awesun

maintainer ExplodingDragon · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt x86_64 .deb binary from dl.oray.com (the official Oray/Sunlogin vendor CDN) and installs it directly into /opt. This is a legitimate vendor distribution channel for a well-known Chinese remote-desktop product, so it is not an unofficial or personal host. However, the sha256sum for the LICENSE source is 'SKIP', and the binary .deb has a checksum that cannot be independently verified against a signed manifest. The package installs a closed-source remote-control daemon (with a systemd service) and uses patchelf to adjust rpath on bundled .so files. The core concern is that a prebuilt proprietary binary with remote-control capabilities is pulled from a CDN without signature verification — a real supply-chain risk if the CDN were compromised or the URL silently redirected. This is a genuine medium: executed closed-source binary from a vendor CDN with no cryptographic chain of trust beyond a single SHA-256 hash, and the LICENSE checksum is explicitly skipped.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:24 source=("LICENSE::https://service.oray.com/question/1820.html")
PKGBUILD:25 source_x86_64=("https://dl.oray.com/sl/linux/${pkgname}-${pkgver}-x86_64.deb")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt x86_64 .deb binary from dl.oray.com (the official Oray/Sunlogin vendor CDN) and installs it directly into /opt. This is a legitimate vendor distribution channel for a well-known Chinese remote-desktop product, so it is not an unofficial or personal host. However, the sha256sum for the LICENSE source is 'SKIP', and the binary .deb has a checksum that cannot be independently verified against a signed manifest. The package installs a closed-source remote-control daemon (with a systemd service) and uses patchelf to adjust rpath on bundled .so files. The core concern is that a prebuilt proprietary binary with remote-control capabilities is pulled from a CDN without signature verification — a real supply-chain risk if the CDN were compromised or the URL silently redirected. This is a genuine medium: executed closed-source binary from a vendor CDN with no cryptographic chain of trust beyond a single SHA-256 hash, and the LICENSE checksum is explicitly skipped.

PKGBUILD

2 offending line(s) highlighted

      1# Maintainer: yjun <jerrysteve1101 at gmail dot com>
    
      2# Maintainer: zhullyb <zhullyb at outlook dot com>
    
      3# Maintainer: ExplodingDragon <explodingfkl at gmail dot com>
    
      4
    
      5pkgname=awesun
    
      6pkgver=16.5.0.30560
    
      7pkgrel=1
    
      8pkgdesc="Proprietary remote control software for mobile devices, Windows, Mac, Linux and other systems. (GUI version)"
    
      9arch=("x86_64")
    
      10url="https://sunlogin.oray.com"
    
      11depends=("libappindicator-gtk3"
    
      12         "gtk3"
    
      13         "webkit2gtk-4.1"
    
      14         "libnotify"
    
      15         "util-linux-libs"
    
      16         "libepoxy"
    
      17         "xorg-xhost"
    
      18         "libcrypt.so=1-64")
    
      19makedepends=("patchelf")
    
      20license=("custom")
    
      21provides=("sunlogin" "sunloginclient")
    
      22conflicts=("sunloginclient")
    
      23backup=("etc/orayconfig.conf")
    
      24source=("LICENSE::https://service.oray.com/question/1820.html")
    
      25source_x86_64=("https://dl.oray.com/sl/linux/${pkgname}-${pkgver}-x86_64.deb")
    
      26install="${pkgname}.install"
    
      27options=(emptydirs !debug !strip)
    
      28sha256sums=("SKIP")
    
      29sha256sums_x86_64=("eda3fffe6d5324afbc4f939f0cb85c08b7851efad3c01878621474ec7503d10f")
    
      30
    
      31build() {
    
      32  mkdir -p build
    
      33  tar -xf data.tar.xz -C build
    
      34}
    
      35
    
      36package() {
    
      37  cd "${srcdir}/build"
    
      38
    
      39  install -dm755 "${pkgdir}/opt"
    
      40  cp -dpr --no-preserve=ownership "usr/local/${pkgname}" \
    
      41    "${pkgdir}/opt/${pkgname}"
    
      42
    
      43  install -dm755 "${pkgdir}/usr/local"
    
      44  ln -s "/opt/${pkgname}" "${pkgdir}/usr/local/${pkgname}"
    
      45
    
      46  while IFS= read -r lib; do
    
      47    patchelf --set-rpath '$ORIGIN' "$lib"
    
      48  done < <(find "${pkgdir}/opt/${pkgname}/lib" -maxdepth 1 -type f -name '*.so' ! -name 'libflutter_linux_gtk.so' | sort)
    
      49
    
      50  patchelf --set-rpath '$ORIGIN' \
    
      51    "${pkgdir}/opt/${pkgname}/lib/libsl_dart_core_plugin.so"
    
      52
    
      53  install -dm755 "${pkgdir}/usr/bin"
    
      54  ln -s "/opt/${pkgname}/awesun" "${pkgdir}/usr/bin/${pkgname}"
    
      55
    
      56  install -Dm644 "usr/local/${pkgname}/awesun.png" \
    
      57    "${pkgdir}/usr/share/pixmaps/${pkgname}.png"
    
      58
    
      59  install -Dm644 "usr/share/applications/${pkgname}.desktop" \
    
      60    "${pkgdir}/usr/share/applications/${pkgname}.desktop"
    
      61  sed -i \
    
      62    -e "s#^Exec=.*#Exec=/usr/bin/${pkgname}#" \
    
      63    -e "s#^Icon=.*#Icon=${pkgname}#" \
    
      64    "${pkgdir}/usr/share/applications/${pkgname}.desktop"
    
      65
    
      66  install -Dm644 "usr/local/${pkgname}/scripts/runawesun.service" \
    
      67    "${pkgdir}/usr/lib/systemd/system/run${pkgname}.service"
    
      68  sed -i \
    
      69    -e "s#/usr/local/${pkgname}#/opt/${pkgname}#g" \
    
      70    "${pkgdir}/usr/lib/systemd/system/run${pkgname}.service"
    
      71
    
      72  install -dm755 "${pkgdir}/etc"
    
      73  : > "${pkgdir}/etc/orayconfig.conf"
    
      74  chmod 644 "${pkgdir}/etc/orayconfig.conf"
    
      75
    
      76  install -Dm644 "${srcdir}/LICENSE" \
    
      77    "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      78}
    
      79# vim: ts=2 sw=2 et:
    
      80

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2