3utools-desktop-bin
MEDIUM
maintainer nathawat
0 votes
scanned 2026-09-17 00:27:14.276658
Why flagged
The package downloads a prebuilt .deb binary from a non-whitelisted, non-standard host (dl.3u.com), which is an unverifiable executable from a swappable source, posing a supply-chain risk.
Triggered rules
Medium
source=() URL on a non-standard host
source_untrusted_domain
One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).
-
PKGBUILD:15
source=("${pkgname}-${pkgver}.deb::https://dl.3u.com/update/v900/dl/linux/x64/com.3u.3utools_${pkgver}_amd64.deb")
Medium
AI review
llm_review
An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads a prebuilt .deb binary from a non-whitelisted, non-standard host (dl.3u.com), which is an unverifiable executable from a swappable source, posing a supply-chain risk.
PKGBUILD
1 offending line(s) highlighted
1
# Maintainer: nathawat <nathawat[at]noreply[dot] codeberg[dot]org>
2
3
pkgname=3utools-desktop-bin
4
pkgver=9.02.009
5
pkgrel=1
6
pkgdesc="Apple Device Management Tool"
7
arch=('x86_64')
8
depends=('glibc' 'gcc-libs' 'zlib' 'nss' 'alsa-lib' 'freetype2' 'usbmuxd' 'libx11' 'libxext' 'libxfixes' 'libxdamage' 'libxcomposite' 'libxcursor' 'libxrender' 'libxrandr' 'libxi' 'libxtst' 'libxau' 'libxdmcp' 'libxcb' 'xcb-util' 'xcb-util-image' 'xcb-util-keysyms' 'xcb-util-renderutil' 'xcb-util-wm' 'glib2' 'fontconfig' 'systemd-libs' 'libxkbcommon' 'libxkbcommon-x11')
9
optdepends=('xorg-xwayland: for running on Wayland sessions')
10
url="https://www.3u.com/"
11
license=('custom')
12
options=('!debug' '!strip')
13
provides=("3utools")
14
replaces=("3utools-bin")
15
source=("${pkgname}-${pkgver}.deb::https://dl.3u.com/update/v900/dl/linux/x64/com.3u.3utools_${pkgver}_amd64.deb")
16
b2sums=("6f94cc3e2509ab256e8c731db655cd92fea2597996a12aed0abbf016fad7d428bad15983ce6efe783fda3ea77d2504f558a0694bc97c4f8a04f74f2688c69301")
17
18
package() {
19
# The .deb is automatically unpacked by makepkg, yielding data.tar.xz
20
tar xf data.tar.xz -C "${pkgdir}"
21
22
# Fix directory permissions to match Arch Linux standards (755)
23
find "${pkgdir}" -type d -exec chmod 755 {} +
24
25
# Create a symlink in /usr/bin for easy access
26
install -d "${pkgdir}/usr/bin"
27
ln -s /opt/apps/com.3u.3utools/run.sh "${pkgdir}/usr/bin/3utools"
28
29
# Fix desktop file name
30
sed -i 's/^Name=com.3u.3utools/Name=3uTools/' "${pkgdir}/usr/share/applications/com.3u.3utools.desktop"
31
sed -i 's/^GenericName=com.3u.3utools/GenericName=3uTools/' "${pkgdir}/usr/share/applications/com.3u.3utools.desktop"
32
33
# Optimize and clean up the bundled run.sh script
34
cat << 'EOF' > "${pkgdir}/opt/apps/com.3u.3utools/run.sh"
35
#!/bin/bash
36
37
if [ $# -eq 0 ]; then
38
