aionui-bin

MEDIUM

maintainer orphaned 2 votes scanned 2026-10-02 00:00:32.890515

View on AUR

Why flagged

The package downloads prebuilt .deb binaries from a non-whitelisted, project-specific host (static.aionui.com), which presents a supply-chain risk if the host is compromised or controlled by an unrelated party; however, the checksums are provided and the payload is unpacked without executing remote code.

Triggered rules

Medium source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:29 source_x86_64=("${_appname}_${pkgver}_${arch[0]}.deb::https://static.aionui.com/releases/${pkgver}/AionUi-${pkgver}-${_barch[0]}.deb")

Medium AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads prebuilt .deb binaries from a non-whitelisted, project-specific host (static.aionui.com), which presents a supply-chain risk if the host is compromised or controlled by an unrelated party; however, the checksums are provided and the payload is unpacked without executing remote code.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: neko_ayaya
    
      2# Maintainer: Rafael Dominiquini <rafaeldominiquini at gmail dot com>
    
      3
    
      4_appname=aionui
    
      5
    
      6pkgname=${_appname}-bin
    
      7pkgver=2.1.54
    
      8pkgrel=1
    
      9pkgdesc="Transform your command-line experience into a modern, efficient AI Chat interface."
    
      10
    
      11arch=('x86_64' 'aarch64')
    
      12_barch=('linux-amd64' 'linux-arm64')
    
      13
    
      14url="https://github.com/iOfficeAI/AionUi" # <-- 示例网址，请替换为官方项目地址
    
      15
    
      16license=('Apache-2.0')
    
      17
    
      18depends=(
    
      19  'gtk3'
    
      20  'nss'
    
      21  'libcups'
    
      22  'mesa'
    
      23  'alsa-lib'
    
      24)
    
      25
    
      26provides=("${_appname}")
    
      27conflicts=("${_appname}")
    
      28
    
      29source_x86_64=("${_appname}_${pkgver}_${arch[0]}.deb::https://static.aionui.com/releases/${pkgver}/AionUi-${pkgver}-${_barch[0]}.deb")
    
      30source_aarch64=("${_appname}_${pkgver}_${arch[1]}.deb::https://static.aionui.com/releases/${pkgver}/AionUi-${pkgver}-${_barch[1]}.deb")
    
      31
    
      32sha256sums_x86_64=('d00f16bfd689d94e4f2e5f425322ac1f2990e5e75071e0d9e47baf125dc9a523')
    
      33sha256sums_aarch64=('d4bb8970bb7310b85e94919b8fbce9e46db234e0e435451ddfe5c8c4aa36e911')
    
      34
    
      35package() {
    
      36  # .deb 包本质是一个 ar 归档文件，先用 ar 命令解开
    
      37  ar x "${srcdir}/${_appname}_${pkgver}_${CARCH}.deb"
    
      38
    
      39  # 将核心文件 data.tar.xz 解压到打包目录中
    
      40  # bsdtar 会自动保留正确的文件权限
    
      41  bsdtar -xf data.tar.xz -C "${pkgdir}/"
    
      42
    
      43  sed -i 's#^Icon=aionui#Icon=/usr/share/icons/hicolor/1024x1024/apps/AionUi.png#' "${pkgdir}/usr/share/applications/AionUi.desktop"
    
      44  sed -i 's/^Comment=\${description}/Comment=AionUi for agent/' "${pkgdir}/usr/share/applications/AionUi.desktop"
    
      45
    
      46  # (可选但推荐) 移除 Debian 特有的 lintian 目录，它在 Arch Linux 中没有用处
    
      47  rm -rf "${pkgdir}/usr/share/lintian"
    
      48
    
      49  # 确保所有文件的所有者是 root，这是标准做法
    
      50  chown -R root:root "${pkgdir}"
    
      51}
    
      52

Scan history

Scanned at (UTC)	Severity	Rules
2026-10-02 00:00:32	Medium	2
2026-10-01 00:02:06	Medium	2
2026-09-30 00:20:07	Medium	2
2026-09-29 00:07:46	Medium	2
2026-09-28 00:28:32	Medium	2
2026-09-27 00:07:07	Medium	2
2026-09-26 00:12:15	Medium	2
2026-09-25 00:03:36	Medium	2
2026-09-24 00:24:14	Medium	2
2026-09-23 00:28:13	Medium	2
2026-09-22 00:15:14	Medium	2
2026-09-21 00:26:32	Medium	2
2026-09-20 00:25:31	Medium	2
2026-09-19 00:25:36	Medium	2
2026-09-18 00:17:11	Medium	2
2026-09-17 00:27:14	Medium	2
2026-09-16 00:03:17	Medium	2
2026-09-15 00:25:31	Medium	2
2026-09-14 00:27:57	Medium	2
2026-09-13 00:19:54	Medium	2