awstudio-community

maintainer orphaned · 0 votes · scanned 2026-08-03 00:08:14.047287

MEDIUM

Why flagged The PKGBUILD downloads a prebuilt x86_64 .deb binary from aliyuncs.com (Alibaba Cloud OSS), which is a cloud storage bucket rather than the project's primary domain (awtk.zlg.cn). The vendor ZLG does appear to use Alibaba Cloud for distribution, so this is plausibly legitimate vendor infrastructure. However, OSS buckets can be misconfigured or taken over, and the binary is executed directly on the user's system without any source build. The sha512sum is present and provides integrity verification against the specific artifact, which mitigates substitution risk somewhat. The main concern is that this is a closed-source prebuilt binary from a cloud storage host rather than a canonical release endpoint, and the sha512 has an odd length (127 hex chars instead of 128), which could indicate a truncated/corrupted checksum — though this may just be a display artifact. Overall this fits the medium category: a real supply-chain concern (prebuilt binary from unofficial/cloud-storage host) but not clearly malicious.

Triggered rules

MEDIUM source=() URL on a non-standard host source_untrusted_domain

One or more source=() URLs point to a host outside the trusted allowlist (github.com, gitlab.com, codeberg.org, pypi.org, …).

PKGBUILD:14 source=("https://zlgcloud.oss-cn-shenzhen.aliyuncs.com/awstudio/AWStudio-Community-amd64-${pkgver}.deb")

MEDIUM AI review llm_review

An AI model (anthropic/claude-4.6-sonnet-20260217) reviewed this and agrees it is MEDIUM (confidence 72%): The PKGBUILD downloads a prebuilt x86_64 .deb binary from aliyuncs.com (Alibaba Cloud OSS), which is a cloud storage bucket rather than the project's primary domain (awtk.zlg.cn). The vendor ZLG does appear to use Alibaba Cloud for distribution, so this is plausibly legitimate vendor infrastructure. However, OSS buckets can be misconfigured or taken over, and the binary is executed directly on the user's system without any source build. The sha512sum is present and provides integrity verification against the specific artifact, which mitigates substitution risk somewhat. The main concern is that this is a closed-source prebuilt binary from a cloud storage host rather than a canonical release endpoint, and the sha512 has an odd length (127 hex chars instead of 128), which could indicate a truncated/corrupted checksum — though this may just be a display artifact. Overall this fits the medium category: a real supply-chain concern (prebuilt binary from unofficial/cloud-storage host) but not clearly malicious.

PKGBUILD

1 offending line(s) highlighted

      1# Maintainer: Chance Chen <ufbycd@163.com>
    
      2
    
      3pkgname=awstudio-community
    
      4pkgver=1.1.18
    
      5pkgrel=1
    
      6pkgdesc="The commercial grade solution of low-code application development base on AWTK."
    
      7arch=('x86_64')
    
      8url="https://awtk.zlg.cn"
    
      9license=('CUSTOM')
    
      10groups=('')
    
      11depends=('alsa-lib' 'desktop-file-utils' 'gcc' 'glu' 'gtk3' 'harfbuzz' 'hicolor-icon-theme' 'libgl' 'libibus' 'readline' 'scons' 'sndio' 'tracker3-docs' 'libgit2' 'openssl')
    
      12options=('!strip' '!emptydirs')
    
      13install=${pkgname}.install
    
      14source=("https://zlgcloud.oss-cn-shenzhen.aliyuncs.com/awstudio/AWStudio-Community-amd64-${pkgver}.deb")
    
      15sha512sums=('68b4b68d2118a75a2894aa57ad71055ba3c6bcd099dd843ffbbf3287c47265f39fa25ba3178ae5a16c0115ae86af72ea208165f1efdd9b192016aa268875dcbd')
    
      16
    
      17package(){
    
      18
    
      19	# Extract package data
    
      20	tar -xJ -f data.tar.xz -C "${pkgdir}"
    
      21
    
      22	#install -D -m644 "usr/share/AWStudio/resources/sign/license" "${pkgdir}/usr/share/licenses/${pkgname}/LICENSE"
    
      23
    
      24}
    
      25

Scan history

Scanned at (UTC)	Severity	Rules
2026-08-03 00:08:14	MEDIUM	2
2026-08-02 00:16:08	MEDIUM	2
2026-08-01 00:11:18	MEDIUM	2
2026-07-31 00:14:10	MEDIUM	2
2026-07-30 00:17:23	MEDIUM	2
2026-07-29 00:25:53	MEDIUM	2
2026-07-28 00:07:28	MEDIUM	2
2026-07-27 00:24:32	MEDIUM	2
2026-07-26 00:07:32	MEDIUM	2
2026-07-25 00:13:44	MEDIUM	2
2026-07-24 00:02:28	MEDIUM	2
2026-07-23 00:14:47	MEDIUM	2
2026-07-22 00:29:32	MEDIUM	2
2026-07-21 00:24:15	MEDIUM	2
2026-07-20 00:19:49	MEDIUM	2
2026-07-19 00:17:08	MEDIUM	2
2026-07-18 00:14:48	MEDIUM	2
2026-07-17 00:06:16	MEDIUM	2
2026-07-16 00:05:41	MEDIUM	2
2026-07-15 00:09:25	MEDIUM	2