aionui-bin

maintainer neko_ayaya · 2 votes · scanned 2026-08-18 00:03:42.021799

MEDIUM

Why flagged The package downloads prebuilt .deb binaries from a non-whitelisted, project-specific host (static.aionui.com), which presents a supply-chain risk if the host is compromised or controlled by an unrelated party; however, the checksums are provided and the payload is unpacked without executing remote code.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:29 source_x86_64=("${_appname}_${pkgver}_${arch[0]}.deb::https://static.aionui.com/releases/${pkgver}/AionUi-${pkgver}-${_barch[0]}.deb")

MEDIUM AI review llm_review

An AI model (qwen/qwen3-235b-a22b-2507) reviewed this and agrees it is MEDIUM (confidence 95%): The package downloads prebuilt .deb binaries from a non-whitelisted, project-specific host (static.aionui.com), which presents a supply-chain risk if the host is compromised or controlled by an unrelated party; however, the checksums are provided and the payload is unpacked without executing remote code.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: neko_ayaya
    
      2# Maintainer: Rafael Dominiquini <rafaeldominiquini at gmail dot com>
    
      3
    
      4_appname=aionui
    
      5
    
      6pkgname=${_appname}-bin
    
      7pkgver=2.1.54
    
      8pkgrel=1
    
      9pkgdesc="Transform your command-line experience into a modern, efficient AI Chat interface."
    
      10
    
      11arch=('x86_64' 'aarch64')
    
      12_barch=('linux-amd64' 'linux-arm64')
    
      13
    
      14url="https://github.com/iOfficeAI/AionUi" # <-- 示例网址，请替换为官方项目地址
    
      15
    
      16license=('Apache-2.0')
    
      17
    
      18depends=(
    
      19  'gtk3'
    
      20  'nss'
    
      21  'libcups'
    
      22  'mesa'
    
      23  'alsa-lib'
    
      24)
    
      25
    
      26provides=("${_appname}")
    
      27conflicts=("${_appname}")
    
      28
    
      29source_x86_64=("${_appname}_${pkgver}_${arch[0]}.deb::https://static.aionui.com/releases/${pkgver}/AionUi-${pkgver}-${_barch[0]}.deb")
    
      30source_aarch64=("${_appname}_${pkgver}_${arch[1]}.deb::https://static.aionui.com/releases/${pkgver}/AionUi-${pkgver}-${_barch[1]}.deb")
    
      31
    
      32sha256sums_x86_64=('d00f16bfd689d94e4f2e5f425322ac1f2990e5e75071e0d9e47baf125dc9a523')
    
      33sha256sums_aarch64=('d4bb8970bb7310b85e94919b8fbce9e46db234e0e435451ddfe5c8c4aa36e911')
    
      34
    
      35package() {
    
      36  # .deb 包本质是一个 ar 归档文件，先用 ar 命令解开
    
      37  ar x "${srcdir}/${_appname}_${pkgver}_${CARCH}.deb"
    
      38
    
      39  # 将核心文件 data.tar.xz 解压到打包目录中
    
      40  # bsdtar 会自动保留正确的文件权限
    
      41  bsdtar -xf data.tar.xz -C "${pkgdir}/"
    
      42
    
      43  sed -i 's#^Icon=aionui#Icon=/usr/share/icons/hicolor/1024x1024/apps/AionUi.png#' "${pkgdir}/usr/share/applications/AionUi.desktop"
    
      44  sed -i 's/^Comment=\${description}/Comment=AionUi for agent/' "${pkgdir}/usr/share/applications/AionUi.desktop"
    
      45
    
      46  # (可选但推荐) 移除 Debian 特有的 lintian 目录，它在 Arch Linux 中没有用处
    
      47  rm -rf "${pkgdir}/usr/share/lintian"
    
      48
    
      49  # 确保所有文件的所有者是 root，这是标准做法
    
      50  chown -R root:root "${pkgdir}"
    
      51}
    
      52

Changes since previous scan

--- PKGBUILD @ 2026-08-13 00:17
+++ PKGBUILD @ 2026-08-18 00:03
@@ -4,7 +4,7 @@
 _appname=aionui
 
 pkgname=${_appname}-bin
-pkgver=2.1.52
+pkgver=2.1.54
 pkgrel=1
 pkgdesc="Transform your command-line experience into a modern, efficient AI Chat interface."
 
@@ -29,8 +29,8 @@
 source_x86_64=("${_appname}_${pkgver}_${arch[0]}.deb::https://static.aionui.com/releases/${pkgver}/AionUi-${pkgver}-${_barch[0]}.deb")
 source_aarch64=("${_appname}_${pkgver}_${arch[1]}.deb::https://static.aionui.com/releases/${pkgver}/AionUi-${pkgver}-${_barch[1]}.deb")
 
-sha256sums_x86_64=('0cf22a18033829d2c98350c4ae351d54ca144570dac25ee3b48509362ae3cb3d')
-sha256sums_aarch64=('62d6b01f1e71c7f20ae7f2b96b743c99f9663f8a193469dd701bd49a7f24f126')
+sha256sums_x86_64=('d00f16bfd689d94e4f2e5f425322ac1f2990e5e75071e0d9e47baf125dc9a523')
+sha256sums_aarch64=('d4bb8970bb7310b85e94919b8fbce9e46db234e0e435451ddfe5c8c4aa36e911')
 
 package() {
   # .deb 包本质是一个 ar 归档文件，先用 ar 命令解开

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-18 00:03:42	MEDIUM	2
2026-08-17 00:18:29	MEDIUM	2
2026-08-16 00:03:42	MEDIUM	2
2026-08-15 00:26:13	MEDIUM	2
2026-08-14 00:03:41	MEDIUM	2
2026-08-13 05:25:33	MEDIUM	2
2026-08-13 00:17:07	MEDIUM	2
2026-08-12 00:27:08	MEDIUM	2
2026-08-11 13:21:13	MEDIUM	2
2026-07-31 19:18:43	CLEAN	0
2026-07-30 19:16:23	CLEAN	0
2026-07-29 19:12:33	CLEAN	0
2026-07-28 19:39:35	CLEAN	0
2026-07-24 19:28:12	CLEAN	0
2026-07-23 19:25:44	CLEAN	0
2026-07-21 19:17:41	CLEAN	0
2026-07-20 19:14:42	CLEAN	0
2026-07-18 17:58:54	CLEAN	0
2026-07-18 15:58:03	CLEAN	0
2026-07-17 17:55:33	CLEAN	0