utools-bin")
    
      15source=("${pkgname}-${pkgver}.deb::https://dl.3u.com/update/v900/dl/linux/x64/com.3u.3utools_${pkgver}_amd64.deb")
    
      16b2sums=("74326c80a90fa720415c53135acdd71fb47f11a3738d6e31e0840ea1c978cd09fb3d0b89613ba17ac640c9761649b5c07a47bdc814befd533bdf5d59171beddd")
    
      17
    
      18package() {
    
      19  # The .deb is automatically unpacked by makepkg, yielding data.tar.xz
    
      20  tar xf data.tar.xz -C "${pkgdir}"
    
      21
    
      22  # Fix directory permissions to match Arch Linux standards (755)
    
      23  find "${pkgdir}" -type d -exec chmod 755 {} +
    
      24
    
      25  # Create a symlink in /usr/bin for easy access
    
      26  install -d "${pkgdir}/usr/bin"
    
      27  ln -s /opt/apps/com.3u.3utools/run.sh "${pkgdir}/usr/bin/3utools"
    
      28
    
      29  # Fix desktop file name
    
      30  sed -i 's/^Name=com.3u.3utools/Name=3uTools/' "${pkgdir}/usr/share/applications/com.3u.3utools.desktop"
    
      31  sed -i 's/^GenericName=com.3u.3utools/GenericName=3uTools/' "${pkgdir}/usr/share/applications/com.3u.3utools.desktop"
    
      32
    
      33  # Optimize and clean up the bundled run.sh script
    
      34  cat << 'EOF' > "${pkgdir}/opt/apps/com.3u.3utools/run.sh"
    
      35#!/bin/bash
    
      36
    
      37if [ $# -eq 0 ]; then
    
      38    cd "$(dirname "$(readlink -f "$0")")" || exit 1
    
      39    export QT_XCB_GL_INTEGRATION=none
    
      40    exec ./3uTools
    
      41elif [ $# -eq 1 ]; then
    
      42    # Safely restart usbmuxd (Arch Linux standard way)
    
      43    if command -v systemctl >/dev/null 2>&1; then
    
      44        systemctl restart usbmuxd || true
    
      45    else
    
      46        killall -9 usbmuxd 2>/dev/null || true
    
      47        usbmuxd --user usbmux || true
    
      48    fi
    
      49else
    
      50    PID_USBMUX="$1"
    
      51    shift
    
      52    mycommand="$1"
    
      53    shift
    
      54
    
      55    kill -9 "$PID_USBMUX" 2>/dev/null || true
    
      56    exec "$mycommand" "$@"
    
      57fi
    
      58EOF
    
      59  chmod +x "${pkgdir}/opt/apps/com.3u.3utools/run.sh"
    
      60
    
      61  # Replace bundled core system libraries with symlinks to system libraries
    
      62  # This fixes Wayland/Mesa crashes (GLIBC_ABI_DT_RELR) and satisfies 3uTools' strict RPATH
    
      63  local syslibs=(
    
      64    "ld-linux-x86-64.so.2" "libc.so.6" "libstdc++.so.6" "libm.so.6" "libdl.so.2" "librt.so.1" "libpthread.so.0" "libgcc_s.so.1"
    
      65    "libresolv.so.2" "libglib-2.0.so.0" "libfontconfig.so.1" "libfreetype.so.6" "libsystemd.so.0" "libudev.so.1" "libz.so.1"
    
      66    "libX11.so.6" "libX11-xcb.so.1" "libXext.so.6" "libXfixes.so.3" "libXdamage.so.1" "libXcomposite.so.1"
    
      67    "libXcursor.so.1" "libXrender.so.1" "libXrandr.so.2" "libXi.so.6" "libXtst.so.6" "libXau.so.6" "libXdmcp.so.6"
    
      68    "libxcb.so.1" "libxcb-glx.so.0" "libxcb-icccm.so.4" "libxcb-image.so.0" "libxcb-keysyms.so.1" "libxcb-randr.so.0"
    
      69    "libxcb-render-util.so.0" "libxcb-render.so.0" "libxcb-shape.so.0" "libxcb-shm.so.0" "libxcb-sync.so.1"
    
      70    "libxcb-util.so.1" "libxcb-xfixes.so.0" "libxcb-xinerama.so.0" "libxcb-xkb.so.1"
    
      71    "libxkbcommon.so.0" "libxkbcommon-x11.so.0"
    
      72  )
    
      73
    
      74  for lib in "${syslibs[@]}"; do
    
      75    if [ -f "${pkgdir}/opt/apps/com.3u.3utools/lib/${lib}" ] || [ -L "${pkgdir}/opt/apps/com.3u.3utools/lib/${lib}" ]; then
    
      76      rm -f "${pkgdir}/opt/apps/com.3u.3utools/lib/${lib}"
    
      77      ln -s "/usr/lib/${lib}" "${pkgdir}/opt/apps/com.3u.3utools/lib/${lib}"
    
      78    fi
    
      79  done
    
      80}
    
      81

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2