cd "$(dirname "$(readlink -f "$0")")" || exit 1
39
export QT_XCB_GL_INTEGRATION=none
40
exec ./3uTools
41
elif [ $# -eq 1 ]; then
42
# Safely restart usbmuxd (Arch Linux standard way)
43
if command -v systemctl >/dev/null 2>&1; then
44
systemctl restart usbmuxd || true
45
else
46
killall -9 usbmuxd 2>/dev/null || true
47
usbmuxd --user usbmux || true
48
fi
49
else
50
PID_USBMUX="$1"
51
shift
52
mycommand="$1"
53
shift
54
55
kill -9 "$PID_USBMUX" 2>/dev/null || true
56
exec "$mycommand" "$@"
57
fi
58
EOF
59
chmod +x "${pkgdir}/opt/apps/com.3u.3utools/run.sh"
60
61
# Replace bundled core system libraries with symlinks to system libraries
62
# This fixes Wayland/Mesa crashes (GLIBC_ABI_DT_RELR) and satisfies 3uTools' strict RPATH
63
local syslibs=(
64
"ld-linux-x86-64.so.2" "libc.so.6" "libstdc++.so.6" "libm.so.6" "libdl.so.2" "librt.so.1" "libpthread.so.0" "libgcc_s.so.1"
65
"libresolv.so.2" "libglib-2.0.so.0" "libfontconfig.so.1" "libfreetype.so.6" "libsystemd.so.0" "libudev.so.1" "libz.so.1"
66
"libX11.so.6" "libX11-xcb.so.1" "libXext.so.6" "libXfixes.so.3" "libXdamage.so.1" "libXcomposite.so.1"
67
"libXcursor.so.1" "libXrender.so.1" "libXrandr.so.2" "libXi.so.6" "libXtst.so.6" "libXau.so.6" "libXdmcp.so.6"
68
"libxcb.so.1" "libxcb-glx.so.0" "libxcb-icccm.so.4" "libxcb-image.so.0" "libxcb-keysyms.so.1" "libxcb-randr.so.0"
69
"libxcb-render-util.so.0" "libxcb-render.so.0" "libxcb-shape.so.0" "libxcb-shm.so.0" "libxcb-sync.so.1"
70
"libxcb-util.so.1" "libxcb-xfixes.so.0" "libxcb-xinerama.so.0" "libxcb-xkb.so.1"
71
"libxkbcommon.so.0" "libxkbcommon-x11.so.0"
72
)
73
74
for lib in "${syslibs[@]}"; do
75
if [ -f "${pkgdir}/opt/apps/com.3u.3utools/lib/${lib}" ] || [ -L "${pkgdir}/opt/apps/com.3u.3utools/lib/${lib}" ]; then
76
rm -f "${pkgdir}/opt/apps/com.3u.3utools/lib/${lib}"
77
ln -s "/usr/lib/${lib}" "${pkgdir}/opt/apps/com.3u.3utools/lib/${lib}"
78
fi
79
done
80
}
81
Scan history
| Scanned at (UTC) | Severity | Rules |
|---|---|---|
| 2026-09-17 00:27:14 | Medium | 2 |
| 2026-09-16 00:03:17 | Medium | 2 |
| 2026-09-15 00:25:31 | Medium | 2 |
| 2026-09-14 00:27:57 | Medium | 2 |
| 2026-09-13 00:19:54 | Medium | 2 |
| 2026-09-12 00:25:17 | Medium | 2 |
| 2026-09-11 00:19:22 | Medium | 2 |
| 2026-09-10 00:22:44 | Medium | 2 |
| 2026-09-09 00:04:09 | Medium | 2 |
| 2026-09-08 00:18:08 | Medium | 2 |
| 2026-09-07 00:30:15 | Medium | 2 |
| 2026-09-06 00:17:06 | Medium | 2 |
| 2026-09-05 00:16:27 | Medium | 2 |
| 2026-09-04 00:03:13 | Medium | 2 |
| 2026-09-03 00:15:47 | Medium | 2 |
| 2026-09-02 00:02:31 | Medium | 2 |
| 2026-09-01 00:11:19 | Medium | 2 |
| 2026-08-31 00:19:57 | Medium | 2 |
| 2026-08-30 00:04:14 | Medium | 2 |
| 2026-08-29 00:29:17 | Medium | 2 